Re: What email encryption is actually in use?

2002-10-02 Thread Len Sassaman
On Wed, 2 Oct 2002, Ben Laurie wrote: > Adam Shostack wrote: > > On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: > > | Lucky Green wrote: > > | >I also agree that current MTAs' implementations of STARTTLS are only a > > | >first step. At least in postfix, the only MTA with which I am

Re: What email encryption is actually in use?

2002-10-02 Thread James A. Donald
-- On 2 Oct 2002 at 16:19, Adam Shostack wrote: > Whats wrong with PGP sigs is that going on 9 full years after > I generated my first pgp key, my mom still can't use the > stuff. The fact that your mum cannot use the stuff is only half the problem. I am a computer expert, a key administr

Re: What email encryption is actually in use?

2002-10-02 Thread James A. Donald
-- James A. Donald wrote: > > And PGP tells me "signature not checked, key does not meet > > validity threshold" On 2 Oct 2002 at 20:40, Dave Howe wrote: > what version are you on? pgp 6.5.8 command line version. The actual problem was that there was no such key in my key ring, but error

RE: What email encryption is actually in use?

2002-10-02 Thread Lucky Green
Ben wrote: > Lucky Green wrote: > > I also agree that current MTAs' implementations of STARTTLS > are only a > > first step. At least in postfix, the only MTA with which I am > > sufficiently familiar to form an opinion, it appears impossible to > > require that certs presented by trusted part

Re: What email encryption is actually in use?

2002-10-02 Thread Adam Shostack
On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: | Lucky Green wrote: | >I also agree that current MTAs' implementations of STARTTLS are only a | >first step. At least in postfix, the only MTA with which I am | >sufficiently familiar to form an opinion, it appears impossible to | >requi

Re: JYA ping

2002-10-02 Thread Eugen Leitl
On Wed, 2 Oct 2002, Anonymous wrote: > Cryptome has nor been updated since 9/23 ... any clues, anyone ? No. Anyone knows whether John Young is okay?

Re: What email encryption is actually in use?

2002-10-02 Thread Ben Laurie
Adam Shostack wrote: > On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: > | Lucky Green wrote: > | >I also agree that current MTAs' implementations of STARTTLS are only a > | >first step. At least in postfix, the only MTA with which I am > | >sufficiently familiar to form an opinion, it

Re: What email encryption is actually in use?

2002-10-02 Thread Adam Shostack
On Wed, Oct 02, 2002 at 09:12:47PM +0100, Ben Laurie wrote: | Adam Shostack wrote: | >On Wed, Oct 02, 2002 at 04:54:54PM +0100, Ben Laurie wrote: | >| Lucky Green wrote: | >| >I also agree that current MTAs' implementations of STARTTLS are only a | >| >first step. At least in postfix, the only MTA

Re: What email encryption is actually in use?

2002-10-02 Thread Dave Howe
James A. Donald wrote: >> And PGP tells me "signature not checked, key does not meet > validity threshold" what version are you on? ckt never does that - it checks it, and marks the sig status as good or bad - but obviously marks the key status as invalid (due to lack of signing) on anyone I don't

Re: What email encryption is actually in use?

2002-10-02 Thread Paul Krumviede
--On Wednesday, 02 October, 2002 10:54 -0500 Jeremey Barrett <[EMAIL PROTECTED]> wrote: > Udhay Shankar N wrote: >| At 10:04 AM 10/2/02 -0500, Jeremey Barrett wrote: >| >|> Amusingly, virtually none of them support STARTLS on any other protocol. >|> :) IMAP and POP are almost all supported only

JYA ping

2002-10-02 Thread Anonymous
Cryptome has nor been updated since 9/23 ... any clues, anyone ?

Re: Court rules up-skirt peep cams legal

2002-10-02 Thread Major Variola (ret)
At 02:37 PM 10/1/02 -0700, Steve Schear wrote: >Court rules up-skirt peep cams legal > >In a ruling that could change fashions in Washington state, the supreme >court there has ruled that "up-skirt cams" do not violate voyeurism laws. > >[Using almost identical logic cities around the country hav

Re: What email encryption is actually in use?

2002-10-02 Thread James A. Donald
-- > > Once you start using it, it becomes part of hte pattern > > by wich other people identify you. On 2 Oct 2002 at 9:52, David Howe wrote: > Exactly the intention, yes :) Just for the sake of it (anyone > who cares will have seen my signature enough times by now) I > will sign

Re: What email encryption is actually in use?

2002-10-02 Thread Ben Laurie
Lucky Green wrote: > I also agree that current MTAs' implementations of STARTTLS are only a > first step. At least in postfix, the only MTA with which I am > sufficiently familiar to form an opinion, it appears impossible to > require that certs presented by trusted parties match a particular hash

Re: What email encryption is actually in use?

2002-10-02 Thread Jeremey Barrett
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Udhay Shankar N wrote: | At 10:04 AM 10/2/02 -0500, Jeremey Barrett wrote: | |> Amusingly, virtually none of them support STARTLS on any other protocol. |> :) IMAP and POP are almost all supported only on dedicated SSL ports |> (IMAPS, POP3S). Argh. |

Re: What email encryption is actually in use?

2002-10-02 Thread Jeremey Barrett
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bill Stewart wrote: | | If your organization is an ISP, the risks are letting them | handle your email at all (especially with currently proposed | mandatory eavesdropping laws), and STARTTLS provides a | mechanism for direct delivery that isn't as li

Re: What email encryption is actually in use?

2002-10-02 Thread David Howe
at Wednesday, October 02, 2002 3:13 AM, Peter Gutmann <[EMAIL PROTECTED]> was seen to say: > As opposed to more conventional encryption, where you're protecting > nothing at any point along the chain, because 99.99% of the user base > can't/won't use it. That is a different problem. if you assume

Re: What email encryption is actually in use?

2002-10-02 Thread Bill Stewart
At 09:05 AM 10/01/2002 -0700, Major Variola (ret) wrote: >So yes Alice at ABC.COM sends mail to Bob at XYZ.COM and >the SMTP link is encrypted, so the bored upstream-ISP netops >can't learn anything besides traffic analysis. >But once inside XYZ.COM, many unauthorized folks could >intercept Bob's

RE: What email encryption is actually in use?

2002-10-02 Thread Vin McLellan
I've always been intrigued by the volume of reports which indicate that when hackers or other outlaws raid a corporate site, the first thing they do is scan the stored email files of company executives. Funny, with all the attention focused pushing the user to encrypt email for transmission, n

Re: fun w/ the SS & chalk

2002-10-02 Thread Bill Stewart
At 09:11 AM 10/01/2002 -0700, Major Variola (ret) wrote: >After reading the last paragraph in the excerpt below, >it occurs to me how much fun could be had in DC with some chalk, >even without an 802.11blah receiver :-) Depending on how well-read the security folks are about warchalking, you can

Re: What email encryption is actually in use?

2002-10-02 Thread David Howe
-BEGIN PGP SIGNED MESSAGE- at Tuesday, October 01, 2002 9:04 PM, Petro <[EMAIL PROTECTED]> was seen to say: > Well, it's a start. Every mail server (except mx1 and > mx2.prserv.net) should use TLS. Its nice in theory, but in practice look how long it takes the bulk of the internet

Re: What email encryption is actually in use?

2002-10-02 Thread David Howe
at Tuesday, October 01, 2002 6:10 PM, James A. Donald <[EMAIL PROTECTED]> was seen to say: > Not so. It turns out the command line is now different in PGP > 6.5.8. It is now pgp -sta to clearsign, instead of pgp -sa. > (Needless to say the t option does not appear in pgp -h *nods* its in the 6.5

Re: What email encryption is actually in use?

2002-10-02 Thread David Howe
-BEGIN PGP SIGNED MESSAGE- at Tuesday, October 01, 2002 9:04 PM, Petro <[EMAIL PROTECTED]> was seen to say: > Well, it's a start. Every mail server (except mx1 and > mx2.prserv.net) should use TLS. Its nice in theory, but in practice look how long it takes the bulk of the internet