Re: Clarification of challenge to Joseph Ashwood:

2002-11-03 Thread Joseph Ashwood
Sorry, I didn't bother reading the first message, and I won't bother reading any of the messages further in this thread either. Kong lacks critical functionality, and is fatally insecure for a wide variety of uses, in short it is beyond worthless, ranging into being a substantial risk to the securi

Re: What email encryption is actually in use?

2002-11-03 Thread Tyler Durden
"Prior to that, the encrypted email I've sent in the past year or so has almost always failed, because of version incompatibilities," While in Telecom I was auditing optical transport gear, and we adopted the practice of encrypting all of our audit reports to vendors. Of course, the chance of t

Re: What email encryption is actually in use?

2002-11-03 Thread Tim May
On Saturday, November 2, 2002, at 08:01 PM, Tyler Durden wrote: "Prior to that, the encrypted email I've sent in the past year or so has almost always failed, because of version incompatibilities," While in Telecom I was auditing optical transport gear, and we adopted the practice of encrypti

Interesting series of articles on GCHQ, Public Key etc.

2002-11-03 Thread Bo Elkjaer
List: This Is Gloucestershire has published an interesting little series of articles commemorating the GCHQ 50 years anniversary. The articles can be found at: http://www.thisisgloucestershire.co.uk/displayNode.jsp?nodeId=110560&command=newModule&sourceNode=84282 Yours Bo Elkjaer, Denmark I

Re: Clarification of challenge to Joseph Ashwood:

2002-11-03 Thread James A. Donald
-- Joseph Ashwood: > > > > So it's going to be broken by design. These are > > > > critical errors that will eliminate any semblance of > > > > security in your program. James A. Donald: > > > I challenge you to fool my canonicalization algorithm by > > > modifying a message to as to chan

Re: Katy, bar the door

2002-11-03 Thread Neil Johnson
On Saturday 02 November 2002 06:38 pm, Major Variola (ret) wrote: > Around a year ago a small private jet lost contact over the US. A jet > was > dispatched, saw iced windows, no response to signals. The plane was on > autopilot, eventually crashed > in the middle of nowhere. The passengers/pilo

Sending bricks through the mail

2002-11-03 Thread Major Variola (ret)
At 09:37 PM 11/2/02 -0800, Tim May wrote: >When I was at Intel we sent our designs for microprocessors to European >branches and/or partners. One set of designs sent to MATRA/Harris, a >partner in the 80C86, was stolen in transit. (The box of tapes arrived >in Paris, but the tapes had been replace

Re: What email encryption is actually in use?

2002-11-03 Thread Len Sassaman
On Sat, 2 Nov 2002, Tim May wrote: > PK crypto has made a lot of things a lot easier, but expecting it all > to work with a click of a button is naive. Of course, most of us don't > actually have secrets which make protocols and efforts justifiable. > There's the rub. I expect it to work with the

Re: What email encryption is actually in use?

2002-11-03 Thread Steve Furlong
On Sunday 03 November 2002 12:53, Len Sassaman wrote: > On Sat, 2 Nov 2002, Tim May wrote: > > PK crypto has made a lot of things a lot easier, but expecting it > > all to work with a click of a button is naive. Of course, most of > > us don't actually have secrets which make protocols and efforts

Re: Katy, bar the door

2002-11-03 Thread Tim May
On Sunday, November 3, 2002, at 07:41 AM, Neil Johnson wrote: On Saturday 02 November 2002 06:38 pm, Major Variola (ret) wrote: Around a year ago a small private jet lost contact over the US. A jet was dispatched, saw iced windows, no response to signals. The plane was on autopilot, eventual

Re: What email encryption is actually in use?

2002-11-03 Thread Adam Shostack
On Sun, Nov 03, 2002 at 11:23:36AM -0800, Tim May wrote: | I think most users, even casual ones, would accept this advice: | | "Look, encrypted text is just a rearrangement of text. Compose your | message in whatever editor or word processor you want, apply the | encryption directly to that text

Re: Integrated crypto sounds useful, but it's fragile and ultimately a lose

2002-11-03 Thread Adam Shostack
On Sun, Nov 03, 2002 at 12:41:11PM -0800, Tim May wrote: | To expand on this point a bit, I suspect one of the main reasons people | who once used PGP stop using it, either privately or at corporations | (as we have heard folks here testify about), is because something | changes and things "brea

Re: What email encryption is actually in use?

2002-11-03 Thread Tim May
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sunday, November 3, 2002, at 10:29 AM, Steve Furlong wrote: > > Agreed. Setup should be pretty simple, but daily use for the unwashed > masses has to be one-click. And version compatibility problems have > _got_ to disappear. Actually, PGP's Outl

Integrated crypto sounds useful, but it's fragile and ultimately a lose

2002-11-03 Thread Tim May
On Sunday, November 3, 2002, at 12:19 PM, Tim May wrote: As with the situation a decade ago, there are: * several OSes in use (2-3 in Wintel world, 2 in Mac world, plus outliers) * various release versions of each * about 5-8 major mail programs covering these platforms * about 3-5 major newsrea

Intel's LaGrab

2002-11-03 Thread Tim May
"New PCs Likely to Cede Some Control Sun Nov 3, 1:58 PM ET By MATTHEW FORDAHL, AP Technology Writer SAN JOSE, Calif. (AP) - To thwart hackers and foster online commerce, the next generation of computers will almost certainly cede some control to software firms, Hollywood and other outsiders.

Re: What email encryption is actually in use?

2002-11-03 Thread Major Variola (ret)
FWIW In the Si biz, its quite common to encrypt files. I've seen (albeit lame, and with guessable passwords) zip encryption and the classic crypt used. Between engineers, and between lawyers and engineers. Typically the encrypted info is an attachment to unencrypted email (often describing its co

Re: What email encryption is actually in use?

2002-11-03 Thread Tim May
On Sunday, November 3, 2002, at 06:14 PM, David W. Hodgins wrote: -BEGIN PGP SIGNED MESSAGE- The advantages really disappear, when the key used to sign the message isn't sent to the key servers {:. Those who need to know, know. You, I've never seen before. Even if you found my key

Re: Sending bricks through the mail

2002-11-03 Thread Steve Furlong
On Sunday 03 November 2002 17:17, Thoenen, Peter Mr. EPS wrote: > Tried emailing direct but bounced so apologize to the list for the OT > content :) > > -Original Message- > > From: Major Variola (ret) [mailto:mv@;cdc.gov] Peter, you might want to google on "variola major" (not "major va

Re: What email encryption is actually in use?

2002-11-03 Thread Tim May
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sunday, November 3, 2002, at 09:53 AM, Len Sassaman wrote: > What's naive is trying to ram such products down the public's > collective > throat. Cryptographic solutions are not of "all or nothing" strength. I > don't know why UI hasn't been the

Re: Sending bricks through the mail

2002-11-03 Thread Steve Schear
At 09:36 AM 11/3/2002 -0800, "Major Variola (ret)" <[EMAIL PROTECTED]> wrote: There exists a website by someone who enjoyed sending unusual things through the US mail. He once sent a brick, with proper postage, no envelope. Some friends used to wrap up bricks and returned them to companies they

Re: What email encryption is actually in use?

2002-11-03 Thread David W. Hodgins
-BEGIN PGP SIGNED MESSAGE- The advantages really disappear, when the key used to sign the message isn't sent to the key servers {:. Regards, Dave Hodgins. Tim May wrote: > > -BEGIN PGP SIGNED MESSAGE- > > (P.S. I'm going to do something I don't often do: sign a post. > Reasons

RE: Sending bricks through the mail

2002-11-03 Thread Thoenen, Peter Mr. EPS
Tried emailing direct but bounced so apologize to the list for the OT content :) You don't happen to have the url do you? Think it would make an amusing read. -Peter > -Original Message- > From: Major Variola (ret) [mailto:mv@;cdc.gov] > Sent: Sunday, November 03, 2002 18:37 > To: [EMAI

Re: Integrated crypto sounds useful, but it's fragile and ultimately a lose

2002-11-03 Thread Morlock Elloi
One solution that would work: 1. keep the text paradigm - cyphertext is just a text for everyone involved. 2. Extract encrypt/decrypt functionality into a device (D) with longer lifetime than OS/MUA/hw combo (C). (2) assumes text interface between (C) and (D). (D) could be a PDA that can OCR com

RE: Sending bricks through the mail

2002-11-03 Thread Thoenen, Peter Mr. EPS
<--smax self :) > -Original Message- > From: Steve Furlong [mailto:sfurlong@;acmenet.net] > Sent: Sunday, November 03, 2002 23:28 > To: [EMAIL PROTECTED] > Subject: Re: Sending bricks through the mail > > > On Sunday 03 November 2002 17:17, Thoenen, Peter Mr. EPS wrote: > > Tried emailin