NetNews Usenet Archive 1992 #23/NN_1992_23.iso/spool/sci/crypt/3674

Text File | 1992-10-07 | 3.8 KB | 78 lines

Newsgroups: sci.crypt
Path: sparky!uunet!wupost!gumby!destroyer!cs.ubc.ca!van-bc!sqwest!mch
From: [e-mail] (Mark C. Henderson)
Subject: Re: Various Tangents (was Re: PGP *2.0* available)
Message-ID: <[e-mail]>
Organization: SoftQuad Inc., Surrey, British Columbia, CANADA
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Thu, 8 Oct 1992 00:27:18 GMT
Lines: 67

In article <[e-mail]> [e-mail] (Christopher Browne) writes:
>...
>Many of the discussions that have gone under this subject line REALLY
>should fall under a subject like: "Key Transmission."
>
>And I think a good point has been brought up:
>
>For most of the people playing with PGP, the actual security of the
>system is really not ALL that important.
>
>If someone is REALLY interested in security, it is because there are
>two or more people that have some CRITICAL communications.  And
>...
>They'll dictate armour code numbers over the telephone if they have
>to; they'll more likely send a printout/disk containing the keys
>
>- It's FUN to feel that you get to "fool" sundry government agencies
>- It's FUN to try to figure out ways of breaking the system
>- It's FUN to try to figure out ways of strengthening the system

There are all sorts of uses for PGP and the various alternatives with
less than perfect key verification and hence far less than perfect
privacy/authentication.

1. Mail is often misdirected unintentionally. Life is like that. Your
sysadmin probably sees at least part of a message not intended for
his/her eyes on a regular basis. Sometimes mail even ends up in the
wrong mailbox. If it is encrypted, your privacy is probably not
compromised. For instance, the day before yesterday, due to a bizarre
system problem at one of our feed sites, my boss received a mail
message directed to me (true story). These things happen.

2. It is possible for more or less any determined knowledgable user
on a unix system (for example) to read your mail. If it is encrypted
he/she has one more hoop to jump through before he/she can read it.

3. With some method of key verification (even finger!) you are a lot
less likely to be taken in by a forgery. Of course, some god-like
organisation, can spoof all your lines of communications. But if some
country's government wants the information on your computer they can
probably get it anyway. However, anyone with a little knowledge can
forge E-mail and news articles at will. Most of us can't spoof all
of the finger requests from system x to system y on the internet. Of
course, your system software could be rewritten, your router might be
grabbing packets and the CIA might be sitting outside your house
grabbing all of the electromagnetic radiation from your computer
monitor.

People have said it here before. If you want perfect security for your
communications, you are out of luck. However if you want a greater
degree of privacy, PGP used with some, but not extraordinary care,
will give you that. I'm personally not worried about the possibility
of someone sitting outside of my home picking up the electromagnetic
radiation from my computer screen.

For the sake of an analogy. People put burglar alarms in their houses
not to give them perfect security, but to make it more difficult to
steal or damage their goods/homes. Anyone with sufficient skill,
determination, and resources will probably be able to circumvent most
alarm systems. Same thing with privacy enhanced email.

Mark
--
Mark Henderson, SoftQuad Inc, 108-10070 King George Hwy, Surrey, B.C. V3T 2W4
Internet:   [e-mail], [e-mail]
UUCP: {van-bc,sq}!sqwest!mch Telephone: [phone]  Fax: [phone]
RIPEM public key available by Email, finger [e-mail] or keyserver