Re: Proof of Work - atmospheric carbon

2009-01-30 Thread John Levine
You know those crackpot ideas that keep showing up in snake oil crypto? Well, e-postage is snake oil antispam. While I think this statement may be true for POW coinage, because for a bot net it grows on trees, for money that traces back to the international monetary exchange system, it may not be

Re: Attack of the Wireless Worms

2009-01-30 Thread Jerry Leichter
On Jan 29, 2009, at 10:07 AM, Donald Eastlake wrote: Recent research has shown that a new and disturbing form of computer infection is readily spread: the epidemic copying of malicious code among wireless routers without the participation of intervening computers. Such an epidemic could easily

Re: full-disk subversion standards released

2009-01-30 Thread John Gilmore
If it comes from the Trusted Computing Group, you can pretty much assume that it will make your computer *less* trustworthy. Their idea of a trusted computer is one that random unrelated third parties can trust to subvert the will of the computer's owner. John

Re: Obama's secure PDA

2009-01-30 Thread Ivan Krstić
Multiple responses inline: On Jan 26, 2009, at 11:26 AM, Paul Hoffman wrote: I too would like to hear more information on this, particularly the crypto that is known to be used on the Edge. See sections 'Secure Speech Processing' and 'Interoperability' of

Re: Attack of the Wireless Worms

2009-01-30 Thread Peter Gutmann
Donald Eastlake d3e...@gmail.com writes: Recent research has shown that a new and disturbing form of computer infection is readily spread: the epidemic copying of malicious code among wireless routers without the participation of intervening computers. Such an epidemic could easily strike cities,

Re: Proof of Work - atmospheric carbon

2009-01-30 Thread Thomas Coppi
On Wed, Jan 28, 2009 at 2:19 PM, John Levine jo...@iecc.com wrote: Indeed. And don't forget that through the magic of botnets, the bad guys have vastly more compute power available than the good guys. Just out of curiosity, does anyone happen to know of any documented examples of a botnet

Re: full-disk subversion standards released

2009-01-30 Thread Thor Lancelot Simon
On Thu, Jan 29, 2009 at 01:22:37PM -0800, John Gilmore wrote: If it comes from the Trusted Computing Group, you can pretty much assume that it will make your computer *less* trustworthy. Their idea of a trusted computer is one that random unrelated third parties can trust to subvert the will

Re: full-disk subversion standards released

2009-01-30 Thread Jonathan Thornburg
On Thu, 29 Jan 2009, John Gilmore wrote: If it comes from the Trusted Computing Group, you can pretty much assume that it will make your computer *less* trustworthy. Their idea of a trusted computer is one that random unrelated third parties can trust to subvert the will of the computer's

UCE - a simpler approach using just digital signing?

2009-01-30 Thread Ray Dillinger
I have a disgustingly simple proposal. It seems to me that one of the primary reasons why UCE-limiting systems fail is the astonishing complexity of having a trust infrastructure maintained by trusted third parties or shared by more than one user. Indeed, trusted third party and trust shared

Re: UCE - a simpler approach using just digital signing?

2009-01-30 Thread Jerry Leichter
On Jan 30, 2009, at 4:47 PM, Ray Dillinger wrote: I have a disgustingly simple proposal. [Basically, always include a cryptographic token when you send mail; always require it when you receive mail.] There is little effective difference between this an whitelists. If I only accept mail

Re: Proof of Work - atmospheric carbon

2009-01-30 Thread John Levine
Richard Clayton and I claim that PoW doesn't work: http://www.cl.cam.ac.uk/~rnc1/proofwork.pdf I bumped into Cynthia Dwork, who originallyinvented PoW, at a CEAS meeting a couple of years ago, and she said she doesn't think it works, either. R's, John

Re: UCE - a simpler approach using just digital signing?

2009-01-30 Thread John Levine
Hi. One of the hats I wear is the chair of the Anti-Spam Research Group of the Internet Research Task Force, which is down the virtual hall from the IETF. You know how you all feel when someone shows up with his super duper new unbreakable crypto scheme? Well, that's kind of how I feel here.

Re: UCE - a simpler approach using just digital signing?

2009-01-30 Thread Taral
On Fri, Jan 30, 2009 at 1:47 PM, Ray Dillinger b...@sonic.net wrote: This is basic digital signatures; it would work. What's your transition plan? How do you deal with stolen trust tokens? (Think trojans/worms.) Also see: http://craphound.com/spamsolutions.txt -- Taral tar...@gmail.com Please

Re: full-disk subversion standards released

2009-01-30 Thread Taral
On Fri, Jan 30, 2009 at 1:41 PM, Jonathan Thornburg jth...@astro.indiana.edu wrote: For open-source software encryption (be it swap-space, file-system, and/or full-disk), the answer is yes: I can assess the developers' reputations, I can read the source code, and/or I can take note of what