From: "Ian Farquhar" <ianf@sydney.sgi.com>
Date: Tue, 27 Dec 94 16:10:36 PST
To: cypherpunks@toad.com
Subject: Re: Breaking into girlfriend's files
In-Reply-To: <199412230045.TAA21904@thor.cs.umass.edu>
Message-ID: <9412281058.ZM10837@wiley.sydney.sgi.com>
MIME-Version: 1.0
Content-Type: text/plain


On Dec 23,  1:11am, Mark Terka wrote:
> Oh goody! Now we are getting a judgement call with respect to how
cryptography
> in general aids "the greater good".

Please indicate where I said or implied this.  Possibly there is such
a thing as the "greater good", but I have seen it used too many times
to justify the applications of someone's personal beliefs or (more commonly)
phobias and personal problems to the world at large.  It's not a concept I
have a lot of respect for, purely on this basis.

Personally - and let's face it, none of us can express much more than
a personal opinion - I think the best that any of us can do is to base
our decisions on individual cases, which seems to have been what has
happened in this case.

> Do you suppose the NSA makes the same call when they do routine traffic
> analysis or try to bust a suspiciously (to them) encrypted message??????

No I don't.  On the other hand, I am sure that a whole load of judgement
calls go into the selection of individuals or subjects which go onto
watchlists.

> That to me indicates that the members of this list should be at least
> remotely interested in the subject of attacks as well as defense as you
> can't defend aginst something unless the method of attack has been discussed.

Agreed.  But that doesn't mean that the way you go around investigating
attacks on protocols and cryptosystems is to help a fairly pathetic
individual violate someone else's privacy.  To me, that just doesn't
follow.

> GROAN! (again) And how, pray tell, do we go about protecting ourselves
> against others if we are not prepared to discuss what sort of attacks
> may be mounted against us?????

I never said we should not discuss it.  But I do say that IN MY OPINION
the original poster who wanted help was a pathetic little slime, and that
IN MY OPINION, shouldn't be assisted to do anything.

Generic attacks on Norton's Encrypt are "valid" subjects for cypherpunks
discussion, which I would have thought goes without saying.  An even
better outcome would be to provide the girlfriend with some indication
of the true security against attack she is getting from the program,
and to replace it with something better if it turns out to be
inadequate.

> Like I alluded to before, I bet if it was a case of someone trying to
> descramble something like skipjack to try and discover something about
> National Security (ours OR theirs) I bet the members of this list
> would have fallen all over themselves trying to help the original poster.

I suppose that would depend on what the individuals concerned perceived
as the consequences of their action.

> I don't recall seeing too much in the waqy of condemnation of the guy that
> posted RC4 to this list ..... but as soon as we see something that touches
> close to home like male/female relationships, the shit hits the fan!!!!!

So?  Based on past conversations and discussions, many of us are here
because we don't like the idea of organisations or individuals being
able to arbitrarily violate our own privacy.  Speaking for myself, I know
that I have had my privacy violated on a couple of occasions, and have
become convinced that technical solutions are the way to go about it.
But it does not follow that I should help someone violate another's
privacy.  It seems that some people feel that their own privacy is
inviolate, yet others are fair game.

> >Possibly.  IMO, what the original requester was asking for was so
> >repulsive and immature that the responses so far have been mild.

> And in my opinion what the original poster was no different than the British
> attack on "Enigma" or the American attack on "Purple".

Well, wartime attacks like these are usually motivated by the belief
that a lot of people's lives depend on the success of the venture.
Whether this is true or not is debatable, and the lives in question are
usually on one side only.   I personally do not find the comparison
to be valid.

						Ian.

#include <std.disclaimer>