From: "Richard Martin" <rmartin@aw.sgi.com>
Date: Thu, 18 Jan 96 09:17:16 PST
To: cypherpunks@toad.com
Subject: Re: Espionage-enabled Lotus notes.
In-Reply-To: <9601181638.AA01736@zorch.w3.org>
Message-ID: <9601181216.ZM26755@glacius.alias.com>
MIME-Version: 1.0
Content-Type: text/plain



-----BEGIN PGP SIGNED MESSAGE-----


On Jan 18, 11:38am, hallam@w3.org wrote:
> The problem with this system is that it is quite likely to suceed. Unlike
> Clipper which made unfettered access to encrypted material possible the
> escrowed key strength reduction means that the FBI can tap a significant
> number of locations, just not all of them.

The Lotus `solution' seems to be the action of an American company
shipping a product which effectively says to foreign users, "We don't
care about you as a market." That this is the so-called "export"
version is ironic. The keys are escrowed with the U.S. government,
and no one else. The French government should rightly cry foul, for
this is (a) encryption where they don't have the keys and (b) encryption
where another government *does*.

For the world where industrial espionage is supposed to be becoming
the top priority and  where there have already been ugly accusations among
teams at trade talks, the NSA has just scored a victory on two fronts.

They've forced a major company (they don't come much more major than IBM)
to ship a product which actually helps them in both aspects of their
mandate. Communications interception of foreign industries' groupware
is now easier for the U.S. than for any other country, while (and
this must be granted) the communications security of American
industries will be somewhat improved by this move.

This is a win for the NSA, whose mandate (much as their Canadian
counterpart) would appear to read:
	We help you make sure that no-one can read your e-mail, except us.

The sick thing is, Notes will probably *still* be the best choice,
despite these matters (compared to competition from other similar software,
and from the web). For all the `Notes is dead, long live the web'
talk, the web as I've used it lacks authentication and access control
beyond an all-or-none system. I'll go check w3.org again.

richard

- --
Richard Martin
Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team]
rmartin@aw.sgi.com/g4frodo@cdf.toronto.edu      http://www.io.org/~samwise
Trinity College UofT ChemPhysCompSci 9T7+PEY=9T8 Shad Valley Waterloo 1992


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMP6AYx1gtCYLvIJ1AQHd1gP9GkTInUub19NPVtIHARULq4g/ifCpMp4g
P1U5FwtHrAfoDvgmwP275JUj/4zfJZ6p7YYnI10ihPD/Jjt6RmEmU/1D6N2XAeuc
chr70nuWVpnUxUXhkSvhDcebDz/FejMAFx9ko3xIkQQDYYstsA+tJBadMPosC8Ec
PEMPVbdfkRA=
=zPD2
-----END PGP SIGNATURE-----