From: Tim May <tcmay@got.net>
Date: Thu, 23 Oct 1997 02:06:19 +0800
To: Declan McCullagh <aba@dcs.ex.ac.uk>
Subject: PGP, Inc.--What were they thinking?
In-Reply-To: <199710221356.OAA02611@server.test.net>
Message-ID: <v03102800b073eb6667df@[207.167.93.63]>
MIME-Version: 1.0
Content-Type: text/plain



At 9:17 AM -0700 10/22/97, Declan McCullagh wrote:

>As for CMR... I was travelling when the discussion started on cypherpunks
>so I haven't been following it very closely.
>
>My position is something along these lines: corporations have a right to go
>down the CMR path; it is unwise to restrict them through the coercive power
>of the state. At the same time, we need to speak out against crypto-foolish
>practices. If corporations start building CMR products, the political
>consequences could be devestating. It's like building a gallows for your
>own hanging.

Just to make things clear, none of us is arguing for any restrictions on a
corporation's adoption of CMR, nor of PGP, Inc.'s right to manufacture and
distribute CMR software.

Many of us think it is a foolish thing for PGP, Inc., especially, to be
building. Both because it helps Big Brother make his arguments (as he has
already, pace the testimony before Congress about key recovery being
practical because PGP, Inc. is now selling similar software), and because
of how it squanders the reputation capital of Phil Zimmermann and PGP, Inc.

Further, CMR addresses the wrong problems. For reasons I and Adam Back and
several others have discussed at length in the past couple of weeks.

>
>>From my perch in Washington, I see PGP 5.5/CMR as an existence proof that
>key recovery can be done. So far the crypto-advocates have been able to
>wave around the Blaze et al white paper that says we don't know how to do
>it. Even Dorothy Denning agreed. But now when a mandatory GAK bill goes to
>the House floor, all Rep. Solomon etc. have to do is wave around a
>shrinkwrapped copy of PGP and say: "I bought this for $19 at the Egghead
>shop at 21st and L." Details will be lost in the fearmongering.

Yep, they're already doing this. This was reported a week or so ago,
somewhere here in Cypherpunks.
>
>I suspect that there's not that substantial a market for CMR. The apparent
>market demand now is an artificial one created by the Clinton
>administration.

Agreed. What amazes me is how PGP, Inc. would decide this should be a core
part of their company. "PGP for Business," indeed. What were they thinking?

--Tim May

The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^2,976,221   | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."