Re: signing messages

[tcmay@netcom.com (Timothy C. May)]

(I haven't been getting list mail all day...just a few message getting
through Netcom's mail bouncer, so....)

Greg Broiles wrote:

> Seems like one way to encourage the use of digital signatures is to
> start forging messages from people who don't ordinarily sign their
> messages. Necessity is the mother of invention, and all of that.
> 
> I finally started signing my messages on a regular basis as a result
> of Detweiler forging a message which purported to be from me. On the
> other hand, I think Tim has been the most frequent target of 
> Detweiler's forgeries, and I don't detect much of a creep towards
> signing messages on his part. 

Several points, and I'll try not to repeat points I made in my long
essay of early this morning:

1. Only one person has reported to me that they were unable to verify
my PGP sig (Lance Cottrell reported this...if others did, maybe their
messages haven't gotten through to me)). From this I conclude that few
people check PGP sigs.

(The "PGP 2.7" and the ASCII message in the sig might've provided some
clues.) 

2. This does not make such sigs useless of course, as the main value
is in "critical" situations. (Legal cases, forgeries, diplomacy,
contracts, etc.)

3. Again, crypto is about economics. In the military, crypto is a big
part of operations (maybe 5% of staff on ships is connected with
crypto, communications, etc.). But the military has real needs, and
can afford (via our tax dollars) to have such efforts. Most of us are
not dealing with such critical uses.

4. Speaking for myself, I have not generated or transmitted a file I
felt *needed* to be signed, encrypted, etc. This is not to say such
situations don't exist for others, won't someday exist for me, etc.
Just things as they now stand.

(When contracts are handled electronically, when payments are made
electronically, etc., then such uses will be more apparent. But I am
fairly open about my politics--indeed, I fly the flag of crypto
anarchy in visible places--and have few files I transmit that I need
to encrypt. Your mileage may vary.)

5. The Detweiler thing was amusing. No such thing as bad publicity
(unless it's the Pinto-um RISK chip). Detweiler's forgeries had no
legal effect on me, no lasting effect. Also, those who were  "taken
in" by his forgeries would hardly be in a position to verify my sig
(to know who I was, to look up my PK on a keyserver, to jump through
the hoops needed, and to ensure that the "Tim May" they checked was
not in fact a phony keyserver entry...the several "BlackNet" public
keys, only one of which I generated, are instructive).

I don't discourage anyone from using crypto, from signing messages,
from routinely encrypting, etc. I just reject arguments that crypto is
"essential," today, when in fact it clearly isn't. Crying wolf and all
that.

In 2-4 years, a lot of the current incompatibilities and lack of
usability will have been worked out. About the time I expect to
actually _need_ to use more crypto.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
Cypherpunks list: majordomo@toad.com with body message of only: 
subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tcmay