Date: Mon, 24 Aug 92 20:21:32 EDT
From: uunet!Camex.COM!kent@uunet.uu.net
Newsgroups: comp.society.privacy
Subject: Re:  Computer Privacy Digest V1#073
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 074, Message 2 of 4

Edward A. Bertsch (eab@msc.edu) wonders about my reaction to By Way of
Deception:

>I don't understand.  It made you want to start encrypting your personal
>communications, or it made you worry what people would think if you
>were encrypting your personal communications ? (or did it make you
>worry if you were encrypting your personal communications with a
>strong enough algorithm on a secure machine with coresident software
>you could trust and a bios the feds hadn't gotten their fingers
>into?) et cetera.

Well, I had made the mistake of arriving in Las Vegas for a tradeshow
without enough reading material.  Being the kind of town it is, there
are very few books available within walking distance of the Riveria,
so I was very happy to find By Way of Deception--and sad once I
finished it.

The visceral effect of reading a modern, practical book on spying in a
place like Las Vegas can be significant.  One result is that I suspect
my hotel room hiding place for small valuables ('slick' I think is the
technical term) was much better than it otherwise would have been.
The book generally made we see things as a spy might, it made me see
spy-like puzzles everywhere.

The best puzzle was wondering how I could send a secure message to,
say, my mother.  We do email (don't all of you have grayhaired mothers
online?, mine is at "borgh@aol.com"), I had a Mac in my room--but I
assumed that anything I sent by modem or voice calls was "in the
open".  I also assumed that Stuffit 1.5.1's "NewDE Encrypt" is pretty
secure.  (Is it??)  

OK, I could send an encrypted message, but how do I get a secure key
to my mother?

I emailed it, in plain text, simple prose--but in a form that only she
would understand.  I dredged through my memory.  I needed a clue,
something she would get, something that was not a matter of public or
private record, something that could not be weazeled out of her in a
"chance meeting" at the grocery store.

When she got it she thought I was acting a bit crazy, didn't know
where to begin, and sent email asking for more help.  Before she got
my coy response, she had figured it out.

We still use this password.  My mother has spent enough time reading
spy novels that I trust that she didn't write it down anywhere, and
didn't and wouldn't tell anyone.

The password itself is the initial letters of a short phrase.  I think
my clue said how many words long it was, but beyond that it was pretty
obscure.  (I don't want to risk repeating it here without looking up
my exact original wording--no point in offering more clues to the
NSA.)

Have I fooled myself about how secure this is?  I don't think so.
First--at least until I posted this--I can't believe I am worth spying
on.  Second, once they do start bugging me, I don't believe the
available spies are particularly competent.  Third, I only offer high
odds on the security, I am not convinced 100%.

The weakest link is my mother's computer and keyboard.  It could be
physically bugged; or, because it is not tempest quality, it could be
tuned in on the radio.  They would still need to get her to type the
password--and because we mostly don't encrypt mail, this is not
trivial, sending a bogus mail message is pretty risky, word of it
would likely get back to me.

My primary computer these days is a notebook.  It is smaller and so a
lot harder to bug; it is low power and it moves, so it is harder to
tune in by radio.

Sure, given sufficient resources, *I* could crack something like this,
but it would be hard and risky.

If it turns out Stuffit 1.5.1 is not secure?, all bets are off.


This all makes me want a secure public system of public key
cryptography.  Too bad Apple doesn't dare put RSA for messages into
their coming O.C.E., instead they only use it for digital
signatures--though even signatures also would make it more of a pain
to a spy trying to break things, for it makes "social engineering" so
much harder if you cannot spoof messages.


>Edward A. Bertsch (eab@msc.edu)   Minnesota Supercomputer Center, Inc.

Hi from a former Minnesotan!


--
Kent Borg                                   kent@camex.com or kentborg@aol.com
                                            H:(617) 776-6899  W:(617) 426-3577
As always, things look better when some costs are left out.
						      -Economist 3-28-92 p. 94