Smaller is better.

On Mon, 05 Apr 93 12:36:09 PST,
 Jonathan Stigelman <uunet!transam.ece.cmu.edu!stig> writes -
 
JS> Yeah....  So if your key can be snooped off the net, so can your
JS> cleartext.  To decript online, then, is akin to using only weak
JS> encription...which indicates only the desire for limited privacy.
 
JS> But if even if you do decript online, you're still protected from
JS> file snooping.
 
JS> What's needed is PGP decription built into your terminal program.
 
 I think that you guys are missing the point here. IMHO, if you wish
 maximum assurance of security, than I'd suggest not trying to run
 programs such as PGP on a multi-user system to begin with! What's
 wrong with using a PC for this? It offfers a maximum convenience,
 single-user secure system quite unlike the security problems
 associated with your university's mainframe.
 
 The PC offers the communications availability and the flexibilty to
 provide an extremely high level of privacy, if you know what you're
 doing.
 
 You should try it sometime ....
 
 Cheers.
 

Paul Ferguson                     |  "Sincerity is fine, but it's no
Network Integration Consultant    |   excuse for stupidity."
Centreville, Virginia USA         |                       -- Anonymous
fergp@sytex.com     (Internet)    |
sytex.com!fergp     (UUNet)       |
1:109/229           (FidoNet)     |
       PGP 2.2 public encryption key available upon request.

Well, I guess I started this thread, so lets see if I can finish it... ;^)

> On Mon, 05 Apr 93 12:36:09 PST,
>  Jonathan Stigelman <uunet!transam.ece.cmu.edu!stig> writes -
> JS> Yeah....  So if your key can be snooped off the net, so can your
> JS> cleartext.  To decript online, then, is akin to using only weak
> JS> encription...which indicates only the desire for limited privacy.
> JS> But if even if you do decript online, you're still protected from
> JS> file snooping.

This is akin to using an umbrella with a hole in it and saying, "Well, at least 
my face doesn't get wet.  If you want to stay dry, you want to stay COMPLETELY
dry.

> JS> What's needed is PGP decription built into your terminal program.

Someone posted a program, link, that would encrypt modem communcations.  Would
you post an address for it.  I can't find where I put it.

>  I think that you guys are missing the point here. IMHO, if you wish
>  maximum assurance of security, than I'd suggest not trying to run
>  programs such as PGP on a multi-user system to begin with! What's
>  wrong with using a PC for this? It offfers a maximum convenience,
>  single-user secure system quite unlike the security problems
>  associated with your university's mainframe.

This is, IMHO, the best solution.  BTW, I have several telix scripts that make
it actually convenient, even at 1200 baud!  (gak!).  I would post them, but they
are trivial.  Thanx, Phantom, for the suggestion.  

What we need here is a "security package" that we distribute in an effort to 
make it easier to use secure practices.

>  The PC offers the communications availability and the flexibilty to
>  provide an extremely high level of privacy, if you know what you're
>  doing.

And many people don't...  I've taken a minor flame or two for asking for help 
with using pgp on this list.  The whole point of this list, IMHO, is to make
strong security practices as easy and as wide-spread as possible.  Correct me
if I'm wrong.

+----------------------+----------------------------------------------------+
| J. Michael Diehl ;-) |  I thought I was wrong once.  But, I was mistaken. |
|                      +----------------------------------------------------+
| mdiehl@triton.unm.edu| "I'm just looking for the opportunity to be        |
| Thunder@forum        |            Politically Incorrect!                  |
| (505) 299-2282       |                        <me>                        |
+----------------------+----------------------------------------------------+

fergp@sytex.com (Paul Ferguson) writes:
> 
> On Mon, 05 Apr 93 12:36:09 PST,
>  Jonathan Stigelman <uunet!transam.ece.cmu.edu!stig> writes -
>  
> JS> [pgp on multi-user systesm stuff]
>  
>  I think that you guys are missing the point here. IMHO, if you wish
>  maximum assurance of security, than I'd suggest not trying to run
>  programs such as PGP on a multi-user system to begin with! What's
>  wrong with using a PC for this? It offfers a maximum convenience,
>  single-user secure system quite unlike the security problems
>  associated with your university's mainframe.

Some people either do not have the option, or need the convenience of a
multi-user system.  My PC is sitting at home with a toasted modem (waiting
for a Paradyne to arrive... :) and even when it is running fine I spend
8-12 hours a day working on multi-user systems with connectivity that is
light-years beyond what my PC has.  If I want to send out am email message
and do not want to spend an hour walking home, encrypting it, walking back,
and then transferring the file and sending it I will use my copy of PGP on
a multi-user machine.  I have a different key that I use (my key on a
server) for this type of communication and accept and understand the
consequences of using PGP in this manner.

As long as the user knows the weaknesses of the system they are using they
should make thier own choices regarding how to use PGP.  You may consider
your PC at home to be completely safe and secure, but unless you recognize
the weaknesses of that particular setup you are not reaching the "maximum
assurance of security" that you claim.

jim