Re: Snake-Oil FAQ

At 4:44 PM 9/22/96, Dale Thorn wrote:

>The basic outline for any products included (and don't forget, just
>getting included is some sort of endorsement, if you know what I mean)
>could be a feature/bug listing, using common crypto terminology, and
>could be followed by side-by-side argument paragraphs from the author
>and from a reputable review panel.
>
>The usefulness of the list would probably depend on:
>1. The participation of all those names people like to name-drop on this
>   forum.
>2. And/or the quality of the list itself if done without (1.) above.
>   In this latter case, it could still be useful, but the variances in
>   evaluation owing to personal bias would be difficult to overcome.

The Basic Problem (tm) with a "Snake Oil FAQ" is that the very persons most
in need of it won't read it.

If those who post descriptions of their "Unbreakable Virtual Whammo-Matic
Really Complicated Transposition Cipher" have not bothered to read Schneier
or other basic texts on ciphers, why would they bother to read a Snake Oil
FAQ? This applies to their customers as well.

It doesn't take much reading of standard crypto books to learn why
historical codes and ciphers (and their reinvented modern variants) are
fundamentally weak, and subject to (usually rapid) breaking with high-speed
computers. Once this basic point is realized, all else follows.

In other words, there is really no meaningful target audience for a Snake
Oil FAQ. If it's just a quick effort, fine. But escalating it into a Major
Cypherpunks Project seems like wasted effort.

Just point people to Schneier's book and suggest they read and absorb the
first several chapters. Then, like the infamous fisherman, they'll be
equipped to understand why the Whammo-matic Really Complicated Cipher is
neither Virtually Unbreakable nor worthy of spending much time analyzing,
and why they should stick with modern ciphers and systems which have been
subjected to years of review and attempts to break them.

--Tim May


We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1,257,787-1 | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Timothy C. May wrote:
> At 4:44 PM 9/22/96, Dale Thorn wrote:
> >The basic outline for any products included (and don't forget, just
> >getting included is some sort of endorsement, if you know what I 
> >mean)
> >could be a feature/bug listing, using common crypto terminology, and
> >could be followed by side-by-side argument paragraphs from the author
> >and from a reputable review panel.
> >The usefulness of the list would probably depend on:
> >1. The participation of all those names people like to name-drop on
> >this forum.
> >2. And/or the quality of the list itself if done without (1.) above.
> >   In this latter case, it could still be useful, but the variances
> >in evaluation owing to personal bias would be difficult to overcome.

> The Basic Problem (tm) with a "Snake Oil FAQ" is that the very persons 
> most in need of it won't read it.
> If those who post descriptions of their "Unbreakable Virtual
> Whammo-Matic Really Complicated Transposition Cipher" have not
> bothered to read Schneier or other basic texts on ciphers, why would
> they bother to read a Snake Oil FAQ? This applies to their customers 
> as well.

[additional text deleted]

Maybe I shouldn't have tried to (slightly) change the subject.  It was 
my thought that someone could encourage the person(s) who wanted to do a 
Snake-Oil product list to generalize the list, to be a more scholarly 
reference, and not just a blacklist.  Since the original(?) proposal 
concerned actual products, and not just techniques which fit into neatly 
identifiable categories, that might justify a Consumer Reports type of 
review list for these products.

-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 22 Sep 1996, Dale Thorn wrote:
 
> Maybe I shouldn't have tried to (slightly) change the subject.  It was 
> my thought that someone could encourage the person(s) who wanted to do a 
> Snake-Oil product list to generalize the list, to be a more scholarly 
> reference, and not just a blacklist.  Since the original(?) proposal 
> concerned actual products, and not just techniques which fit into neatly 
> identifiable categories, that might justify a Consumer Reports type of 
> review list for these products.
> 

  One of the goals of a "Snake-Oil FAQ" as proposed is to gain as wide a
distribution as possible.  If a "blacklist" of products is put into the FAQ,
or if actual existing products are referred to a negative light, the
distribution of this FAQ will be severely limited.

  I also think that as a whole, this project is a good idea and a good
mini-project.  As crypto continues to spread, it is inevitable that "bad"
crypto will spread as well.  While these products will surely come and go
with the phases of the moon, some people will be undoubtedly be suckered and
soured towards crypto-technology in general. 

(sarcasm) "If it saves just one...." (\sarcasm) 

  It has been said before that the best way to counter noise is with signal.

  If one of the primary goals of cypherpunks is to encourage the widespread
use of strong crypto, then, by extension, it is important to discourage the
spread of "crappy crypto."

_______________________________________________________________
 Omegaman <mailto: omega@bigeasy.com>
 PGP Key fingerprint =  6D 31 C3 00 77 8C D1 C2
                        59 0A 01 E3 AF 81 94 63
 Send e-mail with "get key" in the "Subject:" field
 to get a copy of my public key
_______________________________________________________________


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: latin1

iQCVAwUBMkc7Gab3EfJTqNC9AQGBywP+M037TzDBjy/F5MgmKv+x/9lhQrnQsMQ6
xlOB3ApjLHZvoKI//PyHoCKiuCw9BVnTskAE16iu19yWZmUWNL3S6hsOFxex1MMU
pf6YQSajpE4mOSsih8j+b2T60ERXx/jz2BAwGEjtf4azCuGUxObUgX75ydmLoNft
Po4HbyimOtY=
=Yg1d
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be Timothy C. May wrote:
: 
: The Basic Problem (tm) with a "Snake Oil FAQ" is that the very persons most
: in need of it won't read it.
: 
: If those who post descriptions of their "Unbreakable Virtual Whammo-Matic
: Really Complicated Transposition Cipher" have not bothered to read Schneier
: or other basic texts on ciphers, why would they bother to read a Snake Oil
: FAQ? This applies to their customers as well.

I disagree, I think AC is a pretty scary book for the kind of people who
need the Snake-Oil FAQ.  I think the primary target audiences are IS 
professionals who are considering integrating crypto into their data
communications and end users who want to send encrypted mail.  Neither
of these groups is going to embrace crypto if you toss them a tome
like AC.  And what is the primary goal here, if not to promote widespread
use of crypto and educate about what makes good crypto good.  We have to
approach the non-believers on their own ground ;)

mark

- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo@gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo@pobox.com | unless they can get me in trouble. |     APL-CPIO

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMka8HRz4pZwIaHjdAQE8agf+JKgzhzva47IarTXlOmmg869UdWl88WAF
cIQ7uNCXlb7xB9RXmFAHIBTWRy8S+cgkvfEbjPaWmX2dx1038a1Lk96q5kj+6kTq
w0REVj+4FuJ8atgM3PxJljGSzEL5ADjAMicnmKSSBILOK8AU6d/DLquF2Y2rvBgs
7oJkCPH0m/oS87qQuivjEuUoHInrNuvuWC2BrmJ4J7UAvsfT+Zm3WcFpILpvHJ8O
YkVR1IYFU7Q30vaS2eRG4AWCrLcn6tln0fnntGCAjavJz5PD3KMGigRPhE87zdBy
Ht7foguSJwqxI4x+mhJh7PrYoJ6UzqQlqEAbGNTbRJL3CLfs3RStdg==
=7ncj
-----END PGP SIGNATURE-----