Subject: Security enhancement request...

From: Ken Weaverling <[email-masked]>
Date: Tue, 15 Feb 1994 19:52:11 -0500 (EST)

I have just been the victim of a very troubling problem.  My mail directory
was set to 755 permissions and many of my saved mail folders were set to 
644.  I also found evidence that my mail was read by others since this 
hole opened up.  Being the sys administrator here, this is a real bad
problem. I now have to go through 5 megs of saved messages, look for 
compromising information and correct it.

To settle some fears, No, Pine was not responsible for this. Also created 
in my mail directory was a subdir used by Macintosh file serving software 
that I installed on Unix months ago.  Apparently, it changed the permissions,
probably based on the "Privileges" menu item on the Mac that I had checked 
incorrectly.

Yes, this is a stupid user mistake of the highest order, especially since
I should know better.  

But what I am suggesting is the following. Since Pine is geared towards 
novices (and idiots like myself), can it be made to double check access 
rights when opening a folder for world-read permissions and perhaps warn 
the user in the status window ("Warning: Your folder is set to be readable 
by everyone on the system")?

On one hand, a MUA shouldn't have to worry about double-checking for 
stupid luser mistakes, but on the other hand, it might make a nice public 
service feature!  I can't really think of many reasons why people's mail 
should be publically readable. If it is to be shared, it should be in a 
public type newsgroup or bbs type thingamajig.

---

From: [email-masked] (Barry Shein)
Date: Tue, 15 Feb 1994 21:23:43 -0500

It would seem that a better solution to the problem you describe would
be the option to save folders encrypted with some password. Then it
wouldn't matter a lot if file security were compromised. Obviously it
raises the issue of people forgetting their encryption keys, but I
think that only argues for this not being the default. This sort of
thing is becoming a more and more commonplace option in all sorts of
utilities so I think people basically knows what it means and whether
they want it or not (or understand in a sentence.)

The only other problem it raises is the whole export regs spectre, but
perhaps the right approach is the sysadmin or someone enters the
command to be run on the file to encrypt or some such thing.

        -Barry Shein

Software Tool & Die    | [email-masked]          | uunet!world!bzs
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD

---

From: VampLestat <[email-masked]>
Date: Tue, 15 Feb 1994 19:13:38 -0800 (PST)

On Tue, 15 Feb 1994, Barry Shein wrote:

> wouldn't matter a lot if file security were compromised.

I think that existing utilities for secure email, namely PGP, are a 
better way to go that creating Yet Another Format for encryption.  PGP 
has a number of features that make it much more secure than what the pine 
developers would be able to whip up.  

I would prefer that Pine be developed to make it easier to integrate PGP 
encryption and decryption by allowing the user to pipe the contents of 
the current message thru a filter.

> command to be run on the file to encrypt or some such thing.

Which brings up the topic of the Clipper chip.  The US governement 
wants to make Clipper the standard because it will be able to hold the 
keys to decrypt anything it wants to see.

_O_  Ryan L. Watkins                                     [email-masked]
 |   Academic Computing Services Cal State Long Beach - Network Support
 |   pgp key available via 'finger [email-masked]' or key server

---

From: [email-masked] (Barry Shein)
Date: Tue, 15 Feb 1994 22:29:13 -0500

From: VampLestat <[email-masked]>

>the current message thru a filter.

Yes, had you read my whole note before responding you would have seen
this is precisely what I said and could have saved us all this
follow-up.

As to PGP specifically last I heard it was still claimed to be in
violation of the RSA patent. I assume, however, you are an officer of
your university with fidiciary responsibilities so are able to make
the determination of potential liabilities for yourself. I am such an
officer of my company and have made my own decision.

>keys to decrypt anything it wants to see.

No, actually it does not bring up the topic of the Clipper chip since
this has nothing to do with Pine development except perhaps in the
distant future (does Pine use any chips explicitly? Is it likely to?)

My suggestion about export regs was meant only as an argument for a
site-configurable command to encrypt so sites which do not have
something like DES can use something else without trouble, and the
pine folks don't have to worry about complying with export regulations
since they wouldn't be shipping any cryptography software, only a
method for incorporating your own. That would be a proper devpt issue.

        -Barry Shein

---

From: VampLestat <[email-masked]>
Date: Tue, 15 Feb 1994 19:46:20 -0800 (GMT-0800)

> this is precisely what I said and could have saved us all this

Excuse me, but I did indeed read your entire article.  If you look back
at my reply, I quoted your last section, so I had obviously read it. 

> violation of the RSA patent. 

Regardless of legal issues, all I'm asking is that pine be configured to
allow people to use filters of thier own creation, be they PGP or just
crypt.  I think creating the option to pipe out the current message 
would be a heck of alot more useful than simple encryption of a 
folder.

> I assume, however, you are an officer of
> the determination of potential liabilities for yourself.

I'm a student here that happens to work as a student consultant doing 
network support.

> distant future (does Pine use any chips explicitly? Is it likely to?)

I think the whole topic of encryption in the US leads to discussion of 
clipper.  I'd rather know that my mail is indeed secure, and not able to 
be opened when the government feels like snooping around in it, or when 
someone else manages to get the keys.  I'd rather hold the keys to my own 
mail box, thank you.

> method for incorporating your own.

I wasnt asking that the pine developers ship copies of PGP with Pine, 
just that the ability to pipe the current message out to a filter program 
defined by the user.

---

From: Robert Morris <[email-masked]>
Date: Wed, 16 Feb 1994 07:39:51 -0500

[ Omitted: Violent agreement between vamp and bzs about encryption
support in Pine ...]

>> keys to decrypt anything it wants to see.

Clipper refers only to digital telephony cryptography. The computer
system implementation is called Capstone. The secret NSA/NIST
algorithm is Skipjack.  Nothing (yet) in the current U.S. government
proposals prohibits private citizens from using any encryption schemes
they wish in their electronic mail or file transfers.  There are
plenty of good reasons for opposing the key escrow, secret algorithm
and special chip proposals widely mis-referred to as the "Clipper
initiative", as well as for opposing the restrictions on encryption
software exports, but threat to software email encryption is probably
not among them.

See the Risks forum 15.47 and following, for a good discussion of the
current state  or peruse documents on the gopher and ftp servers of
the Electronic Frontier Foundation, gopher.eff.org and ftp.eff.org.

User agent support for viewing encrypted mail deserves a little more
thought than simply providing hooks to external filters---which in my
opinion is a Good Thing on its own. For example, automatic reply to an
encrypted message should possibly be encrypted by default, with key
options that permit the use of the same key or one-time key
generation. Already viewed mail should possibly remain encrypted for
storage, etc. etc.

Of course, the best thing would be to embed a Lisp interpreter in Pine
with access to messages and other internal objects. Then we could use
the 20 years worth of emacs lisp contribiutions out there, including
ones which deal with encryption..... Hah, hah, only serious.

Bob Morris
[email-masked]

---

From: Richard Lee <[email-masked]>
Date: Wed, 16 Feb 1994 09:05:14 -0600 (CST)

Can't the people who give out accounts on your system make sure 
that the .profile or .login file or whatever sets the default permissions 
appropriately.  That's where the responsibility lies.  Sure some of us 
who don't know what we're doing may override that (change it), but then 
it's our fault if our mail is readable by the world.  This is not, in my 
view, pine's job.

--

Dr. Richard Lee                         [email-masked]
Department of Philosophy Old Main 318   [email-masked]
University of Arkansas                  phone: 501-575-5826
Fayetteville, AR 72701