- cypherpunks-legacy@lists.ogf.org

Re: Future of anonymity (short-term vs. long-term)
by jthomas＠mango.mitre.org 03 Mar '93

03 Mar '93

> IMHO a remailer operator should *NEVER* reveal any identities, but I > also believe very strongly that especially if you provide a way to post > news articles, there has to be a way to send replies to the original > sender. Thus a remailer must maintain mapping info. >I like this. Does it make sense (and has it already been talked >about?) to preserve the return information only for a limited time? It could make sense. It would make _practical_ sense in a scheme like the one I proposed (then amended thanks to John Gilmore's comments) in which the remailer encrypts the return addresses with a key that is regularly changed. Just forget the old keys after a certain amount of time. (BTW, forget I ever said anything about using timestamps as salt. The amount of known-plaintext per message is huge if you do that. Any PRNG would be better. I must have left my brain at home yesterday...) Joe

1 0

Just came back.. (fwd)
by jcoryell＠nwu.edu 03 Mar '93

03 Mar '93

Newsgroups: alt.cyberspace From: andyc(a)rock.concert.net (Richard A Ciordia -- Personal Account) Subject: Just came back.. Message-ID: <1993Feb24.042117.12675(a)rock.concert.net> Organization: CONCERT-CONNECT -- Public Access UNIX Date: Wed, 24 Feb 1993 04:21:17 GMT Lines: 6 Just came back from a VR Lecture, hosted by one of the Directors at Autodesk. There are some new VR releases comming out that is Wicked.. Lower cost too. Anyhow... It was way cool.. 3d-Studio, for those who havent used, grab a copy it's a blast.. Easy to make, rend, animate.. Hasta.. Andy

1 0

ANON: Textual analysis
by jthomas＠mango.mitre.org 03 Mar '93

03 Mar '93

> > This reveals a minor and probably obvious weakness of pseudonyms--writing > > styles. >We probably need "rephrasing remailers" which do some rudimentary >grammar parsing on input text, and randomly substitute equivalent >constructs such as switching active/passive voice, synonyms, changing >the word order where it is insignificant, joining/splitting sentences, >etc. Anyone here have any experience in NLP (natural language processing), >specifically parsing english? ... >Another starting point is language translation software. After your text >has been translated automatically to spanish -> french -> german -> english, >not much of the orignal style will remain. Hopefully, enough meaning >will be preserved to allow understanding. This whole problem looks to me to be AI-complete. I mean, I can't understand the manual from my Roland synth without a whole lot of head-scratching, and that was translated by a human! I don't think you're going to see a computer program giving intelligible rephrasing any time soon. The burden of disguising writing style may continue to fall on the author, but if everyone has the tools to statistically analyze their own messages before they send them, they'll at least see what they need to change around before sending. [I, for example, might decide to use sentences with fewer than three clauses...] Joe

1 0

ANON: Revealing identities
by tim＠atri.curtin.edu.au 03 Mar '93

03 Mar '93

I sent the following to Julf earlier, and he encouraged me to post it to news.admin.policy and the cypherpunks list. He mentioned that "the mapping thing has been discussed recently". Feel free to tear it to shreds, but remember that it is only a rough idea at present: don't tell me I forgot to cross the 'l's (oops 't's). ---- 8< Cut Here 8< ----

1 0

Future of anonymity (short-term vs. long-term)
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 03 Mar '93

03 Mar '93

Lance Detweiler lists some problems with freely available anonymity, and suggests that those of us who are pushing for unrestricted anonymity are unwise. Many others on the list argue that unrestricted anonymity and privacy are necessary and even inevitable. First off, I should say that I think this is absolutely the most critical issue that we cypherpunks must address: how desirable is anonymity, what restrictions should we accept and/or push for, and what technological options can we offer as solutions? Secondly, I think that some of us are talking past each other, by ignoring the distinction between short-term and long-term solutions. Lance, for instance, concentrates on short-term problems with anonymity while ignoring some easy-to-implement fixes for these problems in the medium to long term. Tim May emphasizes the long-term inevitability of crypto anarchy while skipping lightly over the practical problems of sysops trying to keep their systems running in the short term. Let's recognize the distinction between short-term and long-term. To help you out, I offer this handy diagram, which I've filled in with my own opinions. Are restrictions on anonymity... Desirable Necessary Feasible ---------------------------------------------------- Short-term (3yrs) | No Some Yes | Medium-term (10yrs) | No No Partly | Long-term (20yrs) | No No Partly | ---------------------------------------------------- More discussion of specific issues to follow in another message. To sum up, my opinions are that in the short term, remailers must try to be good network citizens in order not to get kicked off the "one and only" network. In the long term, -- Marc Ringuette (mnr(a)cs.cmu.edu) Subject: Future of anonymity (SHORT-TERM) Lance Detweiler lists a few problems with freely available anonymity: - newsgroup noise - pornography GIFs - email bombs / crashed computers - Mafia & terrorist uses He seems to believe that the best way to combat these problems is to provide only limited anonymity, which is to be broken at the request of the proper authorities. [If I've misconstrued what you're saying, Lance, I apologize. Some cypherpunks are certainly saying this.] I disagree that it is necessary for a remailer operator to reveal the sender of a piece of mail under any circumstances, and I will not trust a remailer which does not IMMEDIATELY THROW AWAY the correspondence between input and output addresses. I won't try to argue in detail that partial anonymity is not very useful. I'll just say this: if a remailer operator must be a moral arbiter of when to release an anonymous address, then my assurance of anonymity becomes much more tenuous and subjective, and the legal burdens on the remailer operator become much greater. --- I'd now like to deal with the practical objections to this suggestion in the SHORT TERM. First, let's postulate that anonymity is a desirable thing to have, if we can limit its bad effects. If we could solve the worst of the practical problems, without keeping logs which allow tracing a message to its source, wouldn't it be desirable to do so? I would divide the problems into two types: problems with volume and problems with content. The first three of Lance's objections were volume problems; the last was a content problem. My answer to the problems with content: tough. It's a freedom of speech thing. The only legitimate concern I see, in the short term, is anonymous flooding. This is going to be one of the toughest objections to deal with in implementing an anonymous remailer, and one of the biggest practical concerns, because there is the real possibility of abuse of our poorly-controlled networks (for which the only remedy to date has been to trace the problem to its source). Here's my suggestion: let's provide remailers which guarantee not to flood the network with high volume, but keep no logs and are unable to trace messages back to their source. We can deal with the actual mechanism of such volume control later; my point is that I'm suggesting that the ONLY limitation we place on remailed messages is a volume limitation. This restriction could of course go away once we have digital postage stamps, but seems a reasonable one for remailers which don't charge money. Remailer operators will have I propose the following solution: that remailer operators voluntarily compile aggregate "volume reports" I would predict that the primary means by which anonymity will be restricted are: short-term: crackdowns on anonymous remailing sites medium to long term: by convincing most people to participate in "real person only" newsgroups and to use "real person only" email handlers. These limitations could be implemented via the PEM public key hierarchy, for instance.

3 2

Re: Future of anonymity (short-term vs. long-term)
by pmetzger＠shearson.com 03 Mar '93

03 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > > Since John Gilmore, the maintainer of the Cypherpunks mailing list, is > one of the absolute free speach advocates --- let me ask a question > directly at you: What would you do if sometime next week, someone > decided to flood the Cypherpunks mailing list with a large amount of > trash postings, routed through different combinations of remailers? Let > us assume that the trash is generated by grabbing varying snippets from > USENET articles, so that current AI technology is not able to > distinguish a true Cypherpunks submission from the flooded trash > postings. What would you do? Now let's also suppose someone does the > same thing to all of the GNU newsgroups. What would you do then? > I know what I would do: I'd rig the list so it only took PGP signed messages, and then only from official subscribers. They could be anonymous, but they'd have to be operating under "known" pseudonyms. This is a "closed" list -- the Extropians list in principle works under much the same mechanism, only without PGP. This being in place, people who had not joined could not flood the list, and anyone flooding the list could be cut off. Note that just because one is in favor of free speech does not mean that one would necessarily permit arbitrary disruptions in one's living room, and being the list "owner" I think John would be much within his rights to stop non-communicative disruptive "noise" postings. > (Sorry for sounding so cynical, but after being a News admin at MIT for > a long time, and dealing with a lot of people suffering from severe > cases of freshmanitis, I have a less than optimistic view about human > nature.) I think that instead you should have a less than optimistic view of the quality of our current netnews software. The problem you list can be fixed with public key cryptography and some intelligent changes. For instance, there is an easy fix to the "idiots posting newgroups" messages that I heard Nat Howard propose years ago -- use public key signatures on newgroup messages, and each news administrator picks other administrators he trusts in the same sort of "web of trust" notion that PGP has. If the newgroup/delgroup message was posted by someone you trust you take it, otherwise you reject it. Given that, you are practically done. As another example, its easy to assure that moderated newsgroups are run just by the moderator -- he public key signs instead of posting with the "Authorized" header. Easy as pi. Perry

5 5

anon.penet.fi hacking
by Hal 03 Mar '93

03 Mar '93

Eric shows a complicated regular expression, but I don't think it will match just --, because this line provides nothing to match the "." and "[^B]", etc. I think the real point is that Eric's idea allows the user to customize the regular expression to match the particular signature line used by his system. If the line is just --, he can use Eric's simple example. If it's something else, another line can be used to look for the match. Since it's not hard for users to find out how their signatures look it should not be hard to set up a pattern that will strip them. Hal

3 2

Re: Handling Abuses of Remailers
by arcticus!Xenon 03 Mar '93

03 Mar '93

In article <CypherPunksList.0606(a)arcticus.UUCP> tcmay(a)netcom.com (Timothy C. May) writes: > * To handle _abusive volumes_ through remailers, charge for remailing. > Short term, this may be a problem, but this is the long term market > solution. Quick but relevant question: Assuming a commercial anonymous remailer were set up tomorrow, with (don't ask me how this would be done, it's hypothetical...) provable anonymity -- what should it charge per message, or per kilobyte of message? > -Tim May > tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero Chris - Xenon -- Xenon%arcticus(a)burner.com = Chris Hanson | Lord Xenon | Kelson Haldane I work, but you don't know who I work for, and I'm not on their machine(s). "There is no Truth. There is only Perception. To Perceive is to Exist." - Xen Home (303)745-0108|Work (303)696-8973|Flames (976)DEV-NULL|PGP2.1 key by req.

1 0

Re: more ideas on anonymity
by pmetzger＠shearson.com 03 Mar '93

03 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > I see. So you don't believe in libel or slander laws. > > And NBC was perfectly justified in faking an explosion in a GM truck to > show it was unsafe, and broadcast it on prime-time TV. And it didn't do > anybody any harm at all. Uh huh. > > Try again..... I believe that Theodore is confusing the notion of tort and the notion of crime. Slander and Libel are torts, that is, they are civil matters. Prior restraint of speech is brought up in the context of CRIMINAL acts. As an example, obviously, if I promise you that what I am about to tell you is the true formula for a drug who's design I am selling you and I lie, I am liable under our contract. Also similarly, it is possible under various legal arguments to consider slander to be a tort. However, it is something different if the government claims that my saying "all green people should be killed" is a crime. Now, on the issue of slander, the notion of anonymity is largely unimportant. If I had walked into the middle of the street and ranted for an hour saying that GM trucks are unsafe, that would be largely ignored, as most anonymous denunciations likely are. The issue is if a non-anonymous individual or entity with credibility, like NBC, says something that is false. Perry

4 4

REMAIL: Usage stats.
by Hal 03 Mar '93

03 Mar '93

-----BEGIN PGP SIGNED MESSAGE----- I got mail from a remailer operator asking how he could keep some information about how much his remailer was being used without keeping logs of the messages. This seemed like a good feature so I have added it to my maildelivery file. This is how it looks now: # # field pattern action/ string # result (quote included spaces) # Request-Remailing-To "" pipe R "date >> LOG.REMAIL" Request-Remailing-To "" pipe A remail.pl Anon-To "" pipe R "date >> LOG.REMAIL" Anon-To "" pipe A remail.pl Encrypted PGP pipe R "date >> LOG.ENCRYPTED" Encrypted PGP pipe A pgpmail.pl * "" pipe ? recurse.pl The lines which say "date >> LOG.XXX" will append one line to the LOG.* file each time a remailing or decryption is done. That line will tell when it is done. No other information is kept to allow reconstruction of who sent the message or what it was. You can use "wc" to count how many lines are in the files, archive and/or delete them periodically, or do whatever you like. A couple of notes: When you have more than one line that matches a particular field/pattern (defined in the first two columns), use the letter R for the result code for the first ones, and A for the last. Also, be SURE you put quotes around the command string if it is more than one word. Otherwise ALL of your mail will DISAPPEAR! (I need to do a little work on the slocal.pl script to make it more robust about this. :-) If you're using slocal rather than slocal.pl this should still work. Hal Finney -----BEGIN PGP SIGNATURE----- Version: 2.1 iQCVAgUBK5Qqe6gTA69YIUw3AQEYiAQArkTzGy4b2oFetX/AOzXjZ9Wpv8zlthCa rDs54X0mhw2fqe1zRt8VNw4X66qNwV1niyBMJV37IQsiCJVKXYI1ey3bRD5xNKGx FSZogubeoxIJFvKcVnLTe0l6bsRZpzSPRaePslXZsxb0t3ysDKKnzX0GJe0Zg8k0 +4d1mh8q5qQ= =+Bo3 -----END PGP SIGNATURE-----

1 0