Re: a few short notes

> On Mon, 2 Feb 2004 10:30, Chuq Von Rospach wrote:
> > that's why I don't want anoymous operations at the mail-ng level.
> It strikes me that you can achieve your chain of accountability so 
> long as
> anonymous actions are *explicitly* anonymous.
And if some site along the way compromises the accountability (i.e., 
the spammer controls the man in the middle), you find yourself with a 
fascinating quandary -- how to figure out who is compromised and how to 
track them down.
anonymity is a serious problem here. think about it -- you're going to 
have to remove all tracking information, all sourcing information, and 
all sender information. If you don't, you aren't really anonymous, just 
obfuscated. If, for instance, I know what site the message originated 
on, you sure aren't anonymous, and in many cases you're now identified. 
anonymous(_at_)plaidworks(_dot_)com just isn't going to hide me very well.
Who manages this anonymity at the protocol level?

1) If it's the sender's machine, his anonymity ends as soon as a system 
starts adding tracking/trust information, and that information may well 
leave enough hints behind to allow me to subjectively identify who the 
sender is, or at least come really close. That defeats the purpose.
2) If it's the receiver's machine, the sender is depending on the 
receiving machine abiding by his request for anonymity. Hopefully, we 
all agree that's a non-starter, and if you don't understand why, please 
think about it for a while (try this scenario: you send an anonymous 
piece of hate mail to abuse(_at_)fbi(_dot_)gov, and expect them to respect your 
anonymity?)
3) some site in the middle? it's in control of neither party. The 
sender can't depend on that middle site abiding by the request, and the 
receiver may still get enough tracing information to backtrace to the 
sender's ID.
There is no safe way to embed anonymity down at the protocol level 
we're designing. That's why it needs to be at a higher level, a 
specific service that accepts a message, scrubs it of identifying 
information, and re-mails it under an identify owned by that service to 
guarantee anonymity.
Anything else makes assumptions about the reliability of the system 
that someone wanting anonymity shouldn't be making. It's faux anonymity 
if I can get close enough to you through tracing to guess which 
doorbell to push....
> Your main problem is with falsified address information, not anonymous
> senders.
Oh, I've had enough fun with anonymous remailers in the past that I can 
honestly say that's not true. Well, true at the moment, but far from 
forgotten.