Subject: Re: [Asrg] Maintaining Anonymity in an Authenticated System

From: Andrew Akehurst <[email-masked]>
Date: Thu, 03 Jul 2003 11:23:27 +0000 (GMT)

>In all the discussion of authenticating individual senders rather than 
>the servers and MTAs they're using, we've all forgotten that there are 
>circumstances in which anonymity is a requirement.  Think of corporate 
>whistle-blowing situations, in which someone wishes to send an anonymous 
>message to an entity like a media organization or the SEC.  In a world 
>in which all transmissions are undeniably authenticated to a sender, 
>this becomes impossible.
>
>Anonymous transmission is indeed a feature of our current systems, not a 
>bug.  Any new system or authentication layer on top of what already 
>exists needs to maintain that.

As I understand it, most of the proposals of that nature are about tying 
messages to a specific e-mail address. Just because you can trace a message 
back to a certain address does not necessarily mean you can identify the human 
being who sent it.

I could sign up for a fully-traced mail account and then use an anonymising 
proxy service to access it. Providing the mail service didn't check that the 
personal details I supply are correct (as far as I know, few mail services do), 
I could easily sign up with a false name and details.

This would be especially simple for webmail accounts via anonymous web proxy 
(e.g. anonymizer.com) so that tracing the originating IP address would not be 
helpful. And if the mail service itself did not have my real personal details 
(because I wouldn't supply genuine ones) then how could anyone know who sent it?

This is just an example, but there are many technical methods people can use to 
protect their physical identity.

I'm not necessarily in favour of authentication schemes, in fact I've yet to be 
persuaded either way so I've no personal axe to grind. I just wanted to point 
out that "e-mail address != person".

Andrew

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Spencer Dawkins" <[email-masked]>
Date: Thu, 3 Jul 2003 06:50:32 -0500

----- Original Message ----- 
From: "Andrew Akehurst" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, July 03, 2003 6:23 AM
Subject: Re: [Asrg] Maintaining Anonymity in an Authenticated System

[deleted down to]

> back to a certain address does not necessarily mean you can identify the
human

Ya know, I understand what you're saying, but (1) we're going
through an IPv6 exercise to say "well, maybe MAC addresses
are too closely tied to people to use them as part of
autoconfigured IPv6 addresses", (2) for most users of
personal computers, saying "someone else must have broken
into my house and sent all this child porn from my PC" has not
been observed to work very well, and (3) in order to say
"IP addresses != people", you would need dynamic IP
addresses that don't tie to NAIs, etc. - I believe all the IP
addresses I use for POP3/SMTP can be traced back to
me pretty easily... if I was a charter member of al Queda
I'd be more motivated to hide, but I don't think anonymous
POP3/SMTP is as easy as you're making it sound.

By "anonymous", I'm talking about two-way communication -
more than just sending an e-mail from Bill Gates saying "I'm
really excited about this quarter's earnings prospects". Simple
forgery is, of course, a variant of one-way anonymous communication.

> (because I wouldn't supply genuine ones) then how could anyone know who
sent it?

Now, this is fairly true, but is anonymity via webmail sufficient?

Spencer

---

From: Andrew Akehurst <[email-masked]>
Date: Thu, 03 Jul 2003 12:56:40 +0000 (GMT)

Quoting Spencer Dawkins <[email-masked]>:

> [deleted down to]
> 
> > >
> > >Anonymous transmission is indeed a feature of our current systems,
> > >not a bug.  Any new system or authentication layer on top of what
> > >already exists needs to maintain that.

>> As I understand it, most of the proposals of that nature are about
>> tying messages to a specific e-mail address. Just because you can trace a
>> message back to a certain address does not necessarily mean you can
>> identify the human being who sent it.

> autoconfigured IPv6 addresses"

That's an interesting point in itself. Tracing a MAC address (or an IPv6 
address derived from one) could allow an eavesdropper to trace traffic from 
multiple connection sessions (over a period of time) back to a single network 
interface.

Of course there still isn't necessarily a one-to-one mapping between a network 
interface and a human being. NAT gateways can hide many machines and people 
behind them, and of course even a single machine may have multiple people who 
log on and use it.

The shortage of IPv4 addresses has lead to mechanisms like DHCP and NAT, both 
of which can provide limited levels of privacy... This issue intrigues me a lot 
but I won't say too much else about it here for fear of getting wildly off-
topic.

> (2) for most users of

Well, maybe I glibly made it sound easy. My example deliberately bypassed the 
need for POP3 by using a webmail interface to access a mailbox that way.

My point was simply that, whatever new e-mail system is developed in future, if 
access to it can be proxied in some way (via a web interface or otherwise) then 
IP address tracing would turn up at a dead end.

We should of course consider privacy as a requirement, but one needn't define 
it as an explicit part of a new e-mail system provided some external anonymity 
protection method is compatible with it - or at least new ideas shouldn't 
preclude some kind of anonymity even if they don't actually define a mechanism 
for it.
 
> forgery is, of course, a variant of one-way anonymous communication.

That's a good reminder, thanks for that.

OK, suppose there were a tracked, secure version of Hotmail (say) whose 
messages could always be traced back to my Hotmail e-mail address, I could 
still use an anonymous web proxy service to both send and receive messages on 
that account.

That way, if I sent spam, my account could still be closed by MSN for violation 
of their abuse policy. But anyone with a personal or political grudge against 
me would not be able to trace the e-mail address to me as an individual.

Would that work? (Once again I assume that I would lie to Hotmail about any 
personal details they ask for, since it would be difficult for them to check at 
the time of sign-up)

I do take your point about the ease of setting this up. However it would create 
a nice market for companies to provide proxying to common webmail services. 
They could let me log in at their website and proxy on my behalf to Hotmail (or 
whoever), passing the results back to my browser. To average Joe Public it 
could be made very easy to use by being almost totally transparent and it would 
make a nice business opportunity for companies to rent such services to people.

> Now, this is fairly true, but is anonymity via webmail sufficient?

It's difficult to say. On the technical side, with only access to the IP 
address of my proxy and my message itself it might still be possible to 
identify me by my apparent relationship with those I contact. Then again, it 
might still be possible to do so if I wrote a letter to someone.

If I were really paranoid I'd use something like public key cryptography and 
send my messages that way. Whether webmail companies would provide that service 
for free is another matter. Certainly having a protocol which sends e-mail over 
encrypted connections between MTAs might help stop eavesdroppers en route from 
intercepting my message. The technology to do that is readily available.

One issue is that if courts could order anonymiser services to surrender their 
logs then that might be a problem. However jurisdiction would likely rest with 
the country in which the server is based. Indeed, some countries might do a 
nice trade in off-shore privacy proxies (just as Switzerland does with banking 
privacy). I'm not a lawyer however, so I'll leave it to the legal experts to 
determine the risks of that one.

Is any of this helpful? Personally I'll always be paranoid about communications 
privacy, but I happen to believe that low-level paranoia is a survival skill. :-
)

Andrew

---

From: Steve Schear <[email-masked]>
Date: Thu, 10 Jul 2003 12:20:12 -0700

>make a nice business opportunity for companies to rent such services to 

Its much more generalized and effective to just proxy all Web access, like 
Anonymizer and JAP.

>logs then that might be a problem.

These services, like the mixmaster remailers, do not keep/generate logs.

There are many other net address obfuscation techniques.  See 
http://gray-world.net for a good overview of tunneling, covert channels, 
network related steganographic methods.

steve

"There is no protection or safety in anticipatory servility."
Craig Spencer

---

From: Andrew Akehurst <[email-masked]>
Date: Thu, 10 Jul 2003 21:52:00 +0100 (BST)

>>I do take your point about the ease of setting this up. However it
>> would create a nice market for companies to provide proxying to common
>> webmail services.
>>
>> They could let me log in at their website and proxy on my behalf to 
>> Hotmail (or whoever), passing the results back to my browser. To 
>> average Joe Public it could be made very easy to use by being almost
>> totally transparent and it would make a nice business opportunity for 
>> companies to rent such services to people.

> Its much more generalized and effective to just proxy all Web access,
> like Anonymizer and JAP.

True, but I'm not sure how comfortable the average user would be in twiddling 
with their proxy settings. I suppose it depends how knowledgable they are, and 
different companies can always provide different types of proxying service. It 
depends what the market wants.

As long as whatever new e-mail system arises in future doesn't preclude the 
possibility of protecting the sender's physical identity then that's fine. 
Personally I'm deeply suspicious of anything that over-centralises (not just 
because of privacy issues, but also due to the possibility of a central point 
of attack/failure).

After all, as long as you can trace spam back to a definite e-mail account, 
then all that needs to be done is to shut down or suspend that account. It's 
not always necessary to know the identity of the human being who sent the 
message in order to deal with their abuse of the system. 

I suppose legal action against the individual might be a possible remedy in 
cases of severe abuse, but then if spam were traceable via some "source 
tracking component" this would discourage a lot of the abuse before it occurs. 
I'm sure there's lots of ways to arrange things which can still allow human 
anonymity whilst preventing spam.
 
> > > Now, this is fairly true, but is anonymity via webmail sufficient?

... 8< ...

>> One issue is that if courts could order anonymiser services to
>> surrender their logs then that might be a problem.

> These services, like the mixmaster remailers, do not keep/generate

Glad to hear it although I expect they need some level of logging to diagnose 
problems with their system. However if they don't keep them for long or don't 
log full message headers then that's probably OK.

On the subject of legal remedies, could a court document retention order be 
used to force anonymiser companies to keep their logs? Even if it could though, 
I expect "off-shore" companies could dodge such orders due to lack of 
jurisdiction? Again, I consider the parallel with Swiss banking 
confidentiality. Of course I'm not a lawyer, so any legal insight would be 
helpful here.
 
> network related steganographic methods.

Fascinating. I feel a little less worried now, thanks.

Andrew

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 11 Jul 2003 12:40:22 -0400

> > > > Now, this is fairly true, but is anonymity via webmail sufficient?

The requirements document mentions the issue of anonymity 
(https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg05084.html):

----snip------
2.14 Accountability and Anonymity

  Proposals MUST address issues of accountability and anonymity
  of MTS users, specifically message senders.

2.14.1    Rationale:

  One of the most pernicious issues involving [spam] are related
  to accountability of the [spammers] who provide invalid or
  simulated information in order to "game the system" provided by
  the current MTS.  Designers MUST describe the issues of
  accountability addressed by their proposal.  Message
  origination and message formatting forgery must be considered
  in designs, an optimal design would allow tracing of messages
  to the sending person, organization and/or system.
  Additionally, there is just cause for preserving sender
  anonymity and supporting the use of appropriate 'anonymization'
  services that currently exist.  Designers must consider the
  impact of accountability by a proposal on these systems and
  address the issues related to preserving anonymity for
  [legitimate] uses.