Subject: [hrpc] anonymity is hard

From: Stephen Farrell <[email-masked]>
Date: Thu, 19 Jul 2018 23:45:09 +0100

Hiya,

Following up a bit on my comment on the anonymity draft,
I did a quick search using "anonymity is hard" and got [1].
That's a bit Tor-specific and maybe getting old, but it
does seem to touch on a lot of the points that I'd love
to see covered (mainly in draft text, not just by reference)
in this draft.

There are probably lots of other references and materials
that could be used as a basis for text. I'd definitely
be willing to help edit some text if someone else has a
chance to write it, and I might even write a bit, but am
not (yet:-) promising that.

Cheers,
S.

[1]
https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-dingledine-anon.pdf

---

From: Hernâni Marques (p≡p foundation) <[email-masked]>
Date: Fri, 20 Jul 2018 04:23:22 +0200

> Hiya,

Heyo

> not (yet:-) promising that.

Perhaps also texts along the GNUnet references below are helpful here,
those also stating that it's not necessarily about achieving absolute
anonymity, but to assess it might be prohibitively expensive to lift
anonymity (at scale), if we can assume the end-devices participating not
being entirely under control of a single adversary (e.g., by hardware
backdoors):

(1) https://gnunet.org/anonymity
(2) https://gnunet.org/node/132

Below two key excerpt from the two references.

From (1):

"Anonymity is the lack of distinction of an individual from a (large)
group. A central goal for anonymous file-sharing in GNUnet is to make
all users (peers) form a group and to make communications in that group
anonymous, that is, nobody (but the initiator) should be able to tell
which of the peers in the group originated the message. In other words,
it should be difficult to impossible for an adversary to distinguish
between the originating peer and all other peers. In particular, even
peers should not be able to recognize from which node the message
originated, after all, the adversary could control one or more of the
peers."

From (2)

"Decentralized anonymity infrastructures are still not in wide use
today. While there are technical barriers to a secure robust design, our
lack of understanding of the incentives to participate in such systems
remains a major roadblock. Here we explore some reasons why anonymity
systems are particularly hard to deploy, enumerate the incentives to
participate either as senders or also as nodes, and build a general
model to describe the effects of these incentives. We then describe and
justify some simplifying assumptions to make the model manageable, and
compare optimal strategies for participants based on a variety of
scenarios."

-- 
p≡p foundation: https://pep.foundation/

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 20 Jul 2018 10:03:20 -0400

Hi there,

In this context, you might want to use the enumerations in the HRaaS
draft to analyze the positive and negative effects on human rights.

To add contemporary relevance to this analysis, reference HRaaS rights
UDHR02 and ICCPR25 in the context of yesterday's announced report in the
U.S.  <https://www.justice.gov/ag/page/file/1076696/download>. 

There was a similar focus on this subject at last week's meetings in
Strasbourg.  Here in the U.S. at least, there are some of us rather
interested in preventing the FSB/GRU from using internet and related
anonymity/tunneling technologies to continue aiding and abetting the
proliferation of national leaders who are massively destroying human
rights worldwide.

--tony

---

From: Amelia Andersdotter <[email-masked]>
Date: Fri, 20 Jul 2018 19:56:49 +0200

> not (yet:-) promising that.

Anonymity: A Comparison Between the Legal and Computer Science Perspectives by Sergio Mascetti, Anna Monreale, Annarita Ricci, and Andrea Gerino on page 85 in "European Data Protection - Coming of Age" (Gutwirth, et al, ed.), Springer Verlag, 2013 is a /really good essay/ that describes, albeit more verbosely, the ideas I took up at HRPC re: anonymity.

In a computer science setting (and by extension also in a protocol setting) we can generalize tools such as pseudonymisation, or data minimization, data obfuscation and other concrete things to many different areas/pieces of information/data. It makes some intuitive sense (in my mind) too, that if many threats to anonymity identified in RFC6379, RFC8280 among other places (fingerprinting, correlation, traffic analysis, etc) are inferential in nature (basically following Law of Large Numbers), then also solutions could aspire towards to addressing the premises of, say, the Law of Large Numbers. 

And then have a negative definition of "anonymity", namely, that you
define what is "identifiability" (what do we mean when we say someone is
identifiable wholly, partially or somehow?), and then leave it at the
place where "anonymity" is that which in either case is not
"identifiable" (this is also pretty much the strategy adopted in HR law
internationally and in the CoE).

But I'd like to hear Stéphane's (and everyone else's) thoughts on such a
direction of the draft.

best regards,

Amelia

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

-- 
Amelia Andersdotter
Technical Consultant, Digital Programme

ARTICLE19
www.article19.org

PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 20 Jul 2018 14:50:11 -0400

Anonymity is the information systems equivalent of absolute zero. It
requires infinite resources to achieve, and produces dramatic collateral
damage to the preponderance of human rights.  Like getting to absolute
zero, it is a great academic research project.  It would be useful to
produce an algorithm that included all the variables.

On Fri, Jul 20, 2018, 1:57 PM Amelia Andersdotter <[email-masked]>
wrote:

> Anonymity: A Comparison Between the Legal and Computer Science
> Perspectives by Sergio Mascetti, Anna Monreale, Annarita Ricci, and Andrea
> Gerino on page 85 in "European Data Protection - Coming of Age" (Gutwirth,
> et al, ed.), Springer Verlag, 2013 is a /really good essay/ that describes,
> albeit more verbosely, the ideas I took up at HRPC re: anonymity.
>
> In a computer science setting (and by extension also in a protocol
> setting) we can generalize tools such as pseudonymisation, or data
> minimization, data obfuscation and other concrete things to many different
> areas/pieces of information/data. It makes some intuitive sense (in my
> mind) too, that if many threats to anonymity identified in RFC6379, RFC8280
> among other places (fingerprinting, correlation, traffic analysis, etc) are
> inferential in nature (basically following Law of Large Numbers), then also
> solutions could aspire towards to addressing the premises of, say, the Law
> of Large Numbers.
>