Internet Toolkit/Internet Toolkit.iso/info/netpriv2

Text File | 1993-11-24 | 58KB | 1,305 lines

·    Subject: Privacy & Anonymity on the Internet FAQ

Archive-name: net-privacy
Last-modified: 1993/2/3
Version: 1.0



IDENTITY, PRIVACY, AND ANONYMITY on the INTERNET
================================================

(c) 1993 L. Detweiler.  Not for commercial use except by permission
from author, otherwise may be freely copied.  Not to be altered.
Please credit if quoted.

SUMMARY
=======

Information on email and account privacy, anonymous mailing and
posting, file encryption, and other privacy issues associated with
use of the Internet and global networks in general.


QUESTIONS
=========

(Search for <#.#>.)

IDENTITY
--------

<1.1> What is `identity' on the internet?
<1.2> Why is identity (un)important on the internet?
<1.3> How does my email address identify me and my background?
<1.4> How can I find out more about somebody from their email address?
<1.5> Why is identification unstable on the internet?
<1.6> What is the future of identification on the internet?

PRIVACY
-------

<2.1> What is `privacy' on the internet?
<2.2> Why is privacy (un)important on the internet?
<2.3> How private/secure is my account?
<2.4> How private/secure is my email?
<2.5> How do I provide more/less information to others on my identity?
<2.6> Who is my sysadmin?  What does s/he know about me?
<2.7> Why is privacy unstable and nonexistent on the internet?
<2.8> What is the future of privacy on the internet?

ANONYMITY
---------

<3.1> What is `anonymity' on the internet?
<3.2> Why is `anonymity' (un)important on the internet?
<3.3> How can anonymity be protected on the internet?
<3.4> How do I send anonymous mail?
<3.5> How do I post anonymously?
<3.6> Why is anonymity unstable and nonexistent on the internet?
<3.7> What is the future of anonymity on the internet?

MISCELLANEOUS
-------------

<4.1> What is ``digital cash''?
<4.2> What is a ``hacker'' or ``cracker''?
<4.3> What is a ``cypherpunk''?
<4.4> What new standards are needed to guard electronic privacy?

RESOURCES
---------

<5.1> How can I run an anonymous remailer?
<5.2> What is the cypherpunks mailing list?
<5.3> What are some privacy-related newsgroups?  FAQs?
<5.4> What is the MIT ``CROSSLINK'' anonymous message TV program?
<5.5> What are the standards for internet Privacy Enhanced Mail (PEM)?
<5.6> What UNIX utilities are related to privacy?
<5.7> How cam I learn about or use cryptography?

FOOTNOTES
---------

<6.1> Most Wanted list
<6.2> Change history

* * *


IDENTITY
========

_____
<1.1> What is `identity' on the internet?

  Generally, today people's `identity' on the internet is primarily
  determined by their email address in the sense that this is their
  most unchanging 'face' in the electronic realm.   This is your
  login name qualified by the complete address domain information,
  for example ``[e-mail]''.  People see
  this address when receiving mail or reading USENET posts from you
  and in other situations where programs record usage.  Some obsolete
  forms of addresses (such as BITNET) still persist.

  In email messages, additional information on the path that a message
  takes is prepended to the message received by the recipient.  This
  information identifies the chain of hosts involved in the
  transmission and is a very accurate trace of its origination.  This
  type of identify-and-forward protocol is also used in the USENET
  protocol to a lesser extent.  Forging these fields requires
  corrupted mailing software at sites involved in the forwarding and
  is very uncommon.  Not so uncommon is forging the chain at the
  origination point, so that all initial sites in the list are faked
  at the time the message is created.  Tracing these messages can be
  difficult or impossible when the initial faked fields are names of
  real machines and represent real transfer routes.


_____
<1.2> Why is identity (un)important on the internet?

  The concept of identity is closely intertwined with communication,
  privacy, and security, which in turn are all critical aspects of
  computer networks. For example, the convenience of communication
  afforded by email would be impossible without conventions for
  identification.  But there are many potential abuses of identity
  possible that can have very severe consequences, with massive
  computer networks at the forefront of the issue, which can
  potentially either exacerbate or solve these problems.

  Verifying that an identity is correct is called `authentication',
  and one classic example of the problems associated with it is
  H.G.Well's ``War of the Worlds'' radio broadcast that fooled segments
  of the population into thinking that an alien invasion was in
  progress.  Hoaxes of this order are not uncommon on Usenet and
  forged identities makes them more insideous.  People and their
  reputations can be assaulted by forgery.

  However, the fluidity of identity on the internet is for some one of
  its most attractive features. Identity is just as useful as it is
  harmful.  A professor might carefully explain a topic until he
  finds he his talking to an undergraduate. A person of a particular
  occupation may be able to converse with others who might normally
  shun him.  Some prejudices are erased, but, on the other hand, many
  prejudices are useful!  A scientist might argue he can better
  evaluate the findings of a paper if he knows more about the
  authors.  Likewise, he may be more likely to reject it based on
  unfair or irrelevant criteria.

  Identity is especially crucial in establishing and regulating
  `credit' (not necessarily financial) and `ownership' and `usage'.
  Many functions in society demand reliable and accurate techniques
  for identification. Heavy reliance will be placed on digital
  authentication as global economies become increasingly electronic.
  Many government functions and services are based on identification,
  and law enforcement frequently hinges on it.  Hence, employees of
  many government organizations push toward stronger identification
  structures.  But when does identification invade privacy?

  The growth of the internet is provoking social forces of massive
  proportions. Decisions made now on issues of identity will affect
  many future users, especially as the network becomes increasingly
  global, universal, widespread, and entrenched; and the positive or
  adverse affects of these actions, intended and inadvertent,  will
  literally be magnified exponentially.

_____
<1.3> How does my email address identify me and my background?

  Your email address may contain information that influences people's
  perceptions of your background.  The address may `identify' you as
  from a department at a particular university, an employee at a
  company, or a government worker.  It may contain your last name,
  initials, or cryptic identification codes independent of both.  In
  the US some are based on parts of social security numbers.  Others
  are in the form 'u2338' where the number is incremented in the
  order that new users are added to the system.

  Standard internet addresses  also can contain information  on your
  broad geographical location or nationhood.  However, none of this
  information is guaranteed to be correct or be there at all.  The
  fields in the domain qualification of the username are based on
  rather arbitrary organization, such as (mostly invisible) network
  cabling distributions.  The only point to make is that early fields
  in the address are more specific (such as specific computer names
  or local networks) and the later ones the most general (such as
  continental domains).  Typically the first field is the name of the
  computer receiving mail.

  Gleaning information from the email address alone is sometimes an
  inspired art or an inconsistent and futile exercise.  (For more
  information, see the FAQs on email  addresses and known

  geographical distributions below.)  However, UNIX utilities exist
  to aid in the quest (see the question on this).

  Examples
  --------

  [e-mail]
    User named 'jamison' with university identified by `uwm', probably
    in the  computer science department.
  [e-mail]
    User named 'fred' at the commercial company identified as 'inode'.
  [e-mail]
    An alias 'microman' for someone in the United Kingdom, possibly
    Oxford.

_____
<1.4> How can I find out more about somebody with a given email address?

  One simple way is to send email to that address, asking.  Another
  way is to send mail to the postmaster at that address (i.e.
  postmaster@address), although the postmaster's job is more to help
  find user ID's of particular people given their real name and solve
  mail routing problems.  The sysadmin (i.e. `root@address') may also
  be able to supply information.  Users with related email address
  may have information.  However, all of these methods rely on the
  time and patience of others so use them minimally.

  One of the most basic tools for determining identity over the
  internet is the UNIX utility 'finger'.  The basic syntax is:

    finger [e-mail]

  This utility uses communication protocols to query the computer
  named in the address for information on the user named.  The
  response is generated completely by the receiving computer and may
  be in any format.  Possible responses are as follows.

  -  A message `unknown host' meaning some aspect of the address is
    incorrect, two lines with no information and '???'

  -  A message 'In real life: ???' in which case the receiving
    computer could not find any kind of a match on the username. The
    finger utility may return this response in other situations.

  -  A listing of information associated with multiple users. Some
    computers will search only for matching user IDs, others will
    attempt to find the username you specified as a substring of all
    actual full names of users kept in a local database.

  -  At some sites 'finger' can be used to get a list of all users on
    the system with a `finger @address'.  In general this is often
    considered weak security, however, because `attackers' know valid
    user ID's to `crack' passwords.

  More information on the fields returned by `finger' is given below.
  More information on `finger' and locating people's email addresses
  is given in the email FAQ.  Just as you can use these means to find
  out about others, they can use them to find out about you.  You can
  `finger' yourself to find out what is publicly reported by your
  UNIX system about you.  Be careful; generally anyone with internet
  access worldwide can query this information.


_____
<1.5> Why is identification unstable on the internet?

  Generally, identity is an amorphous and almost nonexistent concept
  on the Internet for a variety of reasons.  One is the inherent
  fluidity of `cyberspace' where people emerge and submerge
  frequently, and absences are not readily noted in the `community'.
  Most people remember faces and voices, the primary means of casual
  identification in the 'real world'.  The arbitary and cryptic
  sequences of letters and digits comprising most email addresses are
  not particularly noticeable or memorable and far from a unique
  identification of an individual, who may use multiple accounts on
  multiple machines anywhere in the world.

  Currently internet users do not really have any great assurances
  that the messages in email and USENET are from who they appear to
  be.   A person's mailing address is far from an identification of
  an individual.  First, anyone with access to the account, e.g. they
  know the password, either legitimately or otherwise, can send mail
  with that address in the From: line. Secondly, as part of current
  mailing protocol standards, forging the From: line is a fairly
  trivial operation for many hackers.  Much less forgable is the
  status and path information prepended to messages by intermediate
  hosts. However, in general, while possible, forgeries are fairly
  rare on most newsgroups and in email.

  Besides these pathological cases there are simple problems with
  today's internet protocols affecting identification on the
  internet. Internet mail standards, described in RFC (?), are still
  evolving rapidly and not entirely orderly.  For example, standards
  for mail address `munging' or `parsing' tend to vary slightly
  between sites and frequently mean the difference between finding
  addresses and bouncing mail (in other words, between identifying
  and contacting someone and not).  Also, domain names and computer
  names are changed at sites.  Addresses cannot be resolved when
  certain critical  computers crash, such as the receiving computer
  or computers involved in resolving names into addresses.  A whole
  slew of problems is associated with the `nameservers' in the latter
  category; if they are not updated they will not find name
  addresses, and even the operation of what constitutes `updating'
  has different interpretations at different sites.

  The current internet mailing and addressing protocols are slightly
  anachronistic in that they were created when the network was
  somewhat obscure and not widespread, with only a fraction of the
  traffic it now sees.  Today a large proportion of internet traffic
  is email, comprising  millions of messages.

_____
<1.6> What is the future of identification on the internet?

  Some new technologies and standards are introducing facial images
  and voice messages  into mail and these will improve the sense of
  community that comes from the familiarity of identification.
  However, they are not currently widespread, require large amounts
  of data transfer, standardized software, and make some compromises
  in privacy.

  Promising new cryptographic techniques may make 'digital signatures'
  and 'digital authentication' common (see below).  Also, the trend
  in USENET standards is toward greater authentication of posted
  information.  On the other hand, advances in ensuring anonymity
  (such as remailers) are forthcoming.  See below.


PRIVACY
=======

_____
<2.1> What is `privacy' on the internet?

  Generally, while `privacy' has multiple connotations in society and
  perhaps even more on the internet, in cyberspace most take it to
  mean that you have exclusive use and access to your account and the
  data stored on and and directed to it (such as email), and you do
  not encounter arbitrary restrictions or searches.  In other words,
  others may obtain data associated with your account, but not
  without your permission.  These ideas are probably both fairly
  limiting and liberal in their scope in what most internet users
  consider their private domains.  Some users don't expect or want
  any privacy, some expect and demand it.

_____
<2.2> Why is privacy (un)important on the internet?

  This is a somewhat debatable and inflammatory topic, arousing
  passionate opinions.  On the internet, some take privacy for
  granted and are rudely surprised to find it tenuous or nonexistent.
   Most governments have rules that protect privacy (such as the
  illegal search and seizure clause of the U.S. constitution, adopted
  by others) but have many that are antithetical to it (such as laws
  prohibiting secret communications or allowing wiretapping). These
  rules generally carry over to the internet with few specific rules
  governing it.  However, the legal repercussions of the global
  internet are still largely unknown and untested (i.e. no strong
  legal precedents and court cases).  The fact that internet traffic
  passes past international boundaries frequently complicates and
  discourages its regulation.


_____
<2.3> How private/secure is my account?

  By default, not very.  There are a multitude of factors that may
  reinforce or compromise aspects of your privacy on the internet.
  First, your account must be secure from other users. The universal
  system is to use a password, but if it is `weak' (i.e. easy to
  guess) this security is significantly diminished.  Somewhat
  surprisingly and frighteningly to some, certain  users of the
  system, particularly the administrator, generally have unlimited
  access regardless of passwords, and may grant that access to
  others.  This means that they may read any file in your account.

  Furthermore, not universally known, UNIX  systems keep fairly
  extensive accounting records of when and where you logged in, what
  commands you execute, and when they are executed (in fact, login
  information is public). Potentially, every keystroke you type could
  be intercepted by someone else.  System administrators make
  extensive backups that are completely invisible to users which may
  record the states of an account over many weeks.  Erased files can,
  under many  operating systems, be undeleted.  Some software
  exacerbates these problems.  For example, the widespread Xwindow
  system is extremely insecure; anyone with an account on server
  machine can disrupt the display or read it electronically.  There
  are no protections from this type of access (even the ``access
  control'' xhost command can be evaded by regular users).  Generally,
  you should expect little privacy on your account.


  Be aware of the rights associated with your files and directories in
  UNIX. If the `x' (`execute') right on your parent directory is off
  for users, groups, and other, these users cannot gain information
  on anything in your directories.  Anything less may allow others to
  read, change, or even delete files in your home directory.  By
  default most accounts are accessable only to the owner, but the
  initial configuration varies between sites based on administrator
  preference.  The default file mode specifies the initial rights
  associated with newly created files, and can be set in the shell.
  The details of rights implementations tend to vary between versions
  of UNIX.  Consult man pages on `chmod' and `ls'.

  Examples
  --------

    traver.lance % ls -ld ~
    drwx------ 15 ld231782     1536 Jan 31 21:22 /users/ld231782/

  Here is a listing of the rights associated with a user's home
  directory, denoted by `~'.  The columns at the left identify what
  rights are available. The first column identifies the entry as a
  directory, and the next three columns mean that read, write, and
  execute rights, respectively, are permitted for that user.  For
  directories, the `x' right means that contents (file and
  subdirectory names) within that directory can be listed. The
  subsequent columns indicate that no other users have any rights to
  anything in the directory tree originating at that point.  They
  can't even `see' any lower files or subdirectories; the hierarchy
  is completely invisible to them.

    traver.lance % ls -l msg
    -rw-r--r--  1 ld231782   35661 Jan 29 23:13 msg
    traver.lance % chmod u=rw,g=,o= msg
    traver.lance % ls -l msg
    -rw-------  1 ld231782   35661 Jan 29 23:13 msg

  Here the modes on the file `msg' were changed to take away rights
  from `group' and `other'.

  Indepedent of malevolent administrators are fellow users, a much
  more commonly harmful threat. There are multiple ways to help
  ensure that your account will not be accessed by others, and
  compromises can often be traced to failures in these guidelines:

  - Choose a secure password.  Change it periodically.
  - Make sure to logout always.
  - Do not leave a machine unattended for long.
  - Make sure no one watches you when you type your password.
  - Avoid password references in email.
  - Be conservative in the use of the .rhost file.
  - Use utilities like `xlock' to protect a station, but be
    considerate.

  Be wary of situations where you think you should supply your
  password.  There are only several basic situations where UNIX
  prompts you for a password: when you are logging in to a system or
  changing your password.  Situations can arise in which prompts for
  passwords are forged by other users, especially in cases where you
  are talking to them (such as Internet Relay Chat).  Also, be  aware
  that forged login screens are one method to illegitimately obtain
  passwords.


_____
<2.4> How private/secure is my email?

  By default, not very.   The characters that you are reading are
  almost certainly encoded in ASCII, the American Standard Code for
  Information Interchange that maps alphabetic and symbolic
  characters onto numeric codes and vice versa.  Virtually every
  computer system uses this code, and if not, has ways of converting
  to and from it.  When you write a mail message, by default it is
  being sent in ASCII,  and since the standard is virtually
  universal, there is no intrinsic privacy.

  `Theoretically' people at any site in the chain of sites with access
  to hardware and network media that forwards a given mail message
  over the Internet (globally about a half-dozen (?) on average,
  depending on the distances) could potentially compromise the
  privacy of that message and read it.  Technologies exist to `tap'
  magnetic fields given off by electrical wires without detection. In
  reality these breaches are generally unlikely and rare, with
  disturbing  but isolated incidents known.  Something more common is
  instances of immature or unscrupulous system operators reading
  private mail in the `spool files' at a local site (i.e. the
  ultimate source or destination of the message), such as a
  university.  System administrators may also release files to law
  enforcement agencies, but protocols for warrants have not been
  established and tested.

  Note that bounced messages go to postmasters at a given site in
  their entirety.  This means that if you address mail with an
  incorrect address it has a good chance of being seen by a human
  other than the recipient.

  Typically new user accounts are always set up such that the local
  mail directory is private, but this is not guaranteed and can be
  overridden.

  Finally, be aware that some mailing lists (email addresses of
  everyone on a list) are actually publicly accessable via mail
  routing software mechanisms.  This `feature' can be disabled.

  Most potential compromises in email privacy can be avoided with
  the use of strong cryptography, which has its own set of caveats
  (for example, unscrupulous administrators may still be a threat if
  the encryption site is shared or nonlocal).

_____
<2.5> How do I provide more/less information to others on my identity?

  The public information of your identity and account is mostly
  available though the UNIX utility `finger' described above.  You
  have control over most of this information with the utility `chfn',
  the amount varying  between sites.  You can provide unlimited
  information in the .plan file which is copied directly to the
  destination during the fingering.  Your signature is determined by
  the environment variable SIGNATURE, and USENET signatures are
  usually kept in the .signature file in your home directory. Many
  people put disclaimers in these signatures that don't protect their
  identity but dissociate it from parent organizations as a
  precaution.

  Providing less information is more difficult and involved.  One
  approach is to ask your system adminstrator to change or delete
  information about you (such as your full name).  You may be able to
  obtain access on a public account or one from someone unrelated to
  you personally.  You may be able to remotely login (via modem or
  otherwise) to computers that you are not physically near.  There
  are tactics for hiding or masking your online activities but
  nothing is foolproof.  Consult man pages on the 'chmod' command and
  the default file mode.  Generally, files on a shared system have
  good safeguards within the user pool but very little protection is
  possible from corrupt system administrators.

  To mask your identity in email or on USENET you can use different
  accounts. More untraceable are new `anonymous posting' and
  remailing services that are very recently being established.  See
  below.

_____
<2.6> Who is my sysadmin?  What does s/he know about me?

  The requirements and screening for getting a system administration
  job (and access to all information on a system) vary widely between
  sites and are sometimes frighteningly lax, especially at
  universities.  Many UNIX systems at universities are largely
  managed by undergraduates with a background in computing and often
  `hacking'.  In general, commercial and industrial sites are more
  strict on qualifications and background, and government sites are
  extremely strict.

  The system adminstrator (root user)  knows what commands you used
  and at what times.  S/he may have a record of files on your account
  over a few weeks. S/he can monitor when  you send email or post
  USENET messages, and potentially read either.  S/he may have access
  to records indicating what hosts you are using, both locally and
  elsewhere.

  As punishment or whatever, your system can revoke certain
  `privileges' such as  emailing, USENET posting or reading certain
  groups, file transferring, remote communications, or generally any
  subset of capabilities available from your account.  This all is
  completely at the discretion of the local administrator and under
  the local procedures followed at the site (which are generally
  rather arbitrary).

_____
<2.7> Why is privacy unstable and nonexistent on the internet?

  For the numerous reasons listed above, privacy should not be an
  expectation with current use of the internet.  Furthermore, large
  parts of the internet are funded by the U.S. NSF (National Science
  Foundation) which places certain restrictions on its use (such as
  prohibiting commercial use).  Some high-level officials in this and
  other government agencies may be opposed to emerging techniques to
  guarantee privacy (such as encryption and anonymous services).
  However, traffic is generally completely unimpeded on the internet
  and only the most egregious offenders are pursued.  Currently
  significant portions of USENET traffic, and less so internet
  traffic, are comprised of digitized images from copyrighted
  material, including amounts labelled `pornographic' by many.

  In some cases `abusive' posters to USENET are given admonitions from
  their system administrators as urged by others on the `net'.
  However, some argue that this is also used as a questionable means
  of attacking or silencing `harmless crackpots'.   Currently there
  are virtually no guidelines for restricting use to any internet
  services and local administrators are free to make arbitrary

  decisions. Perhaps the most common example of this are the
  widespread occurrences of university administrators refusing to
  carry some portion of USENET newsgroups labelled as `pornographic'.
  The `alternative' hierarchy in the USENET system, which has
  virtually no restrictions on propagation and new group creation, is
  frequently targeted (although this material may appear anywhere).

_____
<2.8> What is the future of privacy on the internet?

  Some argue that the internet currently has an adequate or
  appropriate level of privacy.  Others will argue that as a
  prototype for future global networks it has woefully inadequate
  safeguards.  The internet is growing to become a completely global,
  international superhighway for data, and this traffic will
  inevitably entail data such as voice messages, postal mail, and
  many other items of extremely personal nature. Computer items that
  many people consider completely private (such as their local hard
  drives) will literally be inches from global network connections.
  Also, sensitive industrial and business information is exchanged
  over networks currently and this volume may conceivably merge with
  the internet.

  Most would agree that, for these basic but sensitive uses of the
  internet, no significant mechanisms are currently in place to
  ensure much privacy. New standards are calling for uniform
  introduction of `privacy enhanced mail' (PEM) which uses encryption
  technologies to ensure privacy, so that privacy protection is
  automatic, and may significantly improve safeguards.

  The same technology that can be extremely destructive to privacy
  (such as with  surreptitious surveilance) can be overwhelmingly
  effective in protecting  it (e.g. with encryption). Some government
  agencies are opposed to unlimited privacy in general, and believe
  that it should lawfully be forfeited in cases of criminal conduct
  (e.g. court-authorized wiretapping).  However, powerful new
  technologies to protect privacy on computers are becoming
  increasingly popular, provoking some to say that ``the cat is out
  of the bag'' and the ``genie can't be put back in the bottle''.  In
  less idiomatic terms, they believe that the spread of strong
  cryptography is already underway will be socially and technically
  unstoppable.

  To date, no feasible system that guarantees both secure
  communication and government oversight has been proposed (the two
  goals are largely incompatible). Proposals for ``registration'' of
  secret keys (by D. Denning on sci.crypt, for example) have been met
  with  hot controversy at best and ridicule and derision at worst,
  mainly because of concerns for the right to privacy and objections
  of inherent feasibility.  Electronic privacy issues, and
  particularly the proper roles of networks and the internet, will
  foreseeably become highly visible and explosive over the next few
  years.


ANONYMITY
=========

_____
<3.1> What is `anonymity' on the internet?

  Simply stated, anonymity is the absence of identity, the ultimate in
  privacy. However, there are several variations on this simple
  theme.  A person may wish to be consistently identified by a
  certain pseudonym and establish a reputation under it in some area,
   providing pseudo-anonymity. A person may wish to be completely
  untraceable for a single one-way message (a sort of `hit-and-run').
   Or, a person may wish to be  openly anonymous but carry on a
  conversation with others (with either known or anonymous
  identities) via an `anonymous return address'.   A user may wish to
  appear as a `regular user' but actually be untraceable.  Sometimes
  a user wishes to hide who he is sending mail to (in addition to the
  message itself).  The anonymous item may directed at individuals or
  groups.

  All of these uses are feasible on the internet but are currently
  tricky to carry out in practice, because of all the tracking
  mechanisms inherent to operating systems and network protocols.
  Officials of the NSF and other government agencies may be opposed
  to any of these uses because of the potential for abuse.
  Nevertheless, the inherent facelessness of large networks will
  always guarantee a certain element of anonymity.

_____
<3.2> Why is `anonymity' (un)important on the internet?

  Anonymity is another powerful tool that can be beneficial or
  problematic depending on its use.  Arguably absence of
  identification is important as the presence of it.  It may be the
  case that many strong benefits from electronic anonymity will be
  discovered that were unforeseen and unpredicted, because true
  anonymity has been historically very difficult to establish.

  One can use anonymity to make personal statements to a colleague
  that would sabotage a relationship if stated openly (such as
  employer/employee scenarios).  One can use it to pass information
  and evade any threat of direct retribution.  For example,
  `whistleblowers' reporting on government abuses (economic, social,
  or  political) can bring issues to light without fear of stigma or
  retaliation. Sensitive, personal, potentially damaging information
  is often posted to some USENET groups, a risky situation where
  anonymity allows conversations to be carried on completely
  independent of the identities of the participants.  Some police
  departments run phone services that allow anonymous reporting of
  crimes; such uses would be straightforward on the network.
  Unfortunately, extortion and harassment become more insideous with
  assurances of anonymity.

_____
<3.3> How can anonymity be protected on the internet?

  The chief means, as alluded to above, are masking identities in
  email and posting. However, anonymous accounts (public accounts as
  accessable and anonymous as e.g. public telephones) may be
  effective as well, but this use is generally not officially
  supported and even discouraged by some system adminstrators and NSF
  guidelines.  The nonuniformity in the requirements of obtaining
  accounts at different sites and institutions makes anonymous
  accounts generally difficult to obtain to the public at large.

  Many communications protocols are inherently detrimental to
  anonymity.  Virtually every protocol in existence currently
  contains information on both sender and receiver in every packet.
  New communications protocols will likely develop that guarantee
  much higher degrees of secure anonymous communication.

_____
<3.4> How do I send anonymous mail?

  One approach has been to set up an `anonymous server' that, when
  activated by email to its address, responds by allocating and
  supplying an `anonymous ID' that is unique to the person requesting
  it (based on his email address).  This will vary for the same
  person for different machine address email originations. To send
  anonymous mail, the user sends email directed to the server
  containing the final destination. The server `anonymizes' the
  message by stripping of identification information and forwards the
  message, which appears to originate from the anonymous server only
  from the corresponding anonymous user id.  This is the
  `interactive' use of anonymity or pseudonymity mentioned above.

  Another more `fringe' approach is to run a `cypherpunk' remailer
  from a regular user account (no root system privileges are
  required). These are currently being pioneered by  Eric Hughes and
  Hal Finney <[e-mail]. The operator runs a process on
  a machine that anonymizes mail sent to him with certain
  characteristics that distinguish it from his regular incoming mail
  (typically fields in the header). One has been implemented as a
  PERL script running on UNIX.  Several of these are in existence
  currently but sites and software currently are highly unstable;
  they may be in operation outside of system administrator knowledge.
   The remailers don't generally support anonymous return addresses.
  Mail that is incorrectly addressed is received by the operator.
  Generally the user of the remailer has to disavow any
  responsibility for the messages forwarded through his system,
  although actually may be held responsible regardless.

  Both of these approaches have several disadvantages. The anonymous
  server approach requires maintaining a mapping of anonymous ID's to
  real addresses that must be maintained indefinitely.  One
  alternative is to allow `deallocation' of aliases at the request of
  the user, but this has not been implemented yet.  Traffic to any of
  these sites could conceivably be monitored, necessitating the use
  of cryptography for basic protection.  Local administrators can
  shut them down either out of caprice or under pressure from
  government agencies. Unscrupulous providers of the services can
  monitor the traffic that goes through them.  Most remailers
  currently keep logs that may be inspected.

  Currently the most direct route to anonymity involves using SMTP
  protocols to submit a message directly to a server with arbitrary
  field information.  This practice, not uncommon to hackers, and the
  approach used by remailers, is generally viewed with hostility by
  most system administrators.  Information in the header routing data
  and logs of network port connection information may be retained
  that can be used to track the originating site.  In practice, this
  is generally infeasible and rarely carried out.  Some
  administrators on the network will contact local administrators to
  request a message be tracked and its writer admonished or punished
  more severely (such as revoking the account), all of this actually
  happening occasionally but infrequently.


_____
<3.5> How do I post anonymously?

  For this use anonymous servers have been established as well with
  all the  associated caveats above (monitored traffic, capricious or
  risky local circumstances, logging).  anon.penet.fi operated by
@DATAPHONE@  [e-mail] can be used here too; mail to [e-mail] for

  information.  Make sure to test the system at least once by e.g.
  anonymous posting to misc.test.  Make sure no  signature data slips
  through.

  Another direct route involves using NNTP protocols to submit a
  message directly to a newserver with arbitrary field information.
  This practice, not uncommon to hackers, is also generally viewed
  with hostility by most system administrators, and similar
  consequences can ensue.


_____
<3.5> What are some known anonymous remailing and posting sites?

  Following are some anonymous remailing and posting sites.  Make sure
  to test the system at least once by e.g. sending anonymized mail to
  yourself. Make sure no signature data slips through.  Be courteous
  to the system operator, who may be personally risking his account
  for your convenience.  Do not send abusive, harrassing or
  threatening messages, or anything else that may endanger the
  operator of the site.


  anon.penet.fi
  -------------
    Anonymized mail, posting, and return addresses (no encryption).
    Send mail to [e-mail] for information.

  [e-mail]
  -------------------------
    Experimental anonymous remailer run Karl Barrus
    <[e-mail]>.  Send to the site name a message with
    the following text:

      ::
      command: help

      user@host

    where `user@host' is the return address.

  [e-mail]
  ----------------------
    Experimental remailer with encryption and return addresses.
    Request information from above address.

  [e-mail]
  ----------------------
    Experimental remailer allowing chaining.  Run by Chael Hall.
    Request information from above address.

  [e-mail]
  -----------------------------
    Experimental remailer with encryption.  `finger' site address
    for information.


  Notes: Currently the most stable of anonymous remailing sites is
  probably anon.penet.fi operated by [e-mail] for several
  months, who has system adminstrator privileges.  So far, all
  encryption is based on public-key cryptography and PGP software
  (see the question on cryptography). Encryption aspects (message
  text, destination address, replies) vary between sites.

_____
<3.6> Why is anonymity unstable and nonexistent on the internet?

  As noted, many factors compromise the anonymity currently available
  to the general internet community, and these services should be
  used with great caution.  To summarize, the technology is in its
  infancy and current approaches are unrefined, unreliable, and not
  completely trustworthy.  No standards have been established and
  troubling situations of loss of anonymity and bugs in the software
  are prevalent.  (For example, one  anonymous remailer reallocated
  already allocated anonymous return addresses.  Others passed
  signature information embedded in messages unaltered.  Address
  resolution problems resulting in anonymized mail bounced to a
  remailer are common.)

  Source code is being distributed, tested, and refined for these
  systems, but standards are progressing slowly and weakly.  The
  field is not likely to improve without  official endorsement and
  action by network agencies.  The whole idea is still viewed with
  suspicion and distrust by many on the internet and seen as
  illegitimate or favorable to criminality.

  A very sophisticated anonymous posting system was recently set up by
  [e-mail] that used cryptography in both directions
  (to/from) the server for the highest degree of confidentiality seen
  so far.  However, it was running on a public access account, and he
  had to shut it down after receiving requests and conditions
  apparently ultimately originating from NSF representatives.


_____
<3.7> What is the future of anonymity on the internet?

  New anonymous protocols effectively serve to significantly increase
  safeguards of anonymity.  For example, the same mechanism that
  routes email over multiple hosts, thereby threatening its privacy,
  can also be used to guarantee it. In a scheme called `chaining' an
  anonymous message is passed through multiple anonymous servers
  before reaching a destination.  In this way generally multiple
  links of the chain have to be `broken' for security to be
  compromised. Re-encryption at each link makes this scenario even
  more unlikely.  Even more significantly the anonymous remailers
  could be spread over the internet globally so that local weaknesses
  (such as corrupt governments or legal wiretapping within a nation)
  would be more unlikely to sacrifice overall security by message
  tracing. However, remailers run by corrupt operators are possible.

  The future of anonymous services on the internet is, at this time,
  highly uncertain and fraught with peril.  Nevertheless, its
  widespread introduction and use may be inevitable and its
  implementation could carry significant and unforeseen social
  repercussions.  However, if its use is continued to be generally
  regarded as subversive it may be confined to the underground.

MISCELLANEOUS
=============

_____
<4.1> What is ``digital cash''?

  With digital encryption and authentication technologies, the
  possibility of a widespread digital cash system may someday be
  realized.  A system utilizing codes sent between users and banks
  (similar to today's checking except entirely digital) may be one
  approach.  The issues of cryptography, privacy, and anonymity are
  closely associated with transfer of cash in an economy.  See the
  article in Scientific American by David Chaum.

  An experimental digital bank is run by Karl Barrus
  <[e-mail]> based on suggestions by Hal Finney on the
  cypherpunks mailing list.  To use the server send mail to
  [e-mail] message with the following text:

    ::
    command: help

    user@host

  where `user@host' is your email address.

_____
<4.2> What is a ``hacker'' or ``cracker''?

  These terms arouse strong feelings by many on their meaning,
  especially on the internet.  In the general news media in the past
  a person who uses computers and networks to malicious ends (such as
  breaking into systems) has been referred to as a hacker, but most
  internet users prefer the term ``cracker'' for this.  Instead, a
  ``hacker'' is perceived as a benign but ambitious and intensely
  curious computer user who explores obscure areas of a system, for
  example---something of an electronic pioneer and patriot.  This is
  the sense intended in this document.  See also the ``Hacker's
  Dictionary'' and the alt.security FAQ.

_____
<4.3> What is a ``cypherpunk''?

  From the charter of the cypherpunk mailing list:

  > Cypherpunks assume privacy is a good thing and wish there were
  > more of it.  Cypherpunks acknowledge that those who want privacy
  > must create it for themselves and not expect governments,
  > corporations, or other large, faceless organizations to grant
  > them privacy out of beneficence.  Cypherpunks know that people
  > have been creating their own privacy for centuries with whispers,
  > envelopes, closed doors, and couriers.  Cypherpunks do not seek
  > to prevent other people from speaking about their experiences or
  > their opinions.

  See information on the cypherpunk mailing list below.

_____
<4.4> What new standards are needed to guard electronic privacy?


  General
  -------

  - Recognition of anonymity, cryptography, and related privacy
    shields as legitimate, useful, desirable, and crucial by the
    general public and their governments.
  - Widespread use and implementation of these technologies in
    hardware, software, and standards, implemented `securely,'
    `seamlessly,' and `transparently'.
  - General shift of use, dependence, and reliance to means other than
    wiretapping and electronic surveillance by law enforcement

    agencies.
  - Publicity, retraction, and dissolution of laws and government
    agencies opposed to privacy, replaced by structures dedicated to
    strengthening and protecting it.

  Remailing/Posting
  -----------------

  - Stable, secure, protected, officially sanctioned and permitted,
    publicly and privately operated anonymous servers and hubs.
  - Official standards for encryption and anonymity in mail and USENET
    postings.
  - Truly anonymous protocols with source and destination information
    obscured or absent and hidden routing mechanisms (chaining,
    encrypted addresses, etc.)
  - Standards for anonymous email addressing, embedding files, and
    remailer site chaining.


RESOURCES
=========

_____
<5.1> How can I run an anonymous remailer?

Cypherpunk remailer source is at soda.berkeley.edu in the
/pub/cypherpunks directory.  It's written in PERL, and is relatively
easy to install (no administrative rights are required).  Karl Barrus
<[e-mail]> has more information and modifications. Also,
most remailer operators mentioned above are amenable to discussing
features, problems, and helping new sites become operational.

_____
<5.2> What is the cypherpunks mailing list?

  Eric Hughes <[e-mail]> runs the `cypherpunk' mailing list
  dedicated to ``discussion about technological defenses for privacy
  in the digital domain.''  Send email to
  [e-mail] to be added or subtracted from the
  list. From the charter:

  > The most important means to the defense of privacy is encryption.
  > To encrypt is to indicate the desire for privacy.  But to encrypt
  > with weak cryptography is to indicate not too much desire for
  > privacy. Cypherpunks hope that all people desiring privacy will
  > learn how best to defend it.

_____
<5.3> What are some privacy-related newsgroups?  FAQs?

  Newsgroups
  ==========

  alt.cyberpunks
  --------------
    Virtual reality, (science) fiction by William Gibson and Bruce
    Sterling, cyberpunk in the mainstream.

 alt.hackers
  -----------
    USENET Network News Transfer Protocol (NNTP) posting mechanisms,
    Simple Mail Transfer Protocol (SMTP), `obligatory hack' reports.

  alt.security.pgp
  ----------------
    Dedicated to discussing PGP, or ``Pretty Good Privacy'' Software
    developed by Phil Zimmerman for public key encryption.

  sci.crypt
  ---------
    Considers scientific and social issues of cryptography.
    Examples: legitimate use of PGP, public-key patents, DES,
    cryptographic security, cypher breaking, etc.

  alt.privacy
  -----------
    General privacy issues involving taxpaying, licensing, social
    security numbers, etc.

  comp.society.privacy
  --------------------
    Privacy issues associated with computer technologies.  Examples:
    caller identification, social security numbers, credit
    applications, mailing lists, etc.  Moderated.

  comp.eff.news
  comp.eff.talk
  -------------
    Moderated and unmoderated groups associated with the Electronic
    Frontier Foundation started by Mitch Kapor for protecting civil
    and constitutional rights in the electronic realm.

  alt.comp.acad-freedom.news
  alt.comp.acad-freedom.talk
  --------------------------
    Moderated and unmoderated issues related to academic freedom and
    privacy at universities. Documented examples of violated
    privacy in e.g. email.  Documented examples of `censhorship' as
    in e.g. limiting USENET groups local availability.

  alt.security
  comp.security.misc
  ------------------
    Computer related security issues.  FAQ in news.answers below.


  FAQs
  ====

  FAQs or ``Frequently-Asked Questions'' are available in the
  newsgroup news.answers or via anonymous FTP to
  pit-manager.mit.edu [18.172.1.27] from the directory
  /pub/usenet/news.answers.

  network-info/part1
  ------------------
    Sources of information about the Internet and how to connect to
    it, through the NSF or commercial vendors.

  alt-security-faq
  ----------------
    Computer related security issues arising in alt.security and
    comp.security.misc, mostly UNIX related.

  ssn-privacy
  -----------
    Privacy issues associated with the use of the U.S. Social
    Security number (SSN).

  pdial
  -----
    Public dialup internet accounts list.

  college-email/part1
  -------------------
    How to find email addresses for undergraduate and graduate
    students, faculty and staff at various colleges and
    universities.

  ripem/faq
  ---------
    Information on RIPEM, a program for public key mail encryption
    officially sanctioned by Public Key Partners Inc., the company
    that owns patents on public key cryptography.

  unix-faq/faq/part1
  ------------------
    Frequently-asked questions about UNIX, including information on
    `finger' and terminal spying.

  distributions/*
  ---------------
     Known geographic, university, and network distributions.

_____
<5.4> What is the MIT ``CROSSLINK'' anonymous message TV program?

  > CROSSLINK is an anonymous message system run on MIT Student
  > Cable TV-36. It provides an anonymous medium through which MIT
  > students can say those things they might otherwise find
  > difficult, inconvenient or impossible to say in person.  It's
  > also a way to send fun or totally random messages to your
  > friends over the air.  It is similar to the anonymous message
  > pages found in many college newspapers, except that it's
  > electronic in nature and it's free.

  Messages can be posted to the service via email.  For more
  information send email to [e-mail].

_____
<5.5> What are the standards for internet PEM (Privacy Enhanced Mail)?

  Internet drafts on Privacy Enhanced Mail (PEM), a standard under
  revision for six years delineating the official protocols for
  email encryption.

  - ``Privacy Enhancement for Internet Electronic Mail:  Part I:
    <draft-ietf-pem-msgproc-02.txt>

  - ``Privacy Enhancement for Internet Electronic Mail: Part II:
    Certificate-Based Key Management'' <draft-ietf-pem-keymgmt-01.txt>

  - ``Privacy Enhancement for Internet Electronic Mail: Part III:
    Algorithms, Modes, and Identifiers''
    <draft-ietf-pem-algorithms-02.txt>

  - ``Privacy Enhancement for Internet Electronic Mail:  Part IV: Key
    Certification and Related Services'' <draft-ietf-pem-forms-01.txt>


_____
<5.6> What UNIX utilities are related to privacy?

  For more information, type `man [cmd]' or `apropos [keyword]' at the
  UNIX shell prompt.

    finger - obtain information about a remote user
    chfn   - change information about yourself obtainable by remote
             users
    chmod  - change the rights associated with a file or directory
    umask  - (shell) change the default (on creation) file access
             rights
    ls     - list the rights associated with files and directories
    xhost  - allow or disable access control of particular users to
             an Xwindow server
    last   - list the latest user logins on the system and
             their originations
    who    - list other users, login/idle times, originations
    w      - list other users and what they are running

    .signature - file in the home directory appended to USENET posts
    $SIGNATURE - used as name in email and USENET postings

_____
<5.7> How can I learn about or use cryptography?

  A general introduction to mostly theoretical cryptographic issues,
  especially those frequently discussed in sci.crypt, is available
  in FAQ form:

  >  Compiled by:
  >        [e-mail] (Carl Ellison)
  >        [e-mail] (Doug Gwyn)
  >        [e-mail] (Steven Bellovin)

  NIST (U.S. National Institute for Standards and Technology)
  publishes an introductory paper on cryptography, special
  publication 800-2 ``Public-Key Cryptograhy'' by James Nechvatal
  (April 1991).  Available via anonymous FTP from
  csrc.ncsl.nist.gov (129.6.54.11), file pub/nistpubs/800-2.txt.
  Also via available anonymous FTP from wimsey.bc.ca as crypt.txt.Z
  in the crypto directory.  Covers technical mathematical aspects
  of encryption such as number theory.

  More general information can be found in a FAQ by Paul Fahn of RSA
  Labortories via anonymous FTP from rsa.com in /pub/faq.ps.Z.  See
  the `readme' file for information on the `tex' version.  Also
  available as hardcopy for $20 from   RSA Laboratories, 100 Marine
  Parkway, Redwood City, CA  94065.  Send questions to
  [e-mail].

  Phil Zimmerman's PGP (Pretty Good Privacy) public-domain package
  for public key encryption is available at numerous sites, and is
  in widespread use over the internet for general UNIX-based file
  encryption (including email).  Consult the archie FTP database.
  Also see the newsgroup alt.security.pgp.  Mailing list requests
  to [e-mail].

  From the RIPEM FAQ by Marc VanHeyningen
  <[e-mail]> on news.answers:

  > RIPEM is a program which performs Privacy Enhanced Mail (PEM)
  > using the cryptographic techniques of RSA and DES.  It allows
  > your electronic mail to have the properties of authentication
  > (i.e. who sent it can be confirmed) and privacy (i.e. nobody can
  > read it except the intended recipient.)
  >
  > RIPEM was written primarily by Mark Riordan
  > <[e-mail]>. Most of the code is in the public domain,
  > except for the RSA routines, which are a library called RSAREF
  > licensed from RSA Data Security Inc.
  >
  > RIPEM is available via anonymous FTP to citizens and permanent
  > residents in the U.S. from rsa.com; cd to rsaref/ and read the
  > README file for info.
  >
  > RIPEM, as well as some other crypt stuff, has its `home site' on
  > rpub.cl.msu.edu, which is open to non-anonymous FTP for users in
  > the U.S. and Canada who are citizens or permanent residents.  To
  > find out how to obtain access, ftp there, cd to pub/crypt/, and
  > read the file GETTING_ACCESS.

  Note: cryptography is generally not well integrated into email yet
  and some system proficiency is required by users to utilize it.

FOOTNOTES
=========

_____
<6.1> Most Wanted list

  Hopefully you have benefitted from this creation, compilation, and
  condensation of information from various sources regarding privacy,
  identity, and anonymity on the internet.  The author is committed
  to keeping this up-to-date and strengthening it, but this can only
  be effective with your feedback.  In particular, the following
  information would be useful:

  - How large is internet traffic?  How much is email?  How much
    USENET?  What are the costs involved?

  - What are NSF standards and regulations on the use and privacy
    associated with the internet?

  - What laws have been passed and are under consideration regarding
    privacy on networks?

  - What are references on privacy?

  - What are some famous or obscure examples of compromised privacy
    on the internet?  (Esp. pointers to info on the Steve Jackson
    Games incident.)

  - What RFCs are available on privacy-related subjects?  What are FTP
    sites?

  - What are the exact details of Xwindow security?  Particularly
    MIT-MAGIC-COOKIE-1, described in `man Xsecurity' at some sites.

  - Where is the code (FTP site) to turn the .plan file into a named
    pipe for sensing/reacting to remote `finger's?

  email feedback to [e-mail].  Please note
  where you saw this (which newsgroup, etc.).

_____
<6.2> Change history

  2/3/93 v1.0 (current)
    More newsgroups & FAQs added.  More `Most Wanted'.  Posted to
    news.answers.  Future monthly posting to sci.crypt, alt.privacy.

  2/1/93 v0.3

    Formatted to 72 columns for quoting etc. `miscellaneous,'
    `resources' sections added with cypherpunk servers and use
    warnings.   More UNIX examples (`ls' and `chmod').  Posted to
    alt.privacy,  comp.society.privacy.

  1/29/93 v0.2

    `Identity' and `Privacy' sections added.  `Anonymity' expanded.
    Remailer addresses removed due to lack of information and
    instability.  Posted to sci.crypt.

  1/25/93 v0.1

    Originally posted to the cypherpunks mailing list on 1/25/93 as a
    call to organize a list of anonymous servers.

  email [e-mail] for earlier versions.

--

[e-mail]