privacy anonymity on the internet faq of archive name net privacy part last modified version identity privacy and anonymity on the internet c l detweiler not for commercial use except by permission from author otherwise may be freely copied not to be altered please credit if quoted summary information on email and account privacy anonymous mailing and posting encryption and other privacy and rights issues associated with use of the internet and global networks in general search for for exact section search for underline for next section part this file identity what is identity on the internet why is identity un important on the internet how does my email address not identify me and my background how can i find out more about somebody from their email address why is identification un stable on the internet what is the future of identification on the internet privacy what is privacy on the internet why is privacy un important on the internet how in secure are internet networks how in secure is my account how in secure are my files and directories how in secure is x windows how in secure is my email how am i not liable for my email and postings how do i provide more less information to others on my identity who is my sysadmin what does s he know about me why is privacy un stable on the internet what is the future of privacy on the internet anonymity what is anonymity on the internet why is anonymity un important on the internet how can anonymity be protected on the internet what is anonymous mail what is anonymous posting why is anonymity un stable on the internet what is the future of anonymity on the internet part next file resources what unix programs are related to privacy how can i learn about or use cryptography what is the cypherpunks mailing list what are some privacy related newsgroups faqs what is internet privacy enhanced mail pem what are other request for comments rfcs related to privacy how can i run an anonymous remailer what are references on privacy in email what are some email usenet and internet use policies what is the mit crosslink anonymous message tv program miscellaneous what is digital cash what is a hacker or cracker what is a cypherpunk what is steganography and anonymous pools what is security through obscurity what are identity daemons what standards are needed to guard electronic privacy issues what is the electronic frontier foundation eff who are computer professionals for social responsibility cpsr what was operation sun devil and the steve jackson game case what is integrated services digital network isdn what is the national research and education network nren what is the fbi s proposed digital telephony act what other u s legislation is related to privacy on networks what are references on rights in cyberspace what is the computers and academic freedom caf archive footnotes what is the background behind the internet how is internet anarchy like the english language most wanted list change history part last file anonymizing what are some known anonymous remailing and posting sites what are the responsibilities associated with anonymity how do i kill anonymous postings what is the history behind anonymous posting servers what is the value of anonymity should anonymous posting to all groups be allowed what should system operators do with anonymous postings what is going on with anon penet fi maintained by j helsingius identity what is identity on the internet generally today people s identity on the internet is primarily determined by their email address in the sense that this is their most unchanging face in the electronic realm this is your login name qualified by the complete address domain information for example ld longs lance colostate edu people see this address when receiving mail or reading usenet posts from you and in other situations where programs record usage some obsolete forms of addresses such as bitnet still persist in email messages additional information on the path that a message takes is prepended to the message received by the recipient this information identifies the chain of hosts involved in the transmission and is a very accurate trace of its origination this type of identify and forward protocol is also used in the usenet protocol to a lesser extent forging these fields requires corrupted mailing software at sites involved in the forwarding and is very uncommon not so uncommon is forging the chain at the origination point so that all initial sites in the list are faked at the time the message is created tracing these messages can be difficult or impossible when the initial faked fields are names of real machines and represent real transfer routes why is identity un important on the internet the concept of identity is closely intertwined with communication privacy and security which in turn are all critical aspects of computer networks for example the convenience of communication afforded by email would be impossible without conventions for identification but there are many potential abuses of identity possible that can have very severe consequences with massive computer networks at the forefront of the issue which can potentially either exacerbate or solve these problems verifying that an identity is correct is called authentication and one classic example of the problems associated with it is h g well s war of the worlds radio broadcast that fooled segments of the population into thinking that an alien invasion was in progress hoaxes of this order are not uncommon on usenet and forged identities makes them more insidious people and their reputations can be assaulted by forgery however the fluidity of identity on the internet is for some one of its most attractive features identity is just as useful as it is harmful a professor might carefully explain a topic until he finds he is talking to an undergraduate a person of a particular occupation may be able to converse with others who might normally shun him some prejudices are erased but on the other hand many prejudices are useful a scientist might argue he can better evaluate the findings of a paper as a reviewer if he knows more about the authors likewise he may be more likely to reject it based on unfair or irrelevant criteria on the other side of the connection the author may find identities of reviewers useful in exerting pressure for acceptance identity is especially crucial in establishing and regulating credit not necessarily financial and ownership and usage many functions in society demand reliable and accurate techniques for identification heavy reliance will be placed on digital authentication as global economies become increasingly electronic many government functions and services are based on identification and law enforcement frequently hinges on it hence employees of many government organizations push toward stronger identification structures but when does identification invade privacy the growth of the internet is provoking social forces of massive proportions decisions made now on issues of identity will affect many future users especially as the network becomes increasingly global universal widespread and entrenched and the positive or adverse affects of these actions intended and inadvertent will literally be magnified exponentially how does my email address not identify me and my background your email address may contain information that influences people s perceptions of your background the address may identify you as from a department at a particular university an employee at a company or a government worker it may contain your last name initials or cryptic identification codes independent of both in the us some are based on parts of social security numbers others are in the form u where the number is incremented in the order that new users are added to the system standard internet addresses also can contain information on your broad geographical location or nationhood however none of this information is guaranteed to be correct or be there at all the fields in the domain qualification of the username are based on rather arbitrary organization such as mostly invisible network cabling distributions the only point to make is that early fields in the address are more specific such as specific computer names or local networks and the later ones the most general such as continental domains typically the first field is the name of the computer receiving mail gleaning information from the email address alone is sometimes an inspired art or an inconsistent and futile exercise for more information see the faqs on email addresses and known geographical distributions below however unix utilities exist to aid in the quest see the question on this common suffixes us united states uk united kingdom ca canada fi finland au australia edu university or college com commercial organization org other e g nonprofit organization gov government mil military site how can i find out more about somebody with a given email address one simple way is to send email to that address asking another way is to send mail to the postmaster at that address i e postmaster address although the postmaster s job is more to help find user id s of particular people given their real name and solve mail routing problems the sysadmin i e root address may also be able to supply information users with related email address may have information however all of these methods rely on the time and patience of others so use them minimally one of the most basic tools for determining identity over the internet is the unix utility finger the basic syntax is finger user here there everywhere this utility uses communication protocols to query the computer named in the address for information on the user named the response is generated completely by the receiving computer and may be in any format possible responses are as follows a message unknown host meaning some aspect of the address is incorrect two lines with no information and a message in real life in which case the receiving computer could not find any kind of a match on the username the finger utility may return this response in other situations a listing of information associated with multiple users some computers will search only for matching user ids others will attempt to find the username you specified as a substring of all actual full names of users kept in a local database at some sites finger can be used to get a list of all users on the system with a finger address in general this is often considered weak security however because attackers know valid user id s to crack passwords more information on the fields returned by finger is given below more information on finger and locating people s email addresses is given in the email faq such as the whois lookup utility just as you can use these means to find out about others they can use them to find out about you you can finger yourself to find out what is publicly reported by your unix system about you be careful when modifying finger data virtually anyone with internet access worldwide can query this information in one amazing case the new york times writer j markoff uncovered the identity of r morris author of the internet worm through the use of an anonymous tip and finger see the book cyberspace by k hafner and j markoff why is identification un stable on the internet generally identity is an amorphous and almost nonexistent concept on the internet for a variety of reasons one is the inherent fluidity of cyberspace where people emerge and submerge frequently and absences are not readily noted in the community most people remember faces and voices the primary means of casual identification in the real world the arbitary and cryptic sequences of letters and digits comprising most email addresses are not particularly noticeable or memorable and far from a unique identification of an individual who may use multiple accounts on multiple machines anywhere in the world currently internet users do not really have any great assurances that the messages in email and usenet are from who they appear to be a person s mailing address is far from an identification of an individual anyone with access to the account e g they know the password either legitimately or otherwise can send mail with that address in the from line email addresses for an individual tend to change frequently as they switch jobs or make moves inside their organizations as part of current mailing protocol standards forging the from line in mail messages is a fairly trivial operation for many hackers the status and path information prepended to messages by intermediate hosts is generally unforgeable in general while possible forgeries are fairly rare on most newsgroups and in email besides these pathological cases abve there are many basic problems with today s internet protocols affecting identification on the internet internet mail standards described in rfc are still evolving rapidly and not entirely orderly for example standards for mail address munging or parsing tend to vary slightly between sites and frequently mean the difference between finding addresses and bouncing mail domain names and computer names are frequently changed at sites and there are delays in the propagation of this data addresses cannot be resolved when certain critical computers crash such as the receiving computer or other computers involved in resolving names into addresses called nameservers a whole slew of problems is associated with nameservers if they are not updated they will not find name addresses and even the operation of what constitutes updating has different interpretations at different sites the current internet mailing and addressing protocols are slightly anachronistic in that they were created when the network was somewhat obscure and not widespread with only a fraction of the traffic it now sees today a large proportion of internet traffic is email comprising millions of messages what is the future of identification on the internet some new technologies and standards are introducing facial images and voice messages into mail and these will improve the sense of community that comes from the familiarity of identification however they are not currently widespread require large amounts of data transfer standardized software and make some compromises in privacy promising new cryptographic techniques may make digital signatures and digital authentication common see below also the trend in usenet standards is toward greater authentication of posted information on the other hand advances in ensuring anonymity such as remailers are forthcoming see below privacy what is privacy on the internet generally while privacy has multiple connotations in society and perhaps even more on the internet in cyberspace most take it to mean that you have exclusive use and access to your account and the data stored on and and directed to it such as email and you do not encounter arbitrary restrictions or searches in other words others may obtain data associated with your account but not without your permission these ideas are probably both fairly limiting and liberal in their scope in what most internet users consider their private domains some users don t expect or want any privacy some expect and demand it why is privacy un important on the internet this is a somewhat debatable and inflammatory topic arousing passionate opinions on the internet some take privacy for granted and are rudely surprised to find it tenuous or nonexistent most governments have rules that protect privacy such as the illegal search and seizure clause of the u s constitution adopted by others but have many that are antithetical to it such as laws prohibiting secret communications or allowing wiretapping these rules generally carry over to the internet with few specific rules governing it however the legal repercussions of the global internet are still largely unknown and untested i e no strong legal precedents and court cases the fact that internet traffic frequently passes past international boundaries and is not centrally managed significantly complicates and strongly discourages its regulation how in secure are internet networks theoretically people at any site in the chain of sites with access to hardware and network media that transmits data over the internet could potentially monitor or archive it however the sheer volume and general noise inherent to this data makes these scenarios highly improbable even by government agencies with supposedly vast funding and resources technologies exist to tap magnetic fields given off by electrical wires without detection less obscurely any machine with a network connection is a potential station for traffic detection but this scenario requires knowledge and access to very low level hardware the network card to pursue if even possible a company network general inc is one of many that manufactures and markets sophisticated network monitoring tools that can filter and read packets by arbitrary criteria for troubleshooting purposes but the cost of this type of device is prohibitive for casual use known instances of the above types of security breaches at a major scale such as at network hubs are very rare the greatest risks tend to emerge locally note that all these approaches are almost completely defused with the use of cryptography how in secure is my account by default not very there are a multitude of factors that may reinforce or compromise aspects of your privacy on the internet first your account must be secure from other users the universal system is to use a password but if it is weak i e easy to guess this security is significantly diminished somewhat surprisingly and frighteningly to some certain users of the system particularly the administrator generally have unlimited access regardless of passwords and may grant that access to others this means that they may read any file in your account without detection furthermore not universally known most unix systems keep fairly extensive accounting records of when and where you logged in what commands you execute and when they are executed in fact login information is usually public most features of this auditing or process accounting information are enabled by default after the initial installation and the system administrator may customize it to strengthen or weaken it to satisfy performance or privacy aims this information is frequently consulted for troubleshooting purposes and may otherwise be ignored this data tracks unsuccessful login attempts and other suspicious activities on the system a traditional part of the unix system that tracks user commands is easily circumvented by the user with the use of symbolic links described in man ln unix implementations vary widely particularly in tracking features and new sophisticated mechanisms are introduced by companies regularly typically system adminstrators augment the basic unix functionality with public domain programs and locally developed tools for monitoring and use them only to isolate suspicious activity as it arises e g remote accesses to the passwd file incorrect login attempts remote connection attempts etc generally you should expect little privacy on your account for various reasons potentially every keystroke you type could be intercepted by someone else system administrators make extensive backups that are completely invisible to users which may record the states of an account over many weeks erased files can under many operating systems be undeleted most automated services keep logs of use for troubleshooting or otherwise for example ftp sites usually log the commands and record the domain originations of users including anonymous ones some software exacerbates these problems see the section on x windows in security indepedent of malevolent administrators are fellow users a much more commonly harmful threat there are multiple ways to help ensure that your account will not be accessed by others and compromises can often be traced to failures in these guidelines choose a secure password change it periodically make sure to logout always do not leave a machine unattended for long make sure no one watches you when you type your password avoid password references in email be conservative in the use of the rhost file use utilities like xlock to protect a station but be considerate be wary of situations where you think you should supply your password there are only several basic situations where unix prompts you for a password when you are logging in to a system or changing your password situations can arise in which prompts for passwords are forged by other users especially in cases where you are talking to them such as internet relay chat also be aware that forged login screens are one method to illegitimately obtain passwords thanks to jim mattson mattson cs ucsd edu for contributions here how in secure are my files and directories the most important privacy considerations are related to file rights and many lapses can be traced to their misunderstood nature or haphazard maintenance be aware of the rights associated with your files and directories in unix if the x execute right on your parent directory is off for users groups and other these users cannot gain information on anything in your directories anything less may allow others to read change or even delete files in your home directory the rights on a directory supersede the rights associated with files in that directory for a directory x means that access to the files or subdirectories in the directory is possible if you know their names to list the contents of the directory however requires the r right by default most accounts are accessable only to the owner but the initial configuration varies between sites based on administrator preference the default file mode specifies the initial rights associated with newly created files and can be set in the shell with umask the details of rights implementations tend to vary between versions of unix consult man pages on chmod and ls examples traver lance ls ld drwx ld jan users ld here is a listing of the rights associated with a user s home directory denoted by the columns at the left identify what rights are available the first column identifies the entry as a directory and the next three columns mean that read write and execute rights respectively are permitted for that user for directories the x right means that contents file and subdirectory names within that directory can be listed the subsequent columns indicate that no other users have any rights to anything in the directory tree originating at that point they can t even see any lower files or subdirectories the hierarchy is completely invisible to them traver lance ls l msg rw r r ld jan msg traver lance chmod u rw g o msg traver lance ls l msg rw ld jan msg here the modes on the file msg were changed to take away rights from group and other note that ls l file requires both the r right to get the list of files and subdirectories and the x right to access the files and subdirectories in order to get their size etc for example suppose the directory foo has rights dr r r the following is possible ls foo these commands would fail independent of file rights ls l foo ls l foo file cat foo file cd foo if the directory foo has rights d x x x the following are possible if it is known beforehand that foo contains an r readable file named file ls l foo file cat foo file cd foo the following commands fail ls foo ls l foo thanks to uwe waldmann uwe mpi sb mpg de for contributions here how in secure is x windows x windows is the primary software developed by the mit athena project which is funded by u s government grants to develop applications to harness the power of networks in enhancing computational tasks particularly the human computer interface the software implements a client server interface to a computer via graphical windows in this case the client is the application requesting or utilizing graphical resources such as windows or a mouse and the server is the machine that provides them in many situations the client is an application program running on the same machine as the server the great utility of x windows comes from its complete dissociation of the client and server so that windows may be broadcast to a server at a remote location from the client unfortunately this dynamic power also introduces many deep intricate and complicated security considerations the primary security and privacy issue associated with x windows is that much more sensitive data may be sent over a network and over wider regions than in the case where the human is situated near the host computer currently there is no encryption of data such as screen updates and keystrokes in x windows due to either intentional design decisions or unintentional design flaws early versions of the x window system are extremely insecure anyone with an account on the server machine can disrupt that display or read it electronically based on access to the device unix by any regular user there are no protections from this type of access in these versions the problem arises because the security is completely based on machine addresses rather than users such that any user at a trusted machine is himself trusted quoting from x documentation man xsecurity any client on a host in the host access control list is allowed access to the x server this system can work reasonably well in an environment where everyone trusts everyone or when only a single person can log into a given machine this system does not work well when multiple people can log in to a single machine and mutual trust does not exist with the access control list the xhost command may prevent some naive attempts i e those other than the direct access unix evasion the syntax as typed on the host machine is xhost name where name is the domain name or internet address of an authorized client machine by default clients running nonlocal to the host are disabled public domain programs to disrupt a display momentarily such as flip or slowly mirror the screen image or cause pixels to melt down to the bottom have been circulating on the internet among hackers for several years and played as pranks on unsuspecting or inexperienced users much more serious security breaches are conceivable from similar mechanisms exploiting this inherent weaknesses the minimal easily bypassed trusted security mode of xhost has been jokingly referred to as x hanging open security terrible new versions of the x window system x r and higher by default make server access as secure as the file system using a xauthority file and magic cookies remote machines must have a code in the xauthority file in the home directory that matches the code allowed by the server many older programs and even new vendor supplied code does not support or is incompatible with magic cookies the basic magic cookie mechanism is vulnerable to monitoring techniques described earlier because no encryption of keys occurs in transmission x r also includes other sophisticated encryption mechanisms try man xsecurity to find out what is supported at your site even though improved security mechanisms have been available in x windows since local sites often update this software infrequently because installation is extremely complex thanks to marc vanheyningen mvanheyn whale cs indiana edu jim mattson mattson cs ucsd edu and bill marshall marshall cs iastate edu for contributions here how in secure is my email by default not very the characters that you are reading are almost certainly encoded in ascii the american standard code for information interchange that maps alphabetic and symbolic characters onto numeric codes and vice versa virtually every computer system uses this code and if not has ways of converting to and from it when you write a mail message by default it is being sent in ascii and since the standard is virtually universal there is no intrinsic privacy despite milleniums worth of accumulated cryptographic knowledge cryptographic technologies are only recently being established that afford high priority to privacy as a primary criteria in computer and network design some potential pitfalls in privacy are as follows the most serious threats are instances of immature or unscrupulous system operators reading private mail in the spool files at a local site i e at the source or destination of the message such as a university system administrators may also release files to law enforcement agencies but conventions and protocols for warrants involving computer searches have still not been strongly established and tested legally note that bounced messages go to postmasters at a given site in their entirety this means that if you address mail with an incorrect address it has a good chance of being seen by a human other than the recipient typically new user accounts are always set up such that the local mail directory is private but this is not guaranteed and can be overridden finally be aware that some mailing lists email addresses of everyone on a list are actually publicly accessable via mail routing software mechanisms this feature can be disabled most potential compromises in email privacy can be thoroughly avoided with the use of strong end to end cryptography which has its own set of caveats for example unscrupulous administrators may still be a threat if the encryption site is shared or nonlocal see the sections on email privacy and email policies how am i not liable for my email and postings as punishment or whatever your system administrator can revoke certain privileges such as emailing usenet posting or reading certain groups file transferring remote communications or generally any subset of capabilities available from your account this all is completely at the discretion of the local administrator and under the procedures followed at a particular site which in many cases are haphazard and crisis oriented currently there are virtually no widespread uniform guidelines or procedures for restricting use to any internet services and local administrators are free to make arbitrary decisions on access today punitive measures are regularly applied in various situations in the typical scenario complaint s reach a system adminstrator regarding abuses by a user usually but not necessarily preceded by complaints to the user in email regarding that person s objectionable email or postings abusive posters to usenet are usually first given admonitions from their system administrators as urged by others on the net the debate persists endlessly on many newsgroups whether this is also used as a questionable means of attacking or silencing harmless crackpots or censoring unpopular opinions system administrators at remote sites regularly cooperate to squelch severe cases of abuse in general however by tradition usenet readers are remarkably tolerant of diverse views and uses of the system but a colorful vocabularly of slang helps describe their alternatives when this patience is sapped the options wielded by the individual user are to simply advance to the next message referred to as hitting the n key or to plonk annoying posters according to the hacker s dictionary the sound a jerk makes at the end of a fall to the bottom of a kill file in cases where punitive actions are applied generally system administrators are least likely to restrict email usenet postings are much more commonly restricted either to individual users or entire groups such as a university campus restrictions are most commonly associated with the following abuses harassing or threatening notes email terrorism illegal uses e g piracy or propagation of copyrighted material ad hominem attacks i e insulting the reputation of the poster instead of citing the content of the message intentional or extreme vulgarity and offensiveness inappropriate postings esp binary files in regular groups mail bombing inundating mail boxes with numerous or massive files major problems originate from lack of distinctions in private and official email or postings most users have internet access via accounts at businesses or universities and their activities on the internet can be construed as representative of their parent organizations many people put disclaimers in their signatures in an attempt dissociate their identity and activities from parent organizations as a precaution a recent visible political case involves the privacy of electronic mail written by white house staff members of the bush administration following are some guidelines acquaint yourself with your company or university policy if possible avoid use of your company email address for private communication use a disclaimer keep a low profile avoid flamewars or simply don t post avoid posting information that could be construed to be proprietary or internal the following references are available from ftp eff com see also the section on internet use policies pub academic banned pub academic banned computer material that was banned challenged in academia in and including usenet hierarchies pub academic cases this is an on line collection of information about specific computers and academic freedom cases file readme is a detailed description of the items in the directory pub academic faq netnews liability notes on university liability for usenet how do i provide more less information to others on my identity the public information of your identity and account is mostly available though the unix utility finger described above you have control over most of this information with the utility chfn the specifics vary between sites on some systems use passwd f you can provide unlimited information in the plan file which is copied directly to the destination during the fingering a technique that works at some sites allows you to find out who is finger ing you and even to vary the plan file sent to them your signature is determined by the environment variable signature usenet signatures are conventionally stored in the signature file in your home directory providing less information on your online identity is more difficult and involved one approach is to ask your system adminstrator to change or delete information about you such as your full name you may be able to obtain access on a public account or one from someone unrelated to you personally you may be able to remotely login via modem or otherwise to computers that you are not physically near these are tactics for hiding or masking your online activities but nothing is foolproof consult man pages on the chmod command and the default file mode generally files on a shared system have good safeguards within the user pool but very little protection is possible from corrupt system administrators to mask your identity in email or on usenet you can use different accounts more untraceable are new anonymous posting and remailing services that are very recently being established see below who is my sysadmin what does s he know about me the requirements and screening for getting a system administration job and thereby access to all information on a system vary widely between sites and are sometimes frighteningly lax especially at universities many unix systems at universities are largely managed by undergraduates with a background in computing and often hacking in general commercial and industrial sites are more strict on qualifications and background and government sites are extremely strict the system adminstrator root user can monitor what commands you used and at what times s he may have a record backups of files on your account over a few weeks s he can monitor when you send email or post usenet messages and potentially read either s he may have access to records indicating what hosts you are using both locally and elsewhere administrators sometimes employ specialized programs to track strange or unusual activity which can potentially be misused why is privacy un stable on the internet for the numerous reasons listed above privacy should not be an expectation with current use of the internet furthermore large parts of the internet are funded by the u s nsf national science foundation which places certain restrictions on its use such as prohibiting commercial use some high level officials in this and other government agencies may be opposed to emerging techniques to guarantee privacy such as encryption and anonymous services historically the major threats to privacy on the internet have been local perhaps the most common example of this are the widespread occurrences of university administrators refusing to carry some portion of usenet newsgroups labelled as pornographic the alternative hierarchy in the usenet system which has virtually no restrictions on propagation and new group creation is frequently targeted although this material may appear anywhere from the global point of view traffic is generally completely unimpeded on the internet and only the most egregious offenders are pursued for example verbatim transcriptions of copyrighted material such as newspaper or magazine articles are posted to usenet with regularity without major consequences some email complaints may ensue more astonishing to some is that currently significant portions of usenet traffic and less so internet traffic is comprised of sexually explicit digitized images almost entirely originating from copyrighted material newsgroups such as alt sex regularly have the highest traffic what is the future of privacy on the internet some argue that the internet currently has an adequate or appropriate level of privacy others will argue that as a prototype for future global networks it has woefully inadequate safeguards the internet is growing to become a completely global international superhighway for data and this traffic will inevitably entail data such as voice messages postal mail and many other items of extremely personal nature computer items that many people consider completely private such as their local hard drives will literally be inches from global network connections also sensitive industrial and business information is exchanged over networks currently and this volume may conceivably merge with the internet most would agree that for these basic but sensitive uses of the internet no significant mechanisms are currently in place to ensure much privacy new standards are calling for uniform introduction of privacy enhanced mail pem which uses encryption technologies to ensure privacy so that privacy protection is automatic and may significantly improve safeguards the same technology that can be extremely destructive to privacy such as with surreptitious surveilance can be overwhelmingly effective in protecting it e g with encryption some government agencies are opposed to unlimited privacy in general and believe that it should lawfully be forfeited in cases of criminal conduct e g court authorized wiretapping however powerful new technologies to protect privacy on computers are becoming increasingly popular provoking some to say that the cat is out of the bag and the genie can t be put back in the bottle in less idiomatic terms they believe that the spread of strong cryptography is already underway will be socially and technically unstoppable to date no feasible system that guarantees both secure communication and government oversight has been proposed the two goals are largely incompatible proposals for registration of secret keys by d denning on sci crypt for example have been met with hot controversy at best and ridicule and derision at worst mainly because of concerns for the right to privacy and objections of inherent feasibility electronic privacy issues and particularly the proper roles of networks and the internet will foreseeably become highly visible and explosive over the next few years anonymity what is anonymity on the internet simply stated anonymity is the absence of identity the ultimate in privacy however there are several variations on this simple theme a person may wish to be consistently identified by a certain pseudonym or handle and establish a reputation under it in some area providing pseudo anonymity a person may wish to be completely untraceable for a single one way message a sort of hit and run or a person may wish to be openly anonymous but carry on a conversation with others with either known or anonymous identities via an anonymous return address a user may wish to appear as a regular user but actually be untraceable sometimes a user wishes to hide who he is sending mail to in addition to the message itself the anonymous item itself may be directed at individuals or groups a user may wish to access some service and hide all signs of the association all of these uses are feasible on the internet but are currently tricky to carry out in practice because of all the tracking mechanisms inherent to operating systems and network protocols officials of the nsf and other government agencies may be opposed to any of these uses because of the potential for abuse nevertheless the inherent facelessness of large networks will always guarantee a certain element of anonymity why is anonymity un important on the internet anonymity is another powerful tool that can be beneficial or problematic depending on its use arguably absence of identification is important as the presence of it it may be the case that many strong benefits from electronic anonymity will be discovered that were unforeseen and unpredicted because true anonymity has been historically very difficult to establish one can use anonymity to make personal statements to a colleague that would sabotage a relationship if stated openly such as employer employee scenarios one can use it to pass information and evade any threat of direct retribution for example whistleblowers reporting on government abuses economic social or political can bring issues to light without fear of stigma or retaliation sensitive personal potentially damaging information is often posted to some usenet groups a risky situation where anonymity allows conversations to be carried on completely independent of the identities of the participants some police departments run phone services that allow anonymous reporting of crimes such uses would be straightforward on the network unfortunately extortion and harassment become more insidious with assurances of anonymity how can anonymity be protected on the internet the chief means as alluded to above are masking identities in email and posting however anonymous accounts public accounts as accessable and anonymous as e g public telephones may be effective as well but this use is generally not officially supported and even discouraged by some system adminstrators and nsf guidelines the nonuniformity in the requirements of obtaining accounts at different sites and institutions makes anonymous accounts generally difficult to obtain to the public at large many communications protocols are inherently detrimental to anonymity virtually every protocol in existence currently contains information on both sender and receiver in every packet new communications protocols will likely develop that guarantee much higher degrees of secure anonymous communication what is anonymous mail one approach to anonymizing mail has been to set up an anonymous server that when activated by email to its address responds by allocating and supplying an anonymous id that is unique to the person requesting it based on his email address this will vary for the same person for different machine address email originations to send anonymous mail the user sends email directed to the server containing the final destination the server anonymizes the message by stripping of identification information and forwards the message which appears to originate from the anonymous server only from the corresponding anonymous user id this is the interactive use of anonymity or pseudonymity mentioned above another more fringe approach is to run a cypherpunk remailer from a regular user account no root system privileges are required these are currently being pioneered by eric hughes and hal finney hal alumni caltech edu the operator runs a process on a machine that anonymizes mail sent to him with certain characteristics that distinguish it from his regular incoming mail typically fields in the header one has been implemented as a perl script running on unix several of these are in existence currently but sites and software currently are highly unstable they may be in operation outside of system administrator knowledge the remailers don t generally support anonymous return addresses mail that is incorrectly addressed is received by the operator generally the user of the remailer has to disavow any responsibility for the messages forwarded through his system although actually may be held liable regardless these approaches have several serious disadvantages and weaknesses the anonymous server approach requires maintaining a mapping of anonymous id s to real addresses that must be maintained indefinitely one alternative is to allow deallocation of aliases at the request of the user but this has not been implemented yet although an unlikely scenario traffic to any of these sites could conceivably be monitored from the outside necessitating the use of cryptography for basic protection local administrators can shut them down either out of caprice or under pressure from local network or government agencies unscrupulous providers of the services can monitor the traffic that goes through them most remailers currently keep logs that may be inspected the cypherpunk approach tends to be highly unstable because these operators are basically network users who do not own the equipment and are accountable to their own system administrators who may be unaware of the use and unsympathetic to the philosophy of anonymity when the operation is discovered regarding it as illicit use in all cases a high degree of trust is placed in the anonymous server operator by the user currently the most direct route to anonymity involves using smtp protocols to submit a message directly to a server with arbitrary field information this practice not uncommon to hackers and the approach used by remailers is generally viewed with hostility by most system administrators information in the header routing data and logs of network port connection information may be retained that can be used to track the originating site in practice this is generally infeasible and rarely carried out some administrators on the network will contact local administrators to request a message be tracked and its writer admonished or punished more severely such as revoking the account all of this actually happening occasionally but infrequently see the sections known anonymous mail and posting sites and responsibilities associated with anonymity what is anonymous posting anonymous servers have been established as well for anonymous usenet posting with all the associated caveats above monitored traffic capricious or risky local circumstances logging make sure to test the system at least once by e g anonymous posting to misc test however some operators don t recommend this because many sites autorespond to test messages possibly causing the anonymous server to allocate anonymous ids for those machines see the responsibilties associated with anonymous posting before proceeding another direct route involves using nntp protocols to submit a message directly to a newserver with arbitrary field information this practice not uncommon to hackers is also generally viewed with hostility by most system administrators and similar consequences can ensue see the sections known anonymous mail and posting sites and responsibilities associated with anonymity why is anonymity un stable on the internet as noted many factors compromise the anonymity currently available to the general internet community and these services should be used with great caution to summarize the technology is in its infancy and current approaches are unrefined unreliable and not completely trustworthy no standards have been established and troubling situations of loss of anonymity and bugs in the software are prevalent here are some encountered and potential bugs one anonymous remailer reallocated already allocated anonymous return addresses others passed signature information embedded in messages unaltered address resolution problems resulting in anonymized mail bounced to a remailer are common forgeries to the anonymous server itself are a problem possibly allowing unauthorized users to potentially glean anon id email address mappings in the alias file this can be remedied with the use of passwords infinite mail loops are possible with chaining remailers source code is being distributed tested and refined for these systems but standards are progressing slowly and weakly the field is not likely to improve considerably without official endorsement and action by network agencies the whole idea is essentially still in its infancy and viewed with suspicion and distrust by many on the internet seen as illegitimate or favorable to criminality the major objection to anonymity over regular internet use is the perceived lack of accountability to system operators i e invulnerability to account restrictions resulting from outside complaints system adminstrators at some sites have threatened to filter anonymous news postings generated by the prominent servers from their redistribution flows this may only have the effect of encouraging server operators to create less characteristically detectable headers probably the least problematic approach and the most traditional to usenet is for individual users to deal with anonymous mail however they prefer e g ignoring it or filtering it with kill files what is the future of anonymity on the internet new anonymous protocols effectively serve to significantly increase safeguards of anonymity for example the same mechanism that routes email over multiple hosts thereby threatening its privacy can also be used to guarantee it in a scheme called chaining an anonymous message is passed through multiple anonymous servers before reaching a destination in this way generally multiple links of the chain have to be broken for security to be compromised re encryption at each link makes this scenario even more unlikely even more significantly the anonymous remailers could be spread over the internet globally so that local weaknesses such as corrupt governments or legal wiretapping within a nation would be more unlikely to sacrifice overall security by message tracing however remailers run by corrupt operators are possible the future of anonymous services on the internet is at this time highly uncertain and fraught with peril while specific groups seem to benefit significantly from anonymous posting capabilities many feel that unlimited newsgroup scope for anonymous posting is a disruptive and dangerous idea and detracts from discussions in serious groups the introduction of unlimited group anonymity may have fundamental repercussions on usenet conventions and distribution mechanisms such as moderated and alt groups have had in the past for example as part of new group creation the charter may specify whether anonymous posting is un welcome nevertheless the widespread introduction and use of anonymity may be inevitable based on traffic statistics anonymous services are in huge demand pervasive and readily available anonymity could carry significant and unforeseen social consequences however if its use is continued to be generally regarded as subversive it may be confined to the underground the ramifications of widespread introduction of anonymity to usenet are still largely unknown it is unclear whether it will provoke signficant amounts of new traffic or instead of expansion cause a shift where a greater portion of existing traffic is anonymized conceivably the services could play a role in influencing future mainstream social acceptance of usenet this is part of the privacy anonymity faq obtained via anonymous ftp to pit manager mit edu pub usenet news answers net privacy or newsgroups news answers sci answers alt answers every days written by l detweiler ld longs lance colostate edu all rights reserved
