At 5:02 PM 10/22/95, Lance Cottrell wrote:
I think one solution to this problem is to encourage (require) the use of pseudonym servers. Having a server like alpha as the entity on the from line has several advantages.
1) Less Spam since it takes some effort to set up the nym and it will be taken away as soon as the spam starts.
2) The operator can take firm action. When people complain they want you to punish the abuser. Typically they want you to pull the offenders account. With a remailer there is no account to pull, but with a nym server it is easy to kill the account, making the complainer happy.
I fully agree with this point, and have argued for this approach before. There is no logical or other reason why "physical machine site = a remailer," even though that has until recently been the norm. ("I have a machine--I'll run a remailer.") Rather, a single physical machine site can and should be able to run many remailers, out of user accounts. (Accounts on systems like Sameer's C2. Or Hal's remailer running on Portal. Or maybe some of the Mixmaster clients.) This has a couple of salutory effects: 1. It separates the logical function, and responsibilities, of running a remailer from the function of maintaining a site. 2. It puts the "risk" on the account holder, not the site owner. (The site owner can plausibly deny knowing the account was remailing messages.) 3. A proliferation of nyms can be used, as Lance notes, with the "offending nym" cancelled when trouble arises. (I'm not especially keen on seeing sysops bow to pressure to kill accounts, but if it happens, better it happens to a "disposable nym.") 4. Multiplication. Having remailer accounts instead of remailer sites means an N-fold increase in the number of remailers. 5. A single person could have multiple remailer nym accounts, perhaps having differing policies. 6. Search warrants and legal speed bumps. If the cops have to get separate search warrants for N accounts, on M different sites, this will slow things down. (Hint: The remailer "Ralph" can choose to route messages through N extra steps, perhaps on several of his own accounts on _distant_ machines. Faced with a search warrant on "his" account, a la the visits to Penet, he doesn't have to implicate himself by saying he also owns the N other hops. Of course, he can do the same thing with remailers operated by others....I'm just noting that having N remailers under one's own control has certain elegant advantages.)
3) The nym server could have a policy of only accepting messages encrypted to it, and logging the address the message came from. If confronted, the nym server could point to the last remailer in the chain. But that remailer could not have known the contents of the message since it was encrypted to the nym server.
7. Competition. Picking up on Lance's point, having multiple remailer accounts under one's own control allows one to experiment with various policies and operational modes, and to see which are most popular. Great for evolutionary purposes. 8. Finally, and most importantly, the "remailer in a box" idea, for turn-key remailers, allows even the timid to operate a remailer FOR THEIR OWN USE! That is, they don't have to publicize the public key, or the existence at all of the remailer. But they can use it in their own chain of hops, for their own messages or for whatever. This facillitates the "everyone a remailer" idea. It also increases protection ("always include a remailer under your own control"). I'll stop for now. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."