-----BEGIN PGP SIGNED MESSAGE----- According to Raph's remailer stats, the remailers have widely varying latencies. Given that only a few remailers have latencies which are acceptably low, the list of usable remailers is quite low. If the user of the remailer, Monty Cantsin for example, signs his messages, a fairly accurate measure of total transit time is obtained. The total transit time gives clues to the remailers which were actually used in the chain. In an of itself, this may not comprise the user, but combined with other weaknesses it will cause the attacker to be significantly more confident of identification hypotheses. The remailers should all have about the same latency. 0 seconds seems like a good Schelling point. What would it take to reduce remailer latency to under 60 seconds for most of the remailers? Do people need old 486s to dedicate to the task? Do they need money? Better software? If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCrG4paWtjSmRH/5AQFuAAf+ID6TSjoUV1sVehzW6DoqVXREyO/fR4Uw H+W6QCiTOQaRhTD1Z6WSaL9FOaBJ5aSHCdLzKy9eIvagXsYR+eqVBdO0oSuDaloc BYSN+QXSKvMEuEotkCF4RicRoENlTmD0Qcrz4KvvW+d+jRxyxejs9O0HqDeTq9y/ KpBtq8CytpEMmGc6VSHuAX90qwJTtHUk/k4ulXU7v4xMmBLu1HpS/9M5h7mooybC 8qwVJKswAMI4wTB5FlBj/+b8txkCzMdqJkFdLEYu+LAGZfkB96W9uRU+eGekCHY2 6iycxv+m4r7wXPbP9A83Y6UnP4nkZBW86y7Du8NjVWGpscCfNjFF3g== =QjE1 -----END PGP SIGNATURE-----
At 11:58 PM 9/25/97 +0200, Anonymous wrote:
If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen.
Sure. Send me $125 a month for a dedicated line, and I'll insure that you get low latencies on winsock. Regards, -- Joey Grasty jgrasty@gate.net WinSock Remailer Operator (winsock@rigel.cyberpass.net)
At 2:58 PM -0700 9/25/97, Anonymous wrote:
The remailers should all have about the same latency. 0 seconds seems like a good Schelling point. What would it take to reduce remailer latency to under 60 seconds for most of the remailers? Do people need old 486s to dedicate to the task? Do they need money? Better software?
If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen.
Think about a zero latency. How would mixing then occur? How would the mapping between incoming and outcoming messages be obscured? Latency, per se, is of course not the key issue. Mixing is. If a remailer site gets an average of 10 messages per minute, and a mixing of 10 is desired, then the average time delay could be as short as 1 minute. If a remailer gets only a handful of messages over several hours, then the latency cannot safely be made shorter than a few hours. The math is straightforward. As to what is needed to generally improve the remailers, this has been discussed many times. Cf. my Cyphernomicon for some thoughts, c. 1994, which actually haven't changed much. Generally, a bunch of things would be nice to have: * throwaway accounts, and yet with some robustness or reputation capital backing them * increased traffic at all levels * a profit motive for remailers, using "digital postage" (though this may work against the second point, having more traffic) * more chaining tools for average users (on Windows and Macintosh machines, using standard mailers) * more analysis of the weaknesses of remailer networks, looking at correlations that can be made, spoofing methods, etc. * and so on --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
At 11:58 PM 9/25/97 +0200, Anonymous (Monty Cantsin) wrote:
The remailers should all have about the same latency. 0 seconds seems like a good Schelling point. What would it take to reduce remailer latency to under 60 seconds for most of the remailers?
By latency, I assume you mean the lag time from when the message is sent, till when it is received. There are several possible reasons as to why a remailer message is subject to a longer lag time than you like. Remailer software is often a work in progress. Changes are made on a regular basis. A recent change to correct one problem recently had the effect of spinning off multiple copies of some of the remailer sub programs. As more and more copies went into memory, the machine got slower and slower. Programming changes are not an uncommon thing. But remailers are subject to the same forces as other things on the internet. Email is particularly well suited for asynchronous communications, so email is often left to drag behind while other processes continue. I've seen email I send to lists take hours to appear back to me. In addition to this natural internet force, remailers can be throttled to go slow. There are a number of options that can be selected by the administrator to keep the remailer running slowly. One of the more externally obvious is the reordering pool. A reordering remailer is designed to fool traffic analysis by sending messages out in a different order from what they come in. By design a message must wait to be delivered. A user option in remailers will allow the sender to specify an additional wait time to add to the system generated latency. What would it take to get latency to under 60 seconds? More remailer traffic would help. If instead of 100 messages per hour a remailer was to receive 1,000 messages per hour there would be less need to throttle the system and introduce lags to foil system traffic. The reordering pool would be flushed much more quickly. You asked about hardware, there are places where faster, or more hardware might help. The truth is not everyone wants to reduce latency. -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key
Tim May
As to what is needed to generally improve the remailers, this has been discussed many times. Cf. my Cyphernomicon for some thoughts, c. 1994, which actually haven't changed much.
Generally, a bunch of things would be nice to have:
* throwaway accounts, and yet with some robustness or reputation capital backing them
We've kind of got throw away accounts recently, Ian Goldberg wrote a
perl script to open accounts and sendmail through a couple of the free
web based email services.
On the remailer operators list use of this script was discussed as an
alternative for remailer operators moving to `middleman' operation, or
closing down entirely in the face of threats.
There might even be a remailer or two using this ... perhaps some
remailer operators could fill us in.
Adam
--
Now officially an EAR violation...
Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0
* increased traffic at all levels
Cover traffic bots are, to my knowledge, not yet implemented in any of the "eze-remailer (tm)" software packages like private idaho etc... Maybe this is a feature to think about for their authors for future revisions???
* a profit motive for remailers, using "digital postage" (though this may work against the second point, having more traffic)
I have never thought this was a good idea, commercialising the remailer market, and indeed any market, not only gives a further incentive for government intervention but also allows for the remailer operators to be prosecuted for content more easily, providing a free service allows one to claim "common carrier" status more eaily.
* more chaining tools for average users (on Windows and Macintosh machines, using standard mailers)
Yes, private idaho is an excellent package, but many users do not want the extra work of setting up another mailer which, in the buggy windoze environment may even lead to clashes and other such nastiness. Integration into mailers such as pegasus and eudora would be nice, I`m sure there must be a plugin for eudora by now but I`m pretty sure there is no such plugin for pegasus. Datacomms Technologies data security Paul Bradley, Paul@fatmans.demon.co.uk Paul@crypto.uk.eu.org, Paul@cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"
At 11:58 PM 9/25/97 +0200, Anonymous (Monty Cantsin) wrote:
What would it take to reduce remailer latency to under 60 seconds for most of the remailers? Do people need old 486s to dedicate to the task? Do they need money? Better software?
If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen.
If Monty would like to send a suitable 486, I'll see to it that it becomes a remailer. If you would like to send two 486's, I'll see to it that they both become remailers and at least one of them has a latency under 60 secs average. Donated machines (stuffed with ecash, I hope) may be sent to: Robert Costner Electronic Frontiers Georgia Suite A-205 4780 Ashford-Dunwoody Rd. Atlanta, GA 30338 -- Robert Costner Phone: (770) 512-8746 Electronic Frontiers Georgia mailto:pooh@efga.org http://www.efga.org/ run PGP 5.0 for my public key
* throwaway accounts, and yet with some robustness or reputation capital backing them We've kind of got throw away accounts recently, Ian Goldberg wrote a perl script to open accounts and sendmail through a couple of the free web based email services. ... There might even be a remailer or two using this ... perhaps some remailer operators could fill us in.
There are remailer programs for both Hotmail (web-based) and Juno (dialup), and several people are actually operating remailers from Juno. The remailers accept mail un the usual fashion, including PGP support, and take care of working around the advertising that comes with the free mail. Both services have anti-spamming terms of service, which probably block running general-purpose remailers from them because they send unsolicited mail to non-previously-consenting users. But there's no problem with the TOS in running remailers that only send mail to subscribed users, and it may or may not be acceptable to run the kind of remailer that sends "Subject: You have anonymous mail - message#12432; reply to pick it up" and doesn't bother the user further unless they ask for the mail. I also don't know about posting to Usenet from them. So what can you do with a limited-target-area remailer? - Entry remailer, with well-known name, that only forwards its mail to other remailers. Recopients don't complain, though you can still get flooded with SPAM. - Middleman remailer, accepting mail only from remailers and sending only to other remailers. Nobody complains. Easy to maintain. Great for forwarding cover traffic through other remailers. - nymserver target remailers, though obviously if you're the only recipient of mail, it's a bit visible, though you could set them up to chain to another remailer - forwarders to message pools - subscription-only remailers. - maybe spam filters? - - your suggestion here - Thanks! Bill Bill Stewart, stewarts@ix.netcom.com Regular Key PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639
Bill Stewart wrote:
So what can you do with a limited-target-area remailer? - Entry remailer, with well-known name, that only forwards its mail to other remailers. Recopients don't complain, though you can still get flooded with SPAM. - Middleman remailer, accepting mail only from remailers and sending only to other remailers. Nobody complains. Easy to maintain. Great for forwarding cover traffic through other remailers. - nymserver target remailers, though obviously if you're the only recipient of mail, it's a bit visible, though you could set them up to chain to another remailer - forwarders to message pools - subscription-only remailers. - maybe spam filters? - - your suggestion here
- use a cheap throw-away account on a different ISP to direct abuse compaints to, and never use the account to 'send' email. (most people can't read headers, and just attack whoever you point them toward. an ISP would be hard-pressed to justify cancelling an account which never sent out email, for 'abuse'.) B. Loser, Remailer
participants (8)
-
Adam Back -
Bill Stewart -
Born Loser Remailer -
Joey Grasty -
nobody＠REPLAY.COM -
Paul Bradley -
Robert A. Costner -
Tim May