CDR: Re: Anonymous Remailers cpunk

[Bill Stewart]

At 02:05 AM 10/4/00 -0400, Sean Roach wrote:
>At 05:22 PM 10/3/2000, Steve Furlong wrote:
>...
>>I'm assuming there's a way to tell with minimal difficulty if a message
>>is encrypted, without relying on an easily-spoofed X header line.
>>Perhaps someone who knows more about all of the many message protocols
>>can weigh in here.
>...
....
>Couldn't something that A.  Watched for a limited list of known words, 
>(including the header information for UUENCODED, and MIME encoded, GIF's, 
>JPG's, BMP's, MP3's etc, along with a dictionary of very common 6+ letter 
>words.  and B.  Back that up with some simple analysis, of the sort that 
>can break single alphabet cyphers, (finding the e's, etc).

Interesting idea, but far more trouble and CPU than it's worth,
especially if you handle all the cases of MIME-encoded and UUencoded stuff.
Also, it'll probably decide GIFs, JPEGs, MP3s, and WAVs are encrypted data.

It's not going to stop all the harassers either,
just force them to be more clever, while slightly decreasing the
reliability of your remailer.  It's probably better to use
simple detection of encryption (look for the headers)
and put in your own Subject: and header lines advising the recipient
that it's an anonymous message and how to block it,
which will take care of most of the anklebiters and
let you be really apologetic to the recipient about how the 
abuser is trying real hard to work around your protections.

  Subject: Anonymous Message - Info at http://foobar.remailer.cc/policy.html

At some point, you might decide that Type I remailers aren't really 
secure enough, and just run Mixmaster anyway.  Then most of this goes away.

The place I found that remailers really get into trouble is Usenet.
It's not the messages directly to the harasser, it's things like 
forged flamebait sent to gay newsgroups or rec.pets.cats.
Limiting yourself to encrypted output makes it hard to post.
If you're going to post directly to Usenet, it's safe to append and
prepend a bunch of disclaimers to the message body (since nobody
reads headers) about how this was an anonymous message, it's untraceable,
there aren't any records, it's probably forged anyway, and the 
web page for complaints and instructions is
http://foobar.remailer.cc/policy.html



				Thanks! 
					Bill
Bill Stewart, bill.stewart at pobox.com
PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639