Archive-name: net-privacy/part1
Last-modified: 1994/5/7
Version: 3.0



IDENTITY, PRIVACY, and ANONYMITY on the INTERNET
================================================

(c) Copyright 1994 L. Detweiler.  Not for commercial use except by
 permission from author, otherwise may be freely copied.  Not to be
 altered.  Please credit if quoted.

SUMMARY
=======

Information on email and account privacy, anonymous mailing and
posting, encryption, and other privacy and rights issues associated
with use of the Internet and global networks in general.

(Search for <#.#> for exact section. Search for '_' (underline) for
next section.)

PART 1
====== (this file)


Identity
--------
<1.1> What is `identity' on the internet?
<1.2> Why is identity (un)important on the internet?
<1.3> How does my email address (not) identify me and my background?
<1.4> How can I find out more about somebody from their email address?
<1.5> Why is identification (un)stable on the internet?
<1.6> What is the future of identification on the internet?

Privacy
-------
<2.1> What is `privacy' on the internet?
<2.2> Why is privacy (un)important on the internet?
<2.3> How (in)secure are internet networks?
<2.4> How (in)secure is my account?
<2.5> How (in)secure are my files and directories?
<2.6> How (in)secure is X Windows?
<2.7> How (in)secure is my email?
<2.8> How am I (not) liable for my email and postings?
<2.9> How do I provide more/less information to others on my identity?
<2.10> Who is my sysadmin?  What does s/he know about me?
<2.11> Why is privacy (un)stable on the internet?
<2.12> What is the future of privacy on the internet?

Anonymity
---------
<3.1> What is `anonymity' on the internet?
<3.2> Why is `anonymity' (un)important on the internet?
<3.3> How can anonymity be protected on the internet?
<3.4> What is `anonymous mail'?
<3.5> What is `anonymous posting'?
<3.6> Why is anonymity (un)stable on the internet?
<3.7> What is the future of anonymity on the internet?

PART 2
====== (next file)

Issues
------

<4.1> What is the Electronic Frontier Foundation (EFF)?
<4.2> Who are Computer Professionals for Social Responsibility (CPSR)?
<4.3> What was `Operation Sundevil' and the Steve Jackson Game case?
<4.4> What is Integrated Services Digital Network (ISDN)?
<4.5> What is the National Research and Education Network (NREN)?
<4.6> What is the FBI's proposed Digital Telephony Act?
<4.7> What is U.S. policy on freedom/restriction of strong encryption?
<4.8> What other U.S. legislation is related to privacy?
<4.9> What are references on rights in cyberspace?
<4.10> What is the Computers and Academic Freedom (CAF) archive?

Clipper
-------

<5.1> What is the Clipper Chip Initiative?
<5.2> How does Clipper blunt `cryptography's dual-edge sword'?
<5.3> Why are technical details of the Clipper chip being kept secret?
<5.4> Who was consulted in the development of the Clipper chip?
<5.5> How is commerical use/export of Clipper chips regulated?
<5.6> What are references on the Clipper Chip?
<5.7> What are compliments/criticisms of the Clipper chip?
<5.8> What are compliments/criticisms of the Clipper Initiative?
<5.9> What are compliments/criticisms of the Clipper announcement?
<5.10> Where does Clipper fit in U.S. cryptographic technology policy?

PART 3
====== (last file)

Resources
---------

<6.1> What UNIX programs are related to privacy?
<6.2> How can I learn about or use cryptography?
<6.3> What is the cypherpunks mailing list?
<6.4> What are some privacy-related newsgroups?  FAQs?
<6.5> What is internet Privacy Enhanced Mail (PEM)?
<6.6> What are other Request For Comments (RFCs) related to privacy?
<6.7> How can I run an anonymous remailer?
<6.8> What are references on privacy in email?
<6.9> What are some email, Usenet, and internet use policies?

Miscellaneous
-------------

<7.1> What is ``digital cash''?
<7.2> What is a ``hacker'' or ``cracker''?
<7.3> What is a ``cypherpunk''?
<7.4> What is `steganography' and anonymous pools?
<7.5> What is `security through obscurity'?
<7.6> What are `identity daemons'?
<7.7> What standards are needed to guard electronic privacy?

Footnotes
---------

<8.1> What is the background behind the Internet?
<8.2> How is Internet `anarchy' like the English language?
<8.3> Most Wanted list
<8.4> Change history

* * *


IDENTITY
========

_____
<1.1> What is `identity' on the internet?

 Generally, today people's `identity' on the internet is primarily
 determined by their email address in the sense that this is their
 most unchanging 'face' in the electronic realm.   This is your
 login name qualified by the complete address domain information,
 for example ``[email protected]''.  People see
 this address when receiving mail or reading USENET posts from you
 and in other situations where programs record usage.  Some obsolete
 forms of addresses (such as BITNET) still persist.

 In email messages, additional information on the path that a message
 takes is prepended to the message received by the recipient.  This
 information identifies the chain of hosts involved in the
 transmission and is a very accurate trace of its origination.  This
 type of identify-and-forward protocol is also used in the USENET
 protocol to a lesser extent.  Forging these fields requires
 corrupted mailing software at sites involved in the forwarding and
 is very uncommon.  Not so uncommon is forging the chain at the
 origination point, so that all initial sites in the list are faked
 at the time the message is created.  Tracing these messages can be
 difficult or impossible when the initial faked fields are names of
 real machines and represent real transfer routes.

_____
<1.2> Why is identity (un)important on the internet?

 The concept of identity is closely intertwined with communication,
 privacy, and security, which in turn are all critical aspects of
 computer networks. For example, the convenience of communication
 afforded by email would be impossible without conventions for
 identification.  But there are many potential abuses of identity
 possible that can have very severe consequences, with massive
 computer networks at the forefront of the issue, which can
 potentially either exacerbate or solve these problems.

 Verifying that an identity is correct is called `authentication',
 and one classic example of the problems associated with it is
 H.G. Well's ``War of the Worlds'' science fiction story adapted to a
radio broadcast that fooled
 segments of the population into thinking that an alien invasion was
 in progress.  Hoaxes of this order are not uncommon on Usenet and
 forged identities makes them more insidious.  People and their
 reputations can be assaulted by forgery.

 However, the fluidity of identity on the internet is for some one of
 its most attractive features. Identity is just as useful as it is
 harmful.  A professor might carefully explain a topic until he
 finds he is talking to an undergraduate. A person of a particular
 occupation may be able to converse with others who might normally
 shun him.  Some prejudices are erased, but, on the other hand, many
 prejudices are useful!  A scientist might argue he can better
 evaluate the findings of a paper as a reviewer if he knows more
 about the authors.  Likewise, he may be more likely to reject it
 based on unfair or irrelevant criteria.  On the other side of the
 connection,  the author may find identities of reviewers useful in
 exerting pressure for acceptance.

 Identity is especially crucial in establishing and regulating
 `credit' (not necessarily financial) and `ownership' and `usage'.
 Many functions in society demand reliable and accurate techniques
 for identification. Heavy reliance will be placed on digital
 authentication as global economies become increasingly electronic.
 Many government functions and services are based on identification,
 and law enforcement frequently hinges on it.  Hence, employees of
 many government organizations push toward stronger identification
 structures.  But when does identification invade privacy?

 The growth of the internet is provoking social forces of massive
 proportions. Decisions made now on issues of identity will affect
 many future users, especially as the network becomes increasingly
 global, universal, widespread, and entrenched; and the positive or
 adverse affects of these actions, intended and inadvertent,  will
 literally be magnified exponentially.

_____
<1.3> How does my email address (not) identify me and my background?

 Your email address may contain information that influences people's
 perceptions of your background.  The address may `identify' you as
 from a department at a particular university, an employee at a
 company, or a government worker.  It may contain your last name,
 initials, or cryptic identification codes independent of both.  In
 the US some are based on parts of social security numbers.  Others
 are in the form 'u2338' where the number is incremented in the
 order that new users are added to the system.

 Standard internet addresses  also can contain information  on your
 broad geographical location or nationhood.  However, none of this
 information is guaranteed to be correct or be there at all.  The
 fields in the domain qualification of the username are based on
 rather arbitrary organization, such as (mostly invisible) network
 cabling distributions.  The only point to make is that early fields
 in the address are more specific (such as specific computer names
 or local networks) and the later ones the most general (such as
 continental domains).  Typically the first field is the name of the
 computer receiving mail.

 Gleaning information from the email address alone is sometimes an
 inspired art or an inconsistent and futile exercise.  (For more
 information, see the FAQs on email  addresses and known
 geographical distributions below.)  However, UNIX utilities exist
 to aid in the quest (see the question on this).

 Common Suffixes
 ---------------

 .us    United States
 .uk    United Kingdom
 .ca    Canada
 .fi    Finland
 .au    Australia

 .edu   university or college
 .com   commercial organization
 .org   'other' (e.g. nonprofit organization)
 .gov   government
 .mil   military site

_____
<1.4> How can I find out more about somebody with a given email address?

 One simple way is to send email to that address, asking.  Another
 way is to send mail to the postmaster at that address (i.e.
 postmaster@address), although the postmaster's job is more to help
 find user ID's of particular people given their real name and solve
 mail routing problems.  The sysadmin (i.e. `root@address') may also
 be able to supply information.  Users with related email address
 may have information.  However, all of these methods rely on the
 time and patience of others so use them minimally.

 One of the most basic tools for determining identity over the
 internet is the UNIX utility 'finger'.  The basic syntax is:

   finger [email protected]

 This utility uses communication protocols to query the computer
 named in the address for information on the user named.  The
 response is generated completely by the receiving computer and may
 be in any format.  Possible responses are as follows:

 - A message `unknown host' meaning some aspect of the address is
   incorrect, two lines with no information and '???'.

 - A message 'In real life: ???' in which case the receiving computer
   could not find any kind of a match on the username. The finger
   utility may return this response in other situations.

 - A listing of information associated with multiple users. Some
   computers will search only for matching user IDs, others will
   attempt to find the username you specified as a substring of all
   actual full names of users kept in a local database.

 At some sites 'finger' can be used to get a list of all users on the
 system with a `finger @address'.  In general this is often
 considered weak security, however, because `attackers' know valid
 user ID's to `crack' passwords.

       More information on the fields returned by `finger' is given below.
       More information on `finger' and locating people's email addresses
       is given in the email FAQ (such as the WHOIS lookup utility).  Just
       as you can use these means to find out about others, they can use
       them to find out about you.  You can `finger' yourself to find out
       what is publicly reported by your UNIX system about you.  Be
       careful when modifying `finger' data; virtually anyone with
       internet access worldwide can query this information.  In one
       famous case, the New York Times writer J. Markoff uncovered the
       identity of R. Morris, author of the Internet Worm,  through the
       use of `finger' after an anonymous caller slipped by revealing his
       initials which were also his login ID.  See the book Cyberpunk by
       K. Hafner and J. Markoff.

_____
<1.5> Why is identification (un)stable on the internet?

 Generally, identity is an amorphous and almost nonexistent concept
 on the Internet for a variety of reasons.  One is the inherent
 fluidity of `cyberspace' where people emerge and submerge
 frequently, and absences are not readily noted in the `community'.
 Most people remember faces and voices, the primary means of casual
 identification in the 'real world'.  The arbitary and cryptic
 sequences of letters and digits comprising most email addresses are
 not particularly noticeable or memorable and far from a unique
 identification of an individual, who may use multiple accounts on
 multiple machines anywhere in the world.

 Currently internet users do not really have any great assurances
 that the messages in email and USENET are from who they appear to
 be. A person's mailing address is far from an identification of an
 individual.

 - Anyone with access to the account, e.g. they know the password,
   either legitimately or otherwise, can send mail with that address
   in the From: line.

 - Email addresses for an individual tend to change frequently as
   they switch jobs or make moves inside their organizations.

 - As part of current mailing protocol standards, forging the From:
   line in mail messages is a fairly trivial operation for many
   hackers.

 The status and path information prepended to messages by
 intermediate hosts is generally unforgeable. In general, while
 possible, forgeries are fairly rare on most newsgroups and in
 email.  Besides these pathological cases abve there are many basic
 problems with today's internet protocols affecting identification
 on the internet:

 - Internet mail standards, described in RFC-822, are still evolving
   rapidly and not entirely orderly.  For example, standards for
   mail address `munging' or `parsing' tend to vary slightly between
   sites and frequently mean the difference between finding
   addresses and bouncing mail.

 - Domain names and computer names are frequently changed at sites,
   and there are delays in the propagation of this data.

 - Addresses cannot be resolved when certain critical computers
   crash, such as the receiving computer or other computers involved
   in resolving names into addresses called `nameservers'.

 - A whole slew of problems is associated with  `nameservers'; if
   they are not updated they will not find name addresses, and even
   the operation of what constitutes `updating' has different
   interpretations at different sites.

 The current internet mailing and addressing protocols are slightly
 anachronistic in that they were created when the network was
 somewhat obscure and not widespread, with only a fraction of the
 traffic it now sees.  Today a large proportion of internet traffic
 is email, comprising  millions of messages.

_____
<1.6> What is the future of identification on the internet?

 Some new technologies and standards are introducing facial images
 and voice messages  into mail and these will improve the sense of
 community that comes from the familiarity of identification.
 However, they are not currently widespread, require large amounts
 of data transfer, standardized software, and make some compromises
 in privacy.

 Promising new cryptographic techniques may make 'digital signatures'
 and 'digital authentication' common (see below).  Also, the trend
 in USENET standards is toward greater authentication of posted
 information.  On the other hand, advances in ensuring anonymity
 (such as remailers) are forthcoming.  See below.


PRIVACY
=======

_____
<2.1> What is `privacy' on the internet?

 Generally, while `privacy' has multiple connotations in society and
 perhaps even more on the internet, in cyberspace most take it to
 mean that you have exclusive use and access to your account and the
 data stored on and and directed to it (such as email), and you do
 not encounter arbitrary restrictions or searches.  In other words,
 others may obtain data associated with your account, but not
 without your permission.  These ideas are probably both fairly
 limiting and liberal in their scope in what most internet users
 consider their private domains.  Some users don't expect or want
 any privacy, some expect and demand it.

_____
<2.2> Why is privacy (un)important on the internet?

 This is a somewhat debatable and inflammatory topic, arousing
 passionate opinions.  On the internet, some take privacy for
 granted and are rudely surprised to find it tenuous or nonexistent.
 Most governments have rules that protect privacy (such as the
 illegal search and seizure clause of the U.S. constitution, adopted
 by others) but have many that are antithetical to it (such as laws
 prohibiting secret communications or allowing wiretapping). These
 rules generally carry over to the internet with few specific rules
 governing it.  However, the legal repercussions of the global
 internet are still largely unknown and untested (i.e. no strong
 legal precedents and court cases).  The fact that internet traffic
 frequently passes past international boundaries, and is not
 centrally managed, significantly complicates and strongly
 discourages its regulation.

_____
<2.3> How (in)secure are internet networks?

 - `Theoretically' people at any site in the chain of sites with
   access to hardware and network media that transmits data over the
   Internet  could potentially monitor or archive it. However, the
   sheer volume and general 'noise' inherent to this data makes
   these scenarios highly improbable, even by government agencies
   with supposedly vast funding and resources.

 - Technologies exist to `tap' magnetic fields given off by
   electrical wires without detection.  Less obscurely, any machine
   with a network connection is a potential station for traffic
   detection, but this scenario requires knowledge and access to
   very low-level hardware (the network card) to pursue, if even
   possible.

 - A company Network General Inc. is one of many that manufactures
   and markets sophisticated network monitoring tools that can
   'filter' and read packets by arbitrary criteria for
   troubleshooting purposes, but the cost of this type of device is
   prohibitive for casual use.

 Known instances of the above types of security  breaches at a major
 scale (such as at network hubs) are very rare. The greatest risks
 tend to emerge locally.  Note that all these approaches are almost
 completely defused with the use of cryptography.

_____
<2.4> How (in)secure is my account?

 By default, not very.  There are a multitude of factors that may
 reinforce or compromise aspects of your privacy on the internet.
 First, your account must be secure from other users. The universal
 system is to use a password, but if it is `weak' (i.e. easy to
 guess) this security is significantly diminished.  Somewhat
 surprisingly and frighteningly to some, certain  users of the
 system, particularly the administrator, generally have unlimited
 access regardless of passwords, and may grant that access to
 others.  This means that they may read any file in your account
 without detection.

 Furthermore, not universally known, most UNIX systems keep fairly
 extensive accounting records of when and where you logged in, what
 commands you execute, and when they are executed (in fact, login
 information is usually public). Most features of this `auditing' or
  `process accounting' information are enabled by default after the
 initial installation and the system administrator may customize it
 to strengthen or weaken it to satisfy performance or privacy aims.
 This information is frequently consulted for troubleshooting
 purposes and may otherwise be ignored.  This data tracks
 unsuccessful login attempts and other 'suspicious' activities on
 the system. A traditional part of the UNIX system that tracks user
 commands is easily circumvented by the user with the use of
 symbolic links (described  in 'man ln').

       UNIX implementations vary widely particularly in tracking features
       and new sophisticated mechanisms are introduced by companies
       regularly. Typically system adminstrators augment the basic UNIX
       functionality with public-domain programs and locally-developed
       tools for monitoring, and use them only to isolate `suspicious'
       activity as it arises (e.g. remote accesses to the 'passwd' file,
       incorrect login attempts, remote connection attempts, etc.).

 Generally, you should expect little privacy on your account for
 various reasons:

 - Potentially, every keystroke you type could be intercepted by
   someone else.

 - System administrators make extensive backups that are completely
   invisible to users which may record the states of an account over
   many weeks.

 - Erased files can, under many operating systems, be undeleted.

 - Most automated services keep logs of use for troubleshooting or
   otherwise; for example FTP sites usually log the commands and
   record the domain originations of users, including anonymous
   ones.

 - Some software exacerbates these problems.  See the section on
   ``X Windows (in)security''.

 Indepedent of malevolent administrators are fellow users, a much
 more commonly harmful threat. There are multiple ways to help
 ensure that your account will not be accessed by others, and
 compromises can often be traced to failures in these guidelines:

 - Choose a secure password.  Change it periodically.
 - Make sure to logout always.
 - Do not leave a machine unattended for long.
 - Make sure no one watches you when you type your password.
 - Avoid password references in email.
 - Be conservative in the use of the .rhost file.
 - Use utilities like `xlock' to protect a station, but be
   considerate.

 Be wary of situations where you think you should supply your
 password.  There are only several basic situations where UNIX
 prompts you for a password: when you are logging in to a system or
 changing your password.  Situations can arise in which prompts for
 passwords are forged by other users, especially in cases where you
 are talking to them (such as Internet Relay Chat).  Also, be  aware
 that forged login screens are one method to illegitimately obtain
 passwords.


 (Thanks to Jim Mattson <[email protected]> for contributions
 here.)

_____
<2.5> How (in)secure are my files and directories?

 The most important privacy considerations are related to file
 rights, and many lapses can be traced to their misunderstood nature
 or haphazard maintenance. Be aware of the rights associated with
 your files and directories in UNIX. If the `x' (`execute') right on
 your parent directory is off for users, groups, and other, these
 users cannot gain information on anything in your directories.
 Anything less may allow others to read, change, or even delete
 files in your home directory. The rights on a directory supersede
 the rights associated with files in that directory. For a
 directory, 'x' means that access to the files (or subdirectories)
 in the directory is possible -- if you know their names.  To list
 the contents of the directory, however, requires the 'r' right.

 By default most accounts are accessable only to the owner, but the
 initial configuration varies between sites based on administrator
 preference.  The default file mode specifies the initial rights
 associated with newly created files, and can be set in the shell
 with `umask'.  The details of rights implementations tend to vary
 between versions of UNIX.  Consult man pages on `chmod' and `ls'.

 Examples
 --------

   traver.lance % ls -ld ~
   drwx------ 15 ld231782     1536 Jan 31 21:22 /users/ld231782/

 Here is a listing of the rights associated with a user's home
 directory, denoted by `~'.  The columns at the left identify what
 rights are available. The first column identifies the entry as a
 directory, and the next three columns mean that read, write, and
 execute rights, respectively, are permitted for that user.  For
 directories, the `x' right means that contents (file and
 subdirectory names) within that directory can be listed. The
 subsequent columns indicate that no other users have any rights to
 anything in the directory tree originating at that point.  They
 can't even `see' any lower files or subdirectories; the hierarchy
 is completely invisible to them.

   traver.lance % ls -l msg
   -rw-r--r--  1 ld231782   35661 Jan 29 23:13 msg
   traver.lance % chmod u=rw,g=,o= msg
   traver.lance % ls -l msg
   -rw-------  1 ld231782   35661 Jan 29 23:13 msg

 Here the modes on the file `msg' were changed to take away rights
 from `group' and `other'.

 Note that `ls -l <file>' requires both the 'r' right to get the list
 of files and subdirectories, and the 'x' right to access the files
 and subdirectories in order to get their size, etc. For example,
 suppose the directory `foo' has rights dr--r--r--,  the following
 is possible:

   ls foo

 These commands would fail independent of file rights:

   ls -l foo
   ls -l foo/file
   cat foo/file
   cd foo

 If the directory `foo' has rights d--x--x--x, the following are
 possible if it is known beforehand that `foo' contains an 'r'
 readable file named `file':

   ls -l foo/file
   cat foo/file
   cd foo

 The following commands fail:

   ls foo
   ls -l foo


 (Thanks to Uwe Waldmann <[email protected]> for contributions here.)

_____
<2.6> How (in)secure is X Windows?

 X Windows is the primary software developed by the MIT Athena
 project (1983-1991) which was funded by commercial grants
 primarily from DEC and IBM to develop
 applications to harness the power of networks in enhancing
 computational tasks, particularly the human-computer interface.
 The software implements a client-server interface to a computer via
 graphical windows. In this case the `client' is the application
 requesting or utilizing  graphical resources (such as windows or a
 mouse) and the `server' is the machine that provides them.  In many
 situations the client is an application program running on the same
 machine as the server.

 The great utility of X Windows comes from its complete dissociation
 of the client and server so that windows may be `broadcast' to a
 server at a remote location from the  client. Unfortunately this
 dynamic power also introduces many deep, intricate, and complicated
 security considerations.  The primary security and privacy issue
 associated with X Windows is that much more sensitive data may be
 sent over a network, and over wider regions, than in the case where
 the human is situated near the host computer.  Currently there is
 no encryption of data such as screen updates and keystrokes in X
 Windows.

       Due to either intentional design decisions or unintentional design
       flaws,  early versions of the X Window system are extremely
       insecure (the decision may have been made not to attempt to
       overcome existing vulnerabiliies in the Unix system). Anyone with
       an account on the server machine can disrupt that display or read
       it electronically based on access to the device unix:0.0 by any
       regular user.   There are no protections from this type of access
       in these versions.   The problem arises because the security is
       completely based on machine addresses rather than users, such that
       any user at a `trusted' machine is himself trusted. Quoting from X
       documentation (man Xsecurity):

 > Any client on a host in the host access control list is allowed
 > access to the X server. This system can work reasonably well in
 > an environment where everyone trusts everyone, or when only a
 > single person can log into a given machine...This system does not
 > work well when multiple people can log in to a single machine and
 > mutual trust does not exist.

 With the access control list, the `xhost' command may prevent some
 naive attempts (i.e. those other than the direct-access unix:0.0
 evasion); the syntax as typed on the host machine is  ``xhost
 +[name]'' where [name] is the domain name or internet address of an
 authorized client machine. By default clients running nonlocal to
 the host are disabled.  Public domain programs to disrupt a display
 momentarily (such as 'flip' or slowly mirror the screen image, or
 cause pixels to 'melt' down to the bottom) have been circulating on
 the internet among hackers for several years and played as pranks
 on unsuspecting or inexperienced users.  Much more serious security
 breaches are conceivable from similar mechanisms exploiting this
 inherent weaknesses.  (The minimal, easily-bypassed `trusted'
 security mode of `xhost' has been jokingly referred to as ``X
 Hanging Open, Security Terrible.'').

 New versions of the X Window system (X11R5 and higher) by default
 make server access as secure as the file system using a .Xauthority
 file and 'magic cookies'.  Remote machines must have a code in the
 .Xauthority file in the home directory that matches the code
 allowed by the server.  Many older programs and even new
 vendor-supplied code does not support or is incompatible with
 `magic cookies'. The basic magic cookie mechanism is vulnerable to
 monitoring techniques described earlier because no encryption of
 keys occurs in transmission.  X11R5 also includes other
 sophisticated encryption mechanisms.  Try `man Xsecurity' to find
 out what is supported at your site.  Even though improved security
 mechanisms have been available in X Windows since ~1990, local
 sites often update this software infrequently because installation
 is extremely complex.


 (Thanks to Marc Vanheyningen <[email protected]>,
 Jim Mattson <[email protected]>, and Bill Marshall
 <[email protected]> for contributions here.)

_____
<2.7> How (in)secure is my email?

 By default, not very.  The characters that you are reading are
 almost certainly encoded in ASCII, the American Standard Code for
 Information Interchange that maps alphabetic and symbolic
 characters onto numeric codes and vice versa.  Virtually every
 computer system uses this code, and if not, has ways of converting
 to and from it.  When you write a mail message, by default it is
 being sent in ASCII,  and since the standard is virtually
 universal, there is no intrinsic privacy.  Despite milleniums worth
 of accumulated cryptographic knowledge, cryptographic technologies
 are only recently being established that afford high priority to
 privacy as a primary criteria in computer and network design.  Some
 potential pitfalls in privacy are as follows:

 - The most serious threats are instances of immature or unscrupulous
   system operators reading private mail in the `spool files' at a
   local site (i.e. at the source or destination of the message),
   such as a university.

 - System administrators may also release files to law enforcement
   agencies, but conventions and protocols for warrants involving
   computer searches have still not been strongly established and
   tested legally.

 - Note that bounced messages go to postmasters at a given site in
   their entirety.  This means that if you address mail with an
   incorrect address it has a good chance of being seen by a human
   other than the recipient.

 - Typically new user accounts are always set up such that the local
   mail directory is private, but this is not guaranteed and can be
   overridden.

 - Finally, be aware that some mailing lists (email addresses of
   everyone on a list) are actually publicly accessable via mail
   routing software mechanisms.  This `feature' can be disabled.

 Most potential compromises in email privacy can be thoroughly
 avoided with the use of strong end-to-end cryptography, which has
 its own set of caveats (for example, unscrupulous administrators
 may still be a threat if the encryption site is shared or
 nonlocal).  See the sections on ``email privacy'' and ``email
 policies.''

_____
<2.8> How am I (not) liable for my email and postings?

 As punishment or whatever, your system administrator can revoke
 certain `privileges' such as emailing, USENET posting or reading
 certain groups, file transferring, remote communications, or
 generally any subset of capabilities available from your account.
 This all is completely at the discretion of the local administrator
 and under the procedures followed at a particular site, which in
 many cases are haphazard and crisis-oriented.  Currently there are
 virtually no widespread, uniform guidelines or procedures  for
 restricting use to any internet services, and local administrators
 are free to make arbitrary decisions on access.

 Today punitive measures are regularly applied in various situations.
 In the typical scenario complaint(s) reach a system adminstrator
 regarding abuses by a user, usually but not necessarily preceded by
 complaints to the user in email, regarding that person's
 objectionable email or postings.  `abusive' posters to USENET are
 usually first given admonitions from their system administrators as
 urged by others on the `net'. (The debate persists endlessly on
 many newsgroups whether this is also used  as a questionable means
 of attacking or silencing `harmless crackpots' or censoring
 unpopular opinions.)

 System administrators at remote sites regularly cooperate to
 'squelch' severe cases of abuse.  In general, however, by tradition
 Usenet readers are remarkably tolerant of diverse views and uses of
 the system, but a colorful vocabularly of slang helps describe
 their alternatives when this patience is sapped: the options
 wielded by the individual user are to simply advance to the next
 message (referred to as ``hitting the `n' key''), or to `plonk'
 annoying posters (according to the Hacker's Dictionary, the sound a
 jerk makes at the end of a fall to the bottom of a kill file).

 In cases where punitive actions are applied, generally system
 administrators are least likely to restrict email.  USENET postings
 are much more commonly restricted, either to individual users or
 entire groups (such as a university campus).  Restrictions are most
 commonly associated with the following `abuses':

 - harassing or threatening notes, `email terrorism'
 - illegal uses, e.g. piracy or propagation of copyrighted material
 - `ad hominem' attacks, i.e. insulting the reputation of the
   poster instead of citing the content of the message
 - intentional or extreme vulgarity and offensiveness
 - inappropriate postings, esp. binary files in regular groups
   `mail-bombing': inundating mail boxes with numerous or massive
   files

 Major problems originate from lack of distinctions in private and
 official email or postings.  Most users have internet access via
 accounts at businesses or universities and their activities on the
 internet can be construed as representative of their parent
 organizations. Many people put disclaimers in their `signatures' in
 an attempt dissociate their identity and activities from parent
 organizations as a precaution. A recent visible political case
 involves the privacy of electronic mail  written by White House
 staff members of the Bush administration.  Following are some
 guidelines:

 - Acquaint yourself with your company or university policy.
 - If possible, avoid use of your company email address for private
   communication.
 - Use a disclaimer.
 - Keep a low profile (avoid `flamewars' or simply don't post).
 - Avoid posting information that could be  construed to be
   proprietary or `internal'.

 The following references are available from ftp.eff.com
 (see also the section on ``internet use policies''):

 /pub/academic/banned.1991
 /pub/academic/banned.1992
 ---
   Computer material that was banned/challenged in academia in 1991
   and 1992 including USENET hierarchies.

 /pub/academic/cases
 ---
   This is an on-line collection of information about specific
   computers and academic freedom cases. File README is a detailed
   description of the items in the directory.

 /pub/academic/faq/netnews.liability
 ---
   Notes on university liability for Usenet.

_____
<2.9> How do I provide more/less information to others on my identity?

 The public information of your identity and account is mostly
 available though the UNIX utility `finger' described above.

 - You have control over most of this information with the utility
   `chfn', the specifics vary between sites (on some systems use
   `passwd -f').

 - You can provide unlimited information in the .plan file which is
   copied directly to the destination during the fingering.

 - A technique that works at some sites allows you to find out who is
   'finger'ing you and even to  vary the .plan file sent to them.

 - Your signature is determined by the environment variable SIGNATURE

 - USENET signatures are conventionally stored in the .signature file
   in your home directory.

 Providing less information on your online identity is more difficult
 and involved.  One approach is to ask your system adminstrator to
 change or delete information about you (such as your full name).
 You may be able to obtain access on a public account or one from
 someone unrelated to you personally.  You may be able to remotely
 login (via modem or otherwise) to computers that you are not
 physically near.  These are tactics for hiding or masking your
 online activities but nothing is foolproof.  Consult man pages on
 the 'chmod' command and the default file mode.  Generally, files on
 a shared system have good safeguards within the user pool but very
 little protection is possible from corrupt system administrators.

 To mask your identity in email or on USENET you can use different
 accounts. More untraceable are new `anonymous posting' and
 remailing services that are very recently being established.  See
 below.

______
<2.10> Who is my sysadmin?  What does s/he know about me?

 The requirements and screening for getting a system administration
 job (and thereby access to all information on a system) vary widely
 between sites and are sometimes frighteningly lax, especially at
 universities.  Many UNIX systems at universities are largely
 managed by undergraduates with a background in computing and often
 `hacking'.  In general, commercial and industrial sites are more
 strict on qualifications and background, and government sites are
 extremely strict.

 The system adminstrator (root user) can monitor what commands you
 used and at what times.  S/he may have a record (backups) of files
 on your account over a few weeks. S/he can monitor when  you send
 email or post USENET messages, and potentially read either.  S/he
 may have access to records indicating what hosts you are using,
 both locally and elsewhere.  Administrators sometimes employ
 specialized programs to  track `strange' or `unusual' activity,
 which can potentially be misused.

______
<2.11> Why is privacy (un)stable on the internet?

 For the numerous reasons listed above, privacy should not be an
 expectation with current use of the internet.  Furthermore, large
 parts of the internet are funded by the U.S. NSF (National Science
 Foundation) which places certain restrictions on its use (such as
 prohibiting commercial use).  Some high-level officials in this and
 other government agencies may be opposed to emerging techniques to
 guarantee privacy (such as encryption and anonymous services).

 Historically the major threats to privacy on the internet have been
 local. Perhaps the most common example of this are the widespread
 occurrences of university administrators refusing to carry some
 portion of USENET newsgroups labelled as `pornographic'. The
 `alternative' hierarchy in the USENET system, which has virtually
 no restrictions on propagation and new group creation, is
 frequently targeted (although this material may appear anywhere).

 From the global point of view traffic is generally completely
 unimpeded on the internet  and only the most egregious offenders
 are pursued.  For example,  verbatim transcriptions of copyrighted
 material (such as newspaper or magazine articles) are posted to
 USENET with regularity without major consequences (some email
 complaints may ensue).  More astonishing to some is that currently
 significant portions of USENET traffic, and less so internet
 traffic, is comprised of sexually-explicit digitized images almost
 entirely originating from copyrighted material (newsgroups such as
 `alt.sex' regularly have the  highest traffic).

______
<2.12> What is the future of privacy on the internet?

 Some argue that the internet currently has an adequate or
 appropriate level of privacy.  Others will argue that as a
 prototype for future global networks it has woefully inadequate
 safeguards.  The internet is growing to become a completely global,
 international superhighway for data, and this traffic will
 inevitably entail data such as voice messages, postal mail, and
 many other items of extremely personal nature. Computer items that
 many people consider completely private (such as their local hard
 drives) will literally be inches from global network connections.
 Also, sensitive industrial and business information is exchanged
 over networks currently and this volume may conceivably merge with
 the internet.

 Most would agree that, for these basic but sensitive uses of the
 internet, no significant mechanisms are currently in place to
 ensure much privacy. New standards are calling for uniform
 introduction of `privacy enhanced mail' (PEM) which uses encryption
 technologies to ensure privacy, so that privacy protection is
 automatic, and may significantly improve safeguards.

 The same technology that can be extremely destructive to privacy
 (such as with  surreptitious surveilance) can be overwhelmingly
 effective in protecting  it (e.g. with encryption). Some government
 agencies are opposed to unlimited privacy in general, and believe
 that it should lawfully be forfeited in cases of criminal conduct
 (e.g. court-authorized wiretapping).  However, powerful new
 technologies to protect privacy on computers are becoming
 increasingly popular, provoking some to say that ``the cat is out
 of the bag'' and the ``genie can't be put back in the bottle''.  In
 less idiomatic terms, they believe that the spread of strong
 cryptography is already underway will be socially and technically
 unstoppable.

 To date, no feasible system that guarantees both secure
 communication and government oversight has been proposed (the two
 goals are largely incompatible). Proposals for ``registration'' of
 secret keys (by D. Denning on sci.crypt, for example) have been met
 with hot controversy at best and ridicule and derision at worst,
 mainly because of concerns for the right to privacy and objections
 of inherent feasibility.  Electronic privacy issues, and
 particularly the proper roles of networks and the internet, will
 foreseeably become highly visible and explosive over the next few
 years.


ANONYMITY
=========

_____
<3.1> What is `anonymity' on the internet?

 Simply stated, anonymity is the absence of identity, the
 ultimate in privacy. However, there are several variations on
 this simple theme.  A person may wish to be consistently
 identified by a certain pseudonym or `handle' and establish a
 reputation under it in some area, providing pseudo-anonymity.
 A person may wish to be completely untraceable for a single
 one-way message (a sort of `hit-and-run'). Or, a person may
 wish to be openly anonymous but carry on a conversation with
 others (with either known or anonymous identities) via an
 `anonymous return address'.  A user may wish to appear as a
 `regular user' but actually be untraceable.  Sometimes a user
 wishes to hide who he is sending mail to (in addition to the
 message itself). The anonymous item itself may be directed at
 individuals or groups.  A user may wish to access some
 service and hide all  signs of the association.

 All of these uses are feasible on the internet but are currently
 tricky to carry out in practice, because of all the tracking
 mechanisms inherent to operating systems and network protocols.
 Officials of the NSF and other government agencies may be opposed
 to any of these uses because of the potential for abuse.
 Nevertheless, the inherent facelessness of large networks will
 always guarantee a certain element of anonymity.

_____
<3.2> Why is `anonymity' (un)important on the internet?

 Anonymity is another powerful tool that can be beneficial or
 problematic depending on its use.  Arguably absence of
 identification is important as the presence of it.  It may be the
 case that many strong benefits from electronic anonymity will be
 discovered that were unforeseen and unpredicted, because true
 anonymity has been historically very difficult to establish.

       One can use anonymity to make personal statements to a colleague
       that would sabotage a relationship if stated openly (such as
       employer/employee scenarios).  One can use it to pass information
       and evade any threat of direct retribution.  For example,
       `whistleblowers' reporting on government abuses (economic, social,
       or  political) can bring issues to light without fear of stigma or
       retaliation. Sensitive, personal, potentially damaging information
       is often posted to some USENET groups, a risky situation where
       anonymity allows conversations to be carried on completely
       independent of the identities of the participants.  Some police
       departments run phone services that allow anonymous reporting of
       crimes; such uses would be straightforward on the network.
       Anonymity can be extremely important and potentially lifesaving
       diagnoses and discussions carried out on medical or theurapeutic
       newsgroups. Unfortunately, extortion and harassment become more
       insidious with assurances of anonymity.

_____
<3.3> How can anonymity be protected on the internet?

 The chief means, as alluded to above, are masking identities in
 email and posting. However, anonymous accounts (public accounts as
 accessable and anonymous as e.g. public telephones) may be
 effective as well, but this use is generally not officially
 supported and even discouraged by some system adminstrators and NSF
 guidelines.  The nonuniformity in the requirements of obtaining
 accounts at different sites and institutions makes anonymous
 accounts generally difficult to obtain to the public at large.

 Many communications protocols are inherently detrimental to
 anonymity.  Virtually every protocol in existence currently
 contains information on both sender and receiver in every packet.
 New communications protocols will likely develop that guarantee
 much higher degrees of secure anonymous communication.

_____
<3.4> What is `anonymous mail'?

 One approach to `anonymizing' mail has been to set up an `anonymous
 server' that, when activated by email to its address, responds by
 allocating and supplying an `anonymous ID' that is unique to the
 person requesting it (based on his email address).  This will vary
 for the same person for different machine address email
 originations. To send anonymous mail, the user sends email directed
 to the server containing the final destination. The server
 `anonymizes' the message by stripping of identification information
 and forwards the message, which appears to originate from the
 anonymous server only from the corresponding anonymous user id.
 This is the `interactive' use of anonymity or pseudonymity
 mentioned above.

 Another more `fringe' approach is to run a `cypherpunk' remailer
 from a regular user account (no root system privileges are
 required). These are currently being pioneered by  Eric Hughes and
 Hal Finney <[email protected]>. The operator runs a process on
 a machine that anonymizes mail sent to him with certain
 characteristics that distinguish it from his regular incoming mail
 (typically fields in the header). One has been implemented as a
 PERL script running on UNIX.  Several of these are in existence
 currently but sites and software currently are highly unstable;
 they may be in operation outside of system administrator knowledge.
 The remailers don't generally support anonymous return addresses.
 Mail that is incorrectly addressed is received by the operator.
 Generally the user of the remailer has to disavow any
 responsibility for the messages forwarded through his system,
 although actually may be held liable regardless.

 These approaches have several serious disadvantages and weaknesses:

 - The anonymous server approach requires maintaining a mapping of
   anonymous ID's to real addresses that must be maintained
   indefinitely.  One alternative is to allow `deallocation' of
   aliases at the request of the user, but this has not been
   implemented yet.

 - Although an unlikely scenario, traffic to any of these sites could
   conceivably be monitored from the `outside', necessitating the
   use of cryptography for basic protection,.

 - Local administrators can shut them down either out of caprice or
   under pressure from local, network, or government agencies.

 - Unscrupulous providers of the services can monitor the traffic
   that goes through them.

 - Most remailers currently keep logs that may be inspected.

 - The cypherpunk approach tends to be highly unstable because these
   operators are basically  network users who do not own the
   equipment and are accountable  to their own system
   administrators, who may be unaware of the use and unsympathetic
   to the philosophy of anonymity when the operation is discovered,
   regarding it as illicit use.

 - In all cases, a high degree of trust is placed in the anonymous
   server operator by the user.

 Currently the most direct route to anonymity involves using SMTP
 protocols to submit a message directly to a server with arbitrary
 field information.  This practice, not uncommon to hackers, and the
 approach used by remailers, is generally viewed with hostility by
 most system administrators.  Information in the header routing data
 and logs of network port connection information may be retained
 that can be used to track the originating site.  In practice, this
 is generally infeasible and rarely carried out.  Some
 administrators on the network will contact local administrators to
 request a message be tracked and its writer admonished or punished
 more severely (such as revoking the account), all of this actually
 happening occasionally but infrequently.

 See the sections ``known anonymous mail and posting sites'' and
 ``responsibilities associated with anonymity''.

_____
<3.5> What is `anonymous posting'?

 Anonymous servers have been established as well for anonymous Usenet
 posting with all the associated caveats above (monitored traffic,
 capricious or risky local circumstances, logging).  Make sure to
 test the system at least once by e.g. anonymous posting to
 misc.test (however some operators don't recommend this because many
 sites `autorespond' to test messages, possibly causing the
 anonymous server to allocate anonymous IDs for those machines).
 See the ``responsibilties associated with anonymous posting''
 before proceeding.

 Another direct route involves using NNTP protocols to submit a
 message directly to a newserver with arbitrary field information.
 This practice, not uncommon to hackers, is also generally viewed
 with hostility by most system administrators, and similar
 consequences can ensue.

 See the sections ``known anonymous mail and posting sites'' and
 ``responsibilities associated with anonymity''.

_____
<3.6> Why is anonymity (un)stable on the internet?

 As noted, many factors compromise the anonymity currently available
 to the general internet community, and these services should be
 used with great caution.  To summarize, the technology is in its
 infancy and current approaches are unrefined, unreliable, and not
 completely trustworthy.  No standards have been established and
 troubling situations of loss of anonymity and bugs in the software
 are prevalent.  Here are some encountered and potential bugs:

 - One  anonymous remailer reallocated already allocated anonymous
   return addresses.
 - Others passed signature information embedded in messages
   unaltered.
 - Address resolution problems resulting in anonymized mail bounced
   to a remailer are common.
 - Forgeries to the anonymous server itself are a problem,  possibly
   allowing unauthorized users to potentially glean anon ID - email
   address  mappings in the alias file.  This can be remedied with
   the use of passwords.
 - Infinite mail loops are possible with chaining remailers.

 Source code is being distributed, tested, and refined for these
 systems, but standards are progressing slowly and weakly.  The
 field is not likely to improve considerably without  official
 endorsement and action by network agencies.  The whole idea is
 essentially still in its infancy and viewed with suspicion and
 distrust by many on the internet, seen as illegitimate or favorable
 to criminality.  The major objection to anonymity over regular
 internet use  is the perceived lack of accountability to system
 operators, i.e. invulnerability to account restrictions resulting
 from outside complaints.  System adminstrators at some sites have
 threatened to filter anonymous news postings generated by the
 prominent servers from their redistribution flows.  This may only
 have the effect of encouraging server operators to create less
 characteristically detectable headers.  Probably the least
 problematic approach, and the most traditional to Usenet, is for
 individual users to deal with anonymous mail however they prefer,
 e.g. ignoring it or filtering it with kill files.

_____
<3.7> What is the future of anonymity on the internet?

 New anonymous protocols effectively serve to significantly increase
 safeguards of anonymity.  For example, the same mechanism that
 routes email over multiple hosts, thereby threatening its privacy,
 can also be used to guarantee it. In a scheme called `chaining' an
 anonymous message is passed through multiple anonymous servers
 before reaching a destination.  In this way generally multiple
 links of the chain have to be `broken' for security to be
 compromised. Re-encryption at each link makes this scenario even
 more unlikely.  Even more significantly the anonymous remailers
 could be spread over the internet globally so that local weaknesses
 (such as corrupt governments or legal wiretapping within a nation)
 would be more unlikely to sacrifice overall security by message
 tracing. However, remailers run by corrupt operators are possible.

 The future of anonymous services on the internet is, at this time,
 highly uncertain and fraught with peril. While specific groups seem
 to benefit significantly from anonymous posting capabilities, many
 feel that unlimited newsgroup scope for anonymous posting is a
 disruptive and dangerous idea and detracts from discussions in
 `serious' groups.   The introduction of unlimited group anonymity
 may have fundamental repercussions on Usenet conventions and
 distribution mechanisms such as moderated and `alt' groups have had
 in the past. For example, as part of new group creation, the
 charter may specify whether `anonymous' posting is (un)welcome.

 Nevertheless, the widespread introduction and use of anonymity may
 be inevitable. Based on traffic statistics, anonymous services are
 in huge demand. Pervasive and readily available anonymity could
 carry significant and unforeseen social consequences.  However, if
 its use is continued to be generally regarded as subversive it may
 be confined to the underground.  The ramifications of the
 widespread introduction of anonymity to Usenet are still largely
 unknown. It is unclear whether it will provoke signficant amounts
 of new traffic or, instead of expansion, cause a shift where a
 greater portion of existing traffic is anonymized.  Conceivably the
 services could play a role in influencing future mainstream social
 acceptance of Usenet.


* * *

This is Part 1 of the Privacy & Anonymity FAQ, obtained via anonymous
 FTP to [email protected]:/pub/usenet/news.answers/net-privacy/ or
 newsgroups news.answers, sci.answers, alt.answers every 21 days.
Written by L. Detweiler <[email protected]>.
All rights reserved.

You are viewing proxied material from infinitelyremote.com. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.