Archive-name: net-privacy/part1 Last-modified: 1993/3/3 Version: 2.1   IDENTITY, PRIVACY, and ANONYMITY on the INTERNET ================================================  (c) 1993 L. Detweiler.  Not for commercial use except by permission from author, otherwise may be freely copied.  Not to be altered.  Please credit if quoted.  SUMMARY =======  Information on email and account privacy, anonymous mailing and  posting, encryption, and other privacy and rights issues associated with use of the Internet and global networks in general.  (Search for <#.#> for exact section. Search for '_' (underline) for next section.)  PART 1 ====== (this file)  Identity -------- <1.1> What is `identity' on the internet? <1.2> Why is identity (un)important on the internet? <1.3> How does my email address (not) identify me and my background? <1.4> How can I find out more about somebody from their email address? <1.5> Why is identification (un)stable on the internet?  <1.6> What is the future of identification on the internet?  Privacy ------- <2.1> What is `privacy' on the internet? <2.2> Why is privacy (un)important on the internet? <2.3> How (in)secure are internet networks? <2.4> How (in)secure is my account? <2.5> How (in)secure are my files and directories? <2.6> How (in)secure is X Windows? <2.7> How (in)secure is my email? <2.8> How am I (not) liable for my email and postings? <2.9> How do I provide more/less information to others on my identity? <2.10> Who is my sysadmin?  What does s/he know about me? <2.11> Why is privacy (un)stable on the internet? <2.12> What is the future of privacy on the internet?  Anonymity --------- <3.1> What is `anonymity' on the internet? <3.2> Why is `anonymity' (un)important on the internet? <3.3> How can anonymity be protected on the internet? <3.4> What is `anonymous mail'? <3.5> What is `anonymous posting'? <3.6> Why is anonymity (un)stable on the internet? <3.7> What is the future of anonymity on the internet?   PART 2 ====== (next file)  Resources ---------  <4.1> What UNIX programs are related to privacy? <4.2> How can I learn about or use cryptography? <4.3> What is the cypherpunks mailing list? <4.4> What are some privacy-related newsgroups?  FAQs? <4.5> What is internet Privacy Enhanced Mail (PEM)? <4.6> What are other Request For Comments (RFCs) related to privacy? <4.7> How can I run an anonymous remailer? <4.8> What are references on privacy in email? <4.9> What are some email, Usenet, and internet use policies? <4.10> What is the MIT ``CROSSLINK'' anonymous message TV program?  Miscellaneous -------------  <5.1> What is ``digital cash''? <5.2> What is a ``hacker'' or ``cracker''? <5.3> What is a ``cypherpunk''? <5.4> What is `steganography' and anonymous pools? <5.5> What is `security through obscurity'? <5.6> What are `identity daemons'? <5.7> What standards are needed to guard electronic privacy?  Issues ------  <6.1> What is the Electronic Frontier Foundation (EFF)? <6.2> Who are Computer Professionals for Social Responsibility (CPSR)? <6.3> What was `Operation Sun Devil' and the Steve Jackson Game case? <6.4> What is Integrated Services Digital Network (ISDN)? <6.5> What is the National Research and Education Network (NREN)? <6.6> What is the FBI's proposed Digital Telephony Act? <6.7> What other U.S. legislation is related to privacy on networks? <6.8> What are references on rights in cyberspace? <6.9> What is the Computers and Academic Freedom (CAF) archive?  Footnotes ---------  <7.1> What is the background behind the Internet? <7.2> How is Internet `anarchy' like the English language? <7.3> Most Wanted list <7.4> Change history   PART 3 ====== (last file)  Anonymizing -----------  <8.1> What are some known anonymous remailing and posting sites? <8.2> What are the responsibilities associated with anonymity? <8.3> How do I `kill' anonymous postings? <8.4> What is the history behind anonymous posting servers? <8.5> What is the value of anonymity? <8.6> Should anonymous posting to all groups be allowed? <8.7> What should system operators do with anonymous postings? <8.8> What is going on with anon.penet.fi maintained by J. Helsingius?   * * *   IDENTITY ========  _____ <1.1> What is `identity' on the internet?    Generally, today people's `identity' on the internet is primarily   determined by their email address in the sense that this is their   most unchanging 'face' in the electronic realm.   This is your   login name qualified by the complete address domain information,   for example ``ld231782@longs.lance.colostate.edu''.  People see   this address when receiving mail or reading USENET posts from you   and in other situations where programs record usage.  Some obsolete   forms of addresses (such as BITNET) still persist.    In email messages, additional information on the path that a message   takes is prepended to the message received by the recipient.  This   information identifies the chain of hosts involved in the   transmission and is a very accurate trace of its origination.  This   type of identify-and-forward protocol is also used in the USENET   protocol to a lesser extent.  Forging these fields requires   corrupted mailing software at sites involved in the forwarding and   is very uncommon.  Not so uncommon is forging the chain at the   origination point, so that all initial sites in the list are faked   at the time the message is created.  Tracing these messages can be   difficult or impossible when the initial faked fields are names of   real machines and represent real transfer routes.  _____ <1.2> Why is identity (un)important on the internet?    The concept of identity is closely intertwined with communication,   privacy, and security, which in turn are all critical aspects of   computer networks. For example, the convenience of communication   afforded by email would be impossible without conventions for   identification.  But there are many potential abuses of identity   possible that can have very severe consequences, with massive   computer networks at the forefront of the issue, which can   potentially either exacerbate or solve these problems.    Verifying that an identity is correct is called `authentication',   and one classic example of the problems associated with it is   H.G.Well's ``War of the Worlds'' radio broadcast that fooled   segments of the population into thinking that an alien invasion was   in progress.  Hoaxes of this order are not uncommon on Usenet and   forged identities makes them more insidious.  People and their   reputations can be assaulted by forgery.    However, the fluidity of identity on the internet is for some one of   its most attractive features. Identity is just as useful as it is   harmful.  A professor might carefully explain a topic until he   finds he is talking to an undergraduate. A person of a particular   occupation may be able to converse with others who might normally   shun him.  Some prejudices are erased, but, on the other hand, many   prejudices are useful!  A scientist might argue he can better   evaluate the findings of a paper as a reviewer if he knows more   about the authors.  Likewise, he may be more likely to reject it   based on unfair or irrelevant criteria.  On the other side of the   connection,  the author may find identities of reviewers useful in   exerting pressure for acceptance.    Identity is especially crucial in establishing and regulating   `credit' (not necessarily financial) and `ownership' and `usage'.    Many functions in society demand reliable and accurate techniques   for identification. Heavy reliance will be placed on digital   authentication as global economies become increasingly electronic.    Many government functions and services are based on identification,   and law enforcement frequently hinges on it.  Hence, employees of   many government organizations push toward stronger identification   structures.  But when does identification invade privacy?    The growth of the internet is provoking social forces of massive   proportions. Decisions made now on issues of identity will affect   many future users, especially as the network becomes increasingly   global, universal, widespread, and entrenched; and the positive or   adverse affects of these actions, intended and inadvertent,  will   literally be magnified exponentially.  _____ <1.3> How does my email address (not) identify me and my background?    Your email address may contain information that influences people's   perceptions of your background.  The address may `identify' you as   from a department at a particular university, an employee at a   company, or a government worker.  It may contain your last name,   initials, or cryptic identification codes independent of both.  In   the US some are based on parts of social security numbers.  Others   are in the form 'u2338' where the number is incremented in the   order that new users are added to the system.    Standard internet addresses  also can contain information  on your   broad geographical location or nationhood.  However, none of this   information is guaranteed to be correct or be there at all.  The   fields in the domain qualification of the username are based on   rather arbitrary organization, such as (mostly invisible) network   cabling distributions.  The only point to make is that early fields   in the address are more specific (such as specific computer names   or local networks) and the later ones the most general (such as   continental domains).  Typically the first field is the name of the   computer receiving mail.    Gleaning information from the email address alone is sometimes an   inspired art or an inconsistent and futile exercise.  (For more   information, see the FAQs on email  addresses and known   geographical distributions below.)  However, UNIX utilities exist   to aid in the quest (see the question on this).    Common Suffixes   ---------------    .us    United States   .uk    United Kingdom   .ca    Canada   .fi    Finland   .au    Australia    .edu   university or college   .com   commercial organization   .org   'other' (e.g. nonprofit organization)   .gov   government   .mil   military site   _____ <1.4> How can I find out more about somebody with a given email address?    One simple way is to send email to that address, asking.  Another   way is to send mail to the postmaster at that address (i.e.   postmaster@address), although the postmaster's job is more to help   find user ID's of particular people given their real name and solve   mail routing problems.  The sysadmin (i.e. `root@address') may also   be able to supply information.  Users with related email address   may have information.  However, all of these methods rely on the   time and patience of others so use them minimally.    One of the most basic tools for determining identity over the   internet is the UNIX utility 'finger'.  The basic syntax is:      finger user@here.there.everywhere    This utility uses communication protocols to query the computer   named in the address for information on the user named.  The   response is generated completely by the receiving computer and may   be in any format.  Possible responses are as follows:    - A message `unknown host' meaning some aspect of the address is     incorrect, two lines with no information and '???'.      - A message 'In real life: ???' in which case the receiving computer     could not find any kind of a match on the username. The finger     utility may return this response in other situations.      - A listing of information associated with multiple users. Some     computers will search only for matching user IDs, others will     attempt to find the username you specified as a substring of all     actual full names of users kept in a local database.      At some sites 'finger' can be used to get a list of all users on the   system with a `finger @address'.  In general this is often   considered weak security, however, because `attackers' know valid   user ID's to `crack' passwords.    More information on the fields returned by `finger' is given below.    More information on `finger' and locating people's email addresses   is given in the email FAQ (such as the WHOIS lookup utility).  Just   as you can use these means to find out about others, they can use   them to find out about you.  You can `finger' yourself to find out   what is publicly reported by your UNIX system about you.  Be   careful when modifying `finger' data; virtually anyone with   internet access worldwide can query this information.  In one   amazing case, the New York Times writer J. Markoff uncovered the   identity of R. Morris, author of the Internet Worm,  through   the use of an anonymous tip and 'finger'.  See the book Cyberspace   by K. Hafner and J. Markoff.  _____ <1.5> Why is identification (un)stable on the internet?    Generally, identity is an amorphous and almost nonexistent concept   on the Internet for a variety of reasons.  One is the inherent   fluidity of `cyberspace' where people emerge and submerge   frequently, and absences are not readily noted in the `community'.    Most people remember faces and voices, the primary means of casual   identification in the 'real world'.  The arbitary and cryptic    sequences of letters and digits comprising most email addresses are   not particularly noticeable or memorable and far from a unique   identification of an individual, who may use multiple accounts on   multiple machines anywhere in the world.    Currently internet users do not really have any great assurances   that the messages in email and USENET are from who they appear to   be. A person's mailing address is far from an identification of an   individual.        - Anyone with access to the account, e.g. they know the password,     either legitimately or otherwise, can send mail with that address     in the From: line.      - Email addresses for an individual tend to change frequently as     they switch jobs or make moves inside their organizations.     - As part of current mailing protocol standards, forging the From:     line in mail messages is a fairly trivial operation for many     hackers.        The status and path information prepended to messages by   intermediate hosts is generally unforgeable. In general, while   possible, forgeries are fairly rare on most newsgroups and in   email.  Besides these pathological cases abve there are many basic   problems with today's internet protocols affecting identification   on the internet:    - Internet mail standards, described in RFC-822, are still evolving     rapidly and not entirely orderly.  For example, standards for     mail address `munging' or `parsing' tend to vary slightly between     sites and frequently mean the difference between finding     addresses and bouncing mail.      - Domain names and computer names are frequently changed at sites,     and there are delays in the propagation of this data.      - Addresses cannot be resolved when certain critical computers     crash, such as the receiving computer or other computers involved     in resolving names into addresses called `nameservers'.       - A whole slew of problems is associated with  `nameservers'; if     they are not updated they will not find name addresses, and even     the operation of what constitutes `updating' has different     interpretations at different sites.      The current internet mailing and addressing protocols are slightly   anachronistic in that they were created when the network was   somewhat obscure and not widespread, with only a fraction of the   traffic it now sees.  Today a large proportion of internet traffic   is email, comprising  millions of messages.  _____ <1.6> What is the future of identification on the internet?    Some new technologies and standards are introducing facial images   and voice messages  into mail and these will improve the sense of   community that comes from the familiarity of identification.   However, they are not currently widespread, require large amounts   of data transfer, standardized software, and make some compromises   in privacy.    Promising new cryptographic techniques may make 'digital signatures'   and 'digital authentication' common (see below).  Also, the trend   in USENET standards is toward greater authentication of posted   information.  On the other hand, advances in ensuring anonymity   (such as remailers) are forthcoming.  See below.   PRIVACY =======  _____ <2.1> What is `privacy' on the internet?    Generally, while `privacy' has multiple connotations in society and   perhaps even more on the internet, in cyberspace most take it to   mean that you have exclusive use and access to your account and the   data stored on and and directed to it (such as email), and you do   not encounter arbitrary restrictions or searches.  In other words,    others may obtain data associated with your account, but not   without your permission.  These ideas are probably both fairly   limiting and liberal in their scope in what most internet users   consider their private domains.  Some users don't expect or want   any privacy, some expect and demand it.  _____ <2.2> Why is privacy (un)important on the internet?    This is a somewhat debatable and inflammatory topic, arousing   passionate opinions.  On the internet, some take privacy for   granted and are rudely surprised to find it tenuous or nonexistent.   Most governments have rules that protect privacy (such as the   illegal search and seizure clause of the U.S. constitution, adopted   by others) but have many that are antithetical to it (such as laws   prohibiting secret communications or allowing wiretapping). These   rules generally carry over to the internet with few specific rules   governing it.  However, the legal repercussions of the global   internet are still largely unknown and untested (i.e. no strong   legal precedents and court cases).  The fact that internet traffic   frequently passes past international boundaries, and is not   centrally managed, significantly complicates and strongly   discourages its regulation.  _____ <2.3> How (in)secure are internet networks?    - `Theoretically' people at any site in the chain of sites with     access to hardware and network media that transmits data over the     Internet  could potentially monitor or archive it. However, the     sheer volume and general 'noise' inherent to this data makes     these scenarios highly improbable, even by government agencies     with supposedly vast funding and resources.      - Technologies exist to `tap' magnetic fields given off by     electrical wires without detection.  Less obscurely, any machine     with a network connection is a potential station for traffic     detection, but this scenario requires knowledge and access to     very low-level hardware (the network card) to pursue, if even     possible.      - A company Network General Inc. is one of many that manufactures     and markets sophisticated network monitoring tools that can     'filter' and read packets by arbitrary criteria for     troubleshooting purposes, but the cost of this type of device is     prohibitive for casual use.    Known instances of the above types of security  breaches at a major   scale (such as at network hubs) are very rare. The greatest risks   tend to emerge locally.  Note that all these approaches are almost   completely defused with the use of cryptography.      _____ <2.4> How (in)secure is my account?    By default, not very.  There are a multitude of factors that may   reinforce or compromise aspects of your privacy on the internet.    First, your account must be secure from other users. The universal   system is to use a password, but if it is `weak' (i.e. easy to   guess) this security is significantly diminished.  Somewhat   surprisingly and frighteningly to some, certain  users of the   system, particularly the administrator, generally have unlimited   access regardless of passwords, and may grant that access to   others.  This means that they may read any file in your account   without detection.    Furthermore, not universally known, most UNIX systems keep fairly   extensive accounting records of when and where you logged in, what   commands you execute, and when they are executed (in fact, login   information is usually public). Most features of this `auditing' or    `process accounting' information are enabled by default after the   initial installation and the system administrator may customize it   to strengthen or weaken it to satisfy performance or privacy aims.    This information is frequently consulted for troubleshooting   purposes and may otherwise be ignored.  This data tracks   unsuccessful login attempts and other 'suspicious' activities on   the system. A traditional part of the UNIX system that tracks user   commands is easily circumvented by the user with the use of   symbolic links (described  in 'man ln').      UNIX implementations vary widely particularly in tracking features   and new sophisticated mechanisms are introduced by companies   regularly. Typically system adminstrators augment the basic UNIX   functionality with public-domain programs and locally-developed   tools for monitoring, and use them only to isolate `suspicious'   activity as it arises (e.g. remote accesses to the 'passwd' file, incorrect   login attempts, remote connection attempts, etc.).      Generally, you should expect little privacy on your account for   various reasons:      - Potentially, every keystroke you type could be intercepted by     someone else.     - System administrators make extensive backups that are completely     invisible to users which may record the states of an account over     many weeks.     - Erased files can, under many operating systems, be undeleted.     - Most automated services keep logs of use for troubleshooting or     otherwise; for example FTP sites usually log the commands and     record the domain originations of users, including anonymous     ones.    - Some software exacerbates these problems.  See the section on     ``X Windows (in)security''.    Indepedent of malevolent administrators are fellow users, a much   more commonly harmful threat. There are multiple ways to help   ensure that your account will not be accessed by others, and   compromises can often be traced to failures in these guidelines:    - Choose a secure password.  Change it periodically.   - Make sure to logout always.   - Do not leave a machine unattended for long.   - Make sure no one watches you when you type your password.   - Avoid password references in email.   - Be conservative in the use of the .rhost file.   - Use utilities like `xlock' to protect a station, but be     considerate.    Be wary of situations where you think you should supply your   password.  There are only several basic situations where UNIX   prompts you for a password: when you are logging in to a system or   changing your password.  Situations can arise in which prompts for   passwords are forged by other users, especially in cases where you   are talking to them (such as Internet Relay Chat).  Also, be  aware   that forged login screens are one method to illegitimately obtain    passwords.     (Thanks to Jim Mattson <mattson@cs.ucsd.edu> for contributions   here.)  _____ <2.5> How (in)secure are my files and directories?    The most important privacy considerations are related to file   rights, and many lapses can be traced to their misunderstood nature   or haphazard maintenance. Be aware of the rights associated with   your files and directories in UNIX. If the `x' (`execute') right on   your parent directory is off for users, groups, and other, these   users cannot gain information on anything in your directories.    Anything less may allow others to read, change, or even delete   files in your home directory. The rights on a directory supersede   the rights associated with files in that directory. For a   directory, 'x' means that access to the files (or subdirectories)   in the directory is possible -- if you know their names.  To list   the contents of the directory, however, requires the 'r' right.     By default most accounts are accessable only to the owner, but the   initial configuration varies between sites based on administrator   preference.  The default file mode specifies the initial rights   associated with newly created files, and can be set in the shell   with `umask'.  The details of rights implementations tend to vary   between versions of UNIX.  Consult man pages on `chmod' and `ls'.    Examples   --------      traver.lance % ls -ld ~     drwx------ 15 ld231782     1536 Jan 31 21:22 /users/ld231782/    Here is a listing of the rights associated with a user's home   directory, denoted by `~'.  The columns at the left identify what   rights are available. The first column identifies the entry as a   directory, and the next three columns mean that read, write, and   execute rights, respectively, are permitted for that user.  For   directories, the `x' right means that contents (file and   subdirectory names) within that directory can be listed. The   subsequent columns indicate that no other users have any rights to   anything in the directory tree originating at that point.  They   can't even `see' any lower files or subdirectories; the hierarchy   is completely invisible to them.      traver.lance % ls -l msg     -rw-r--r--  1 ld231782   35661 Jan 29 23:13 msg     traver.lance % chmod u=rw,g=,o= msg     traver.lance % ls -l msg     -rw-------  1 ld231782   35661 Jan 29 23:13 msg    Here the modes on the file `msg' were changed to take away rights   from `group' and `other'.       Note that `ls -l <file>' requires both the 'r' right to get the list   of files and subdirectories, and the 'x' right to access the files   and subdirectories in order to get their size, etc. For example,   suppose the directory `foo' has rights dr--r--r--,  the following   is possible:      ls foo    These commands would fail independent of file rights:        ls -l foo     ls -l foo/file     cat foo/file     cd foo    If the directory `foo' has rights d--x--x--x, the following are   possible if it is known beforehand that `foo' contains an 'r'   readable file named `file':        ls -l foo/file     cat foo/file     cd foo      The following commands fail:        ls foo     ls -l foo       (Thanks to Uwe Waldmann <uwe@mpi-sb.mpg.de> for contributions here.)  _____ <2.6> How (in)secure is X Windows?    X Windows is the primary software developed by the MIT Athena   project which is funded by U.S. government grants to develop   applications to harness the power of networks in enhancing   computational tasks, particularly the human-computer interface.    The software implements a client-server interface to a computer via   graphical windows. In this case the `client' is the application   requesting or utilizing  graphical resources (such as windows or a   mouse) and the `server' is the machine that provides them.  In many   situations the client is an application program running on the same   machine as the server.    The great utility of X Windows comes from its complete dissociation   of the client and server so that windows may be `broadcast' to a   server at a remote location from the  client. Unfortunately this   dynamic power also introduces many deep, intricate, and complicated   security considerations.  The primary security and privacy issue   associated with X Windows is that much more sensitive data may be   sent over a network, and over wider regions, than in the case where   the human is situated near the host computer.  Currently there is   no encryption of data such as screen updates and keystrokes in X   Windows.    Due to either intentional design decisions or unintentional design   flaws,  early versions of the X Window system are extremely   insecure. Anyone with an account on the server machine can disrupt   that display or read it electronically based on access to the   device unix:0.0 by any regular user.   There are no protections   from this type of access in these versions.   The problem arises   because the security is completely based on machine addresses   rather than users, such that any user at a `trusted' machine is   himself trusted. Quoting from X documentation (man Xsecurity):      > Any client on a host in the host access control list is allowed   > access to the X server. This system can work reasonably well in   > an environment where everyone trusts everyone, or when only a   > single person can log into a given machine...This system does not   > work well when multiple people can log in to a single machine and   > mutual trust does not exist.       With the access control list, the `xhost' command may prevent some   naive attempts (i.e. those other than the direct-access unix:0.0   evasion); the syntax as typed on the host machine is  ``xhost   +[name]'' where [name] is the domain name or internet address of an   authorized client machine. By default clients running nonlocal to   the host are disabled.  Public domain programs to disrupt a display   momentarily (such as 'flip' or slowly mirror the screen image, or   cause pixels to 'melt' down to the bottom) have been circulating on   the internet among hackers for several years and played as pranks   on unsuspecting or inexperienced users.  Much more serious security   breaches are conceivable from similar mechanisms exploiting this   inherent weaknesses.  (The minimal, easily-bypassed `trusted'   security mode of `xhost' has been jokingly referred to as ``X   Hanging Open, Security Terrible.'').     New versions of the X Window system (X11R5 and higher) by default    make server access as secure as the file system using a .Xauthority   file and 'magic cookies'.  Remote machines must have a code in the   .Xauthority file in the home directory that matches the code   allowed by the server.  Many older programs and even new   vendor-supplied code does not support or is incompatible with   `magic cookies'. The basic magic cookie mechanism is vulnerable to   monitoring techniques described earlier because no encryption of   keys occurs in transmission.  X11R5 also includes other   sophisticated encryption mechanisms.  Try `man Xsecurity' to find   out what is supported at your site.  Even though improved security    mechanisms have been available in X Windows since ~1990, local   sites often update this software infrequently because installation   is extremely complex.     (Thanks to Marc Vanheyningen <mvanheyn@whale.cs.indiana.edu>,    Jim Mattson <mattson@cs.ucsd.edu>, and Bill Marshall   <marshall@cs.iastate.edu> for contributions here.)  _____ <2.7> How (in)secure is my email?    By default, not very.  The characters that you are reading are   almost certainly encoded in ASCII, the American Standard Code for   Information Interchange that maps alphabetic and symbolic   characters onto numeric codes and vice versa.  Virtually every   computer system uses this code, and if not, has ways of converting   to and from it.  When you write a mail message, by default it is   being sent in ASCII,  and since the standard is virtually   universal, there is no intrinsic privacy.  Despite milleniums worth   of accumulated cryptographic knowledge, cryptographic technologies   are only recently being established that afford high priority to   privacy as a primary criteria in computer and network design.  Some   potential pitfalls in privacy are as follows:    - The most serious threats are instances of immature or unscrupulous     system operators reading private mail in the `spool files' at a     local site (i.e. at the source or destination of the message),     such as a university.       - System administrators may also release files to law enforcement     agencies, but conventions and protocols for warrants involving     computer searches have still not been strongly established and     tested legally.    - Note that bounced messages go to postmasters at a given site in     their entirety.  This means that if you address mail with an     incorrect address it has a good chance of being seen by a human     other than the recipient.    - Typically new user accounts are always set up such that the local     mail directory is private, but this is not guaranteed and can be     overridden.    - Finally, be aware that some mailing lists (email addresses of      everyone on a list) are actually publicly accessable via mail      routing software mechanisms.  This `feature' can be disabled.    Most potential compromises in email privacy can be thoroughly   avoided with the use of strong end-to-end cryptography, which has   its own set of caveats (for example, unscrupulous administrators   may still be a threat if the encryption site is shared or   nonlocal).  See the sections on ``email privacy'' and ``email   policies.''  _____ <2.8> How am I (not) liable for my email and postings?    As punishment or whatever, your system administrator can revoke   certain `privileges' such as emailing, USENET posting or reading   certain groups, file transferring, remote communications, or   generally any subset of capabilities available from your account.    This all is completely at the discretion of the local administrator   and under the procedures followed at a particular site, which in   many cases are haphazard and crisis-oriented.  Currently there are   virtually no widespread, uniform guidelines or procedures  for   restricting use to any internet services, and local administrators   are free to make arbitrary decisions on access.    Today punitive measures are regularly applied in various situations.   In the typical scenario complaint(s) reach a system adminstrator   regarding abuses by a user, usually but not necessarily preceded by   complaints to the user in email, regarding that person's   objectionable email or postings.  `abusive' posters to USENET are   usually first given admonitions from their system administrators as   urged by others on the `net'. (The debate persists endlessly on   many newsgroups whether this is also used  as a questionable means   of attacking or silencing `harmless crackpots' or censoring   unpopular opinions.)      System administrators at remote sites regularly cooperate to   'squelch' severe cases of abuse.  In general, however, by tradition   Usenet readers are remarkably tolerant of diverse views and uses of   the system, but a colorful vocabularly of slang helps describe   their alternatives when this patience is sapped: the options   wielded by the individual user are to simply advance to the next   message (referred to as ``hitting the `n' key''), or to `plonk'   annoying posters (according to the Hacker's Dictionary, the sound a   jerk makes at the end of a fall to the bottom of a kill file).    In cases where punitive actions are applied, generally system   administrators are least likely to restrict email.  USENET postings   are much more commonly restricted, either to individual users or    entire groups (such as a university campus).  Restrictions are most   commonly associated with the following `abuses':    - harassing or threatening notes, `email terrorism'   - illegal uses, e.g. piracy or propagation of copyrighted material   - `ad hominem' attacks, i.e. insulting the reputation of the     poster instead of citing the content of the message   - intentional or extreme vulgarity and offensiveness   - inappropriate postings, esp. binary files in regular groups     `mail-bombing': inundating mail boxes with numerous or massive     files    Major problems originate from lack of distinctions in private and   official email or postings.  Most users have internet access via   accounts at businesses or universities and their activities on the   internet can be construed as representative of their parent   organizations. Many people put disclaimers in their `signatures' in   an attempt dissociate their identity and activities from parent   organizations as a precaution. A recent visible political case   involves the privacy of electronic mail  written by White House   staff members of the Bush administration.  Following are some   guidelines:    - Acquaint yourself with your company or university policy.   - If possible, avoid use of your company email address for private     communication.   - Use a disclaimer.   - Keep a low profile (avoid `flamewars' or simply don't post).   - Avoid posting information that could be  construed to be     proprietary or `internal'.    The following references are available from ftp.eff.com   (see also the section on ``internet use policies''):    /pub/academic/banned.1991   /pub/academic/banned.1992   ---     Computer material that was banned/challenged in academia in 1991     and 1992 including USENET hierarchies.    /pub/academic/cases   ---     This is an on-line collection of information about specific     computers and academic freedom cases. File README is a detailed     description of the items in the directory.    /pub/academic/faq/netnews.liability   ---     Notes on university liability for Usenet.  _____ <2.9> How do I provide more/less information to others on my identity?    The public information of your identity and account is mostly   available though the UNIX utility `finger' described above.       - You have control over most of this information with the utility     `chfn', the specifics vary between sites (on some systems use     `passwd -f').       - You can provide unlimited information in the .plan file which is     copied directly to the destination during the fingering.         - A technique that works at some sites allows you to find out who is     'finger'ing you and even to  vary the .plan file sent to them.        - Your signature is determined by the environment variable SIGNATURE        - USENET signatures are conventionally stored in the .signature file     in your home directory.        Providing less information on your online identity is more difficult   and involved.  One approach is to ask your system adminstrator to   change or delete information about you (such as your full name).    You may be able to obtain access on a public account or one from   someone unrelated to you personally.  You may be able to remotely   login (via modem or otherwise) to computers that you are not   physically near.  These are tactics for hiding or masking your   online activities but nothing is foolproof.  Consult man pages on   the 'chmod' command and the default file mode.  Generally, files on   a shared system have good safeguards within the user pool but very   little protection is possible from corrupt system administrators.    To mask your identity in email or on USENET you can use different   accounts. More untraceable are new `anonymous posting' and   remailing services that are very recently being established.  See   below.  ______ <2.10> Who is my sysadmin?  What does s/he know about me?    The requirements and screening for getting a system administration   job (and thereby access to all information on a system) vary widely   between sites and are sometimes frighteningly lax, especially at   universities.  Many UNIX systems at universities are largely   managed by undergraduates with a background in computing and often   `hacking'.  In general, commercial and industrial sites are more   strict on qualifications and background, and government sites are   extremely strict.    The system adminstrator (root user) can monitor what commands you   used and at what times.  S/he may have a record (backups) of files   on your account over a few weeks. S/he can monitor when  you send   email or post USENET messages, and potentially read either.  S/he   may have access to records indicating what hosts you are using,   both locally and elsewhere.  Administrators sometimes employ   specialized programs to  track `strange' or `unusual' activity,   which can potentially be misused.  ______ <2.11> Why is privacy (un)stable on the internet?    For the numerous reasons listed above, privacy should not be an   expectation with current use of the internet.  Furthermore, large   parts of the internet are funded by the U.S. NSF (National Science   Foundation) which places certain restrictions on its use (such as   prohibiting commercial use).  Some high-level officials in this and   other government agencies may be opposed to emerging techniques to   guarantee privacy (such as encryption and anonymous services).    Historically the major threats to privacy on the internet have been   local. Perhaps the most common example of this are the widespread   occurrences of university administrators refusing to carry some   portion of USENET newsgroups labelled as `pornographic'. The   `alternative' hierarchy in the USENET system, which has virtually   no restrictions on propagation and new group creation, is   frequently targeted (although this material may appear anywhere).    From the global point of view traffic is generally completely   unimpeded on the internet  and only the most egregious offenders   are pursued.  For example,  verbatim transcriptions of copyrighted   material (such as newspaper or magazine articles) are posted to   USENET with regularity without major consequences (some email   complaints may ensue).  More astonishing to some is that currently   significant portions of USENET traffic, and less so internet   traffic, is comprised of sexually-explicit digitized images almost   entirely originating from copyrighted material (newsgroups such as   `alt.sex' regularly have the  highest traffic).    ______ <2.12> What is the future of privacy on the internet?    Some argue that the internet currently has an adequate or   appropriate level of privacy.  Others will argue that as a   prototype for future global networks it has woefully inadequate   safeguards.  The internet is growing to become a completely global,   international superhighway for data, and this traffic will   inevitably entail data such as voice messages, postal mail, and   many other items of extremely personal nature. Computer items that   many people consider completely private (such as their local hard   drives) will literally be inches from global network connections.   Also, sensitive industrial and business information is exchanged   over networks currently and this volume may conceivably merge with   the internet.      Most would agree that, for these basic but sensitive uses of the   internet, no significant mechanisms are currently in place to   ensure much privacy. New standards are calling for uniform   introduction of `privacy enhanced mail' (PEM) which uses encryption   technologies to ensure privacy, so that privacy protection is   automatic, and may significantly improve safeguards.    The same technology that can be extremely destructive to privacy   (such as with  surreptitious surveilance) can be overwhelmingly   effective in protecting  it (e.g. with encryption). Some government   agencies are opposed to unlimited privacy in general, and believe   that it should lawfully be forfeited in cases of criminal conduct   (e.g. court-authorized wiretapping).  However, powerful new   technologies to protect privacy on computers are becoming   increasingly popular, provoking some to say that ``the cat is out   of the bag'' and the ``genie can't be put back in the bottle''.  In   less idiomatic terms, they believe that the spread of strong   cryptography is already underway will be socially and technically   unstoppable.      To date, no feasible system that guarantees both secure   communication and government oversight has been proposed (the two   goals are largely incompatible). Proposals for ``registration'' of   secret keys (by D. Denning on sci.crypt, for example) have been met   with hot controversy at best and ridicule and derision at worst,   mainly because of concerns for the right to privacy and objections   of inherent feasibility.  Electronic privacy issues, and   particularly the proper roles of networks and the internet, will   foreseeably become highly visible and explosive over the next few   years.   ANONYMITY =========  _____ <3.1> What is `anonymity' on the internet?    Simply stated, anonymity is the absence of identity, the   ultimate in privacy. However, there are several variations on   this simple theme.  A person may wish to be consistently   identified by a certain pseudonym or `handle' and establish a   reputation under it in some area, providing pseudo-anonymity.   A person may wish to be completely untraceable for a single   one-way message (a sort of `hit-and-run'). Or, a person may   wish to be openly anonymous but carry on a conversation with   others (with either known or anonymous identities) via an   `anonymous return address'.  A user may wish to appear as a   `regular user' but actually be untraceable.  Sometimes a user   wishes to hide who he is sending mail to (in addition to the   message itself). The anonymous item itself may be directed at   individuals or groups.  A user may wish to access some   service and hide all  signs of the association.       All of these uses are feasible on the internet but are currently   tricky to carry out in practice, because of all the tracking   mechanisms inherent to operating systems and network protocols.    Officials of the NSF and other government agencies may be opposed   to any of these uses because of the potential for abuse.    Nevertheless, the inherent facelessness of large networks will   always guarantee a certain element of anonymity.  _____ <3.2> Why is `anonymity' (un)important on the internet?    Anonymity is another powerful tool that can be beneficial or   problematic depending on its use.  Arguably absence of   identification is important as the presence of it.  It may be the   case that many strong benefits from electronic anonymity will be   discovered that were unforeseen and unpredicted, because true   anonymity has been historically very difficult to establish.    One can use anonymity to make personal statements to a colleague   that would sabotage a relationship if stated openly (such as   employer/employee scenarios).  One can use it to pass information   and evade any threat of direct retribution.  For example,   `whistleblowers' reporting on government abuses (economic, social,   or  political) can bring issues to light without fear of stigma or   retaliation. Sensitive, personal, potentially damaging information   is often posted to some USENET groups, a risky situation where   anonymity allows conversations to be carried on completely   independent of the identities of the participants.  Some police   departments run phone services that allow anonymous reporting of   crimes; such uses would be straightforward on the network.   Unfortunately, extortion and harassment become more insidious with   assurances of anonymity.  _____ <3.3> How can anonymity be protected on the internet?    The chief means, as alluded to above, are masking identities in   email and posting. However, anonymous accounts (public accounts as   accessable and anonymous as e.g. public telephones) may be   effective as well, but this use is generally not officially   supported and even discouraged by some system adminstrators and NSF   guidelines.  The nonuniformity in the requirements of obtaining   accounts at different sites and institutions makes anonymous   accounts generally difficult to obtain to the public at large.    Many communications protocols are inherently detrimental to   anonymity.  Virtually every protocol in existence currently   contains information on both sender and receiver in every packet.   New communications protocols will likely develop that guarantee   much higher degrees of secure anonymous communication.  _____ <3.4> What is `anonymous mail'?    One approach to `anonymizing' mail has been to set up an `anonymous   server' that, when activated by email to its address, responds by   allocating and supplying an `anonymous ID' that is unique to the   person requesting it (based on his email address).  This will vary   for the same person for different machine address email   originations. To send anonymous mail, the user sends email directed   to the server containing the final destination. The server   `anonymizes' the message by stripping of identification information   and forwards the message, which appears to originate from the   anonymous server only from the corresponding anonymous user id.    This is the `interactive' use of anonymity or pseudonymity   mentioned above.    Another more `fringe' approach is to run a `cypherpunk' remailer   from a regular user account (no root system privileges are   required). These are currently being pioneered by  Eric Hughes and   Hal Finney <hal@alumni.caltech.edu>. The operator runs a process on   a machine that anonymizes mail sent to him with certain   characteristics that distinguish it from his regular incoming mail   (typically fields in the header). One has been implemented as a    PERL script running on UNIX.  Several of these are in existence   currently but sites and software currently are highly unstable;   they may be in operation outside of system administrator knowledge.   The remailers don't generally support anonymous return addresses.    Mail that is incorrectly addressed is received by the operator.    Generally the user of the remailer has to disavow any   responsibility for the messages forwarded through his system,   although actually may be held liable regardless.    These approaches have several serious disadvantages and weaknesses:      - The anonymous server approach requires maintaining a mapping of     anonymous ID's to real addresses that must be maintained     indefinitely.  One alternative is to allow `deallocation' of     aliases at the request of the user, but this has not been     implemented yet.    - Although an unlikely scenario, traffic to any of these sites could     conceivably be monitored from the `outside', necessitating the     use of cryptography for basic protection,.    - Local administrators can shut them down either out of caprice or     under pressure from local, network, or government agencies.      - Unscrupulous providers of the services can monitor the traffic     that goes through them.    - Most remailers currently keep logs that may be inspected.     - The cypherpunk approach tends to be highly unstable because these     operators are basically  network users who do not own the     equipment and are accountable  to their own system     administrators, who may be unaware of the use and unsympathetic     to the philosophy of anonymity when the operation is discovered,     regarding it as illicit use.     - In all cases, a high degree of trust is placed in the anonymous     server operator by the user.    Currently the most direct route to anonymity involves using SMTP   protocols to submit a message directly to a server with arbitrary   field information.  This practice, not uncommon to hackers, and the   approach used by remailers, is generally viewed with hostility by   most system administrators.  Information in the header routing data   and logs of network port connection information may be retained   that can be used to track the originating site.  In practice, this   is generally infeasible and rarely carried out.  Some   administrators on the network will contact local administrators to   request a message be tracked and its writer admonished or punished   more severely (such as revoking the account), all of this actually   happening occasionally but infrequently.    See the sections ``known anonymous mail and posting sites'' and    ``responsibilities associated with anonymity''.  _____ <3.5> What is `anonymous posting'?    Anonymous servers have been established as well for anonymous Usenet   posting with all the associated caveats above (monitored traffic,   capricious or risky local circumstances, logging).  Make sure to   test the system at least once by e.g. anonymous posting to   misc.test (however some operators don't recommend this because many   sites `autorespond' to test messages, possibly causing the   anonymous server to allocate anonymous IDs for those machines).    See the ``responsibilties associated with anonymous posting''   before proceeding.    Another direct route involves using NNTP protocols to submit a   message directly to a newserver with arbitrary field information.   This practice, not uncommon to hackers, is also generally viewed   with hostility by most system administrators, and similar   consequences can ensue.    See the sections ``known anonymous mail and posting sites'' and    ``responsibilities associated with anonymity''.  _____ <3.6> Why is anonymity (un)stable on the internet?    As noted, many factors compromise the anonymity currently available   to the general internet community, and these services should be   used with great caution.  To summarize, the technology is in its   infancy and current approaches are unrefined, unreliable, and not   completely trustworthy.  No standards have been established and   troubling situations of loss of anonymity and bugs in the software   are prevalent.  Here are some encountered and potential bugs:       - One  anonymous remailer reallocated already allocated anonymous     return addresses.    - Others passed signature information embedded in messages     unaltered.    - Address resolution problems resulting in anonymized mail bounced     to a remailer are common.   - Forgeries to the anonymous server itself are a problem,  possibly     allowing unauthorized users to potentially glean anon ID - email     address  mappings in the alias file.  This can be remedied with     the use of passwords.   - Infinite mail loops are possible with chaining remailers.      Source code is being distributed, tested, and refined for these   systems, but standards are progressing slowly and weakly.  The   field is not likely to improve considerably without  official   endorsement and action by network agencies.  The whole idea is   essentially still in its infancy and viewed with suspicion and   distrust by many on the internet, seen as illegitimate or favorable   to criminality.  The major objection to anonymity over regular   internet use  is the perceived lack of accountability to system   operators, i.e. invulnerability to account restrictions resulting   from outside complaints.  System adminstrators at some sites have   threatened to filter anonymous news postings generated by the   prominent servers from their redistribution flows.  This may only   have the effect of encouraging server operators to create less   characteristically detectable headers.  Probably the least   problematic approach, and the most traditional to Usenet, is for   individual users to deal with anonymous mail however they prefer,   e.g. ignoring it or filtering it with kill files.    _____ <3.7> What is the future of anonymity on the internet?    New anonymous protocols effectively serve to significantly increase   safeguards of anonymity.  For example, the same mechanism that   routes email over multiple hosts, thereby threatening its privacy,   can also be used to guarantee it. In a scheme called `chaining' an   anonymous message is passed through multiple anonymous servers   before reaching a destination.  In this way generally multiple   links of the chain have to be `broken' for security to be   compromised. Re-encryption at each link makes this scenario even   more unlikely.  Even more significantly the anonymous remailers   could be spread over the internet globally so that local weaknesses   (such as corrupt governments or legal wiretapping within a nation)   would be more unlikely to sacrifice overall security by message   tracing. However, remailers run by corrupt operators are possible.      The future of anonymous services on the internet is, at this time,   highly uncertain and fraught with peril. While specific groups seem   to benefit significantly from anonymous posting capabilities, many   feel that unlimited newsgroup scope for anonymous posting is a   disruptive and dangerous idea and detracts from discussions in   `serious' groups.   The introduction of unlimited group anonymity   may have fundamental repercussions on Usenet conventions and   distribution mechanisms such as moderated and `alt' groups have had   in the past. For example, as part of new group creation, the   charter may specify whether `anonymous' posting is (un)welcome.     Nevertheless, the widespread introduction and use of anonymity may   be inevitable. Based on traffic statistics, anonymous services are   in huge demand. Pervasive and readily available anonymity could   carry significant and unforeseen social consequences.  However, if   its use is continued to be generally regarded as subversive it may   be confined to the underground.  The ramifications of widespread   introduction of anonymity to Usenet are still largely unknown. It   is unclear whether it will provoke signficant amounts of new   traffic or, instead of expansion, cause a shift where a greater   portion of existing traffic is anonymized.  Conceivably the   services could play a role in influencing future mainstream social   acceptance of Usenet.   * * *