Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #2403 > unrolled thread

alt.anonymous.messages

Back to article view | Back to comp.misc

Contents

  alt.anonymous.messages RS Wood <rsw@therandymon.com> - 2014-04-16 11:15 +0000
    Re: alt.anonymous.messages Huge <Huge@nowhere.much.invalid> - 2014-04-16 11:28 +0000
    Re: alt.anonymous.messages Mike Easter <MikeE@ster.invalid> - 2014-04-16 05:03 -0700
      Re: alt.anonymous.messages RS Wood <rsw@therandymon.com> - 2014-04-17 23:51 +0000
        Re: alt.anonymous.messages Mike Easter <MikeE@ster.invalid> - 2014-04-17 17:45 -0700
          Re: alt.anonymous.messages RS Wood <rsw@therandymon.com> - 2014-04-18 21:12 +0000
            Re: alt.anonymous.messages RS Wood <rswood@therandymon.com> - 2014-04-19 17:47 +0000
              Re: alt.anonymous.messages Mike Easter <MikeE@ster.invalid> - 2014-04-20 10:07 -0700
          Re: alt.anonymous.messages Randy Westlund <Vorzakir@invalid.invalid> - 2014-04-19 20:18 +0000

#2403 — alt.anonymous.messages

Question: does anyone have any idea what is going on in that group?  Endless, PGP messages of the same format and length?

[toc] | [next] | [standalone]

#2404

On 2014-04-16, RS Wood <rsw@therandymon.com> wrote:
> Question: does anyone have any idea what is going on in that group?  Endless, PGP messages of the same format and length?

Something to do with this?;

http://en.wikipedia.org/wiki/Mixmaster_anonymous_remailer

-- 
Today is Sweetmorn, the 33rd day of Discord in the YOLD 3180
“Stupidity cannot be cured. Stupidity is the only universal capital crime;
 the sentence is death. There is no appeal, and execution is carried out
                 automatically and without pity.”

[toc] | [prev] | [next] | [standalone]

#2405

RS Wood wrote:
> Question: does anyone have any idea what is going on in that group?
> Endless, PGP messages of the same format and length?

It's a form of shared mailbox; mixing a bunch of different people's 
messages into the same pile.

One person can anonymously post an encrypted message there by way of 
avoiding evidence they posted/sent it, while another person can acquire 
the message from the public/shared mailbox by way of avoiding evidence 
they received it and then decrypt it.

The recipient downloads (or sees) all the messages or message headers in 
the mailbox/newsgroup and is (only) able to decrypt the one/s intended 
for them.



-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#2419

On 4/16/14 12:03 PM, Mike Easter wrote:
>RS Wood wrote:
>> Question: does anyone have any idea what is going on in that group?
>> Endless, PGP messages of the same format and length?
>
>It's a form of shared mailbox; mixing a bunch of different people's 
>messages into the same pile.
>
>One person can anonymously post an encrypted message there by way of 
>avoiding evidence they posted/sent it, while another person can acquire 
>the message from the public/shared mailbox by way of avoiding evidence 
>they received it and then decrypt it.
>
>The recipient downloads (or sees) all the messages or message headers in 
>the mailbox/newsgroup and is (only) able to decrypt the one/s intended 
>for them.
>
>
>
>-- 
>Mike Easter


That's a good explanation, thanks.  A very clever system.

[toc] | [prev] | [next] | [standalone]

#2420

RS Wood wrote:
> Mike Easter wrote:
>> RS Wood wrote:
>>> Question: does anyone have any idea what is going on in that group?
>>> Endless, PGP messages of the same format and length?
>>
>> It's a form of shared mailbox; mixing a bunch of different people's
>> messages into the same pile.

> That's a good explanation, thanks.  A very clever system.

Actually it has a number of flaws from a security viewpoint.

There was a recent in-depth evaluation by Tom Ritter, called 
De-Anonymizing Alt.Anonymous.Messages and presented at the DefCon 21 
conference.  It is a 116 p. .pdf doc and there are discussions about the 
'revelations' such as:

// It seems there are issues with AAM, many of them related to the size 
of the mixmaster network, the poor tools available, and the sloppy 
operational practices of the people who use it... //

Ritter did a lot of analysis of metadata as well as a little cracking by 
acquiring 1.1 million messages over the last 10 years and 'digesting' them.

There are plenty of places to get the .pdf and here's Ritter's page 
intro'ing http://ritter.vg/blog-deanonymizing_amm.html



-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#2429

On 2014-04-18, Mike Easter <MikeE@ster.invalid> wrote:
> Actually it has a number of flaws from a security viewpoint.  There
> was a recent in-depth evaluation by Tom Ritter, called De-Anonymizing
> Alt.Anonymous.Messages and presented at the DefCon 21 conference.  It
> is a 116 p. .pdf doc and there are discussions about the 'revelations'
> such as: // It seems there are issues with AAM, many of them related
> to the size of the mixmaster network, the poor tools available, and
> the sloppy operational practices of the people who use it... //
>
> Ritter did a lot of analysis of metadata as well as a little cracking
> by acquiring 1.1 million messages over the last 10 years and
> 'digesting' them.  There are plenty of places to get the .pdf and
> here's Ritter's page intro'ing
> http://ritter.vg/blog-deanonymizing_amm.html

So, is the purpose of an app like the one they're discussing on
alt.privacy (http://genmixdummy.sourceforge.net I think) simply to
crapflood the newsgroup to lower the signal/noise ratio?  If that's the
case, seems like a somewhat futile strategy.  I'll have a look at that
PDF - seems fascinating.

[toc] | [prev] | [next] | [standalone]

#2431

In article <lis4f8$qad$5@solani.org>, RS Wood <rsw@therandymon.com> 
wrote:

> On 2014-04-18, Mike Easter <MikeE@ster.invalid> wrote:
> > Actually it has a number of flaws from a security viewpoint.  There
> > was a recent in-depth evaluation by Tom Ritter, called De-Anonymizing
> > Alt.Anonymous.Messages and presented at the DefCon 21 conference.  It
> > is a 116 p. .pdf doc and there are discussions about the 'revelations'
> > such as: // It seems there are issues with AAM, many of them related
> > to the size of the mixmaster network, the poor tools available, and
> > the sloppy operational practices of the people who use it... //
> >
> > Ritter did a lot of analysis of metadata as well as a little cracking
> > by acquiring 1.1 million messages over the last 10 years and
> > 'digesting' them.  There are plenty of places to get the .pdf and
> > here's Ritter's page intro'ing
> > http://ritter.vg/blog-deanonymizing_amm.html

Fascinating.  I had no idea the practice/whatever was so old.  Here's a 
clip from the beginning of that PDF.

//---clip

Hello, and Welcome. My name is Tom Ritter, and I work for iSEC Partners. 
If you donšt know who Zax is, you will by the end of this talk.
This talk is about an anonymity network that was started in the 
fledgling days of the Cypherpunk era ­ the early 1990s.

This book hadnšt even come out yet ­ this is the second edition. But 
this is the first edition, and it had come out, and the US had ruled you 
while you could export the book itself, you couldnšt export the floppy 
disk with the source code. The United States government was actively 
investigating Phil Zimmerman for violating the Arms Control Export Act, 
for making the first few versions of PGP available.

Dan Bernstein and the toddler-aged EFF went on the offensive taking the 
US government to court and suing over the export controls on 
cryptography. Another group of people ultimately printed the source code 
for PGP, exported the book to Europe, scanned it in, and OCR-ed it in 
1997 releasing a version of PGP that bypassed export controls

Alt.Anonymous.Messages was forged in the heyday of the cypherpunks, and 
really, overall, has changed very little in the intervening decade since 
it was last shaped in any major way.

And in that decade, what we have seen is a monumental focus of the 
nations spy agencies on not what was thought to be the most critical 
piece of information to encrypt ­ the content itself. But instead....

Metadata.
//---

[toc] | [prev] | [next] | [standalone]

#2433

RS Wood wrote:
>> Mike Easter wrote:

>>> Actually it has a number of flaws from a security viewpoint.  There
>>> was a recent in-depth evaluation by Tom Ritter,

> Alt.Anonymous.Messages was forged in the heyday of the cypherpunks, and
> really, overall, has changed very little in the intervening decade since
> it was last shaped in any major way.
>
> And in that decade, what we have seen is a monumental focus of the
> nations spy agencies on not what was thought to be the most critical
> piece of information to encrypt ­ the content itself. But instead....
>
> Metadata.

Well, if we are going to cite elements of the .pdf, I would choose to 
mention where TR thinks things should be headed which is about pages 106.

//
But what I keep coming back to is the fact that we have no anonymity 
network that is high bandwidth, high latency.  We have no anonymity 
network that would have let someone securely share the Collateral Murder 
video, without Wikileaks being their proxy.  You can’t take a video of 
corruption or police brutality, and post it anonymously.

Now I hear you arguing with me in your heads: Use Tor and upload it to 
Youtube.  No, youtube will take it down.  Use Tor and upload it to MEGA, 
or some site that will fight fradulent takedown notices.  Okay, but now 
you’re relying on the good graces of some third party.  A third party 
that is known to host the video, and can be sued.  Wikileaks was the 
last organization that was willing to take on that legal fight, and now 
they are no longer in the business of hosting content for normal people.

And you can say Hidden Service and I’ll point to size-based traffic 
analysis and confirmation attacks that come with a low-latency network, 
never mind Ralf-Phillip Weinmen’s amazing work the other month that 
really killed Hidden Services.  We can go on and on like this, but I 
hope you’ll at least concede the point that what you are coming up with 
are work-arounds for a problem that we lack a good solution to.
//

Ritter would like to see -1- fixing of Mixminion and -2- implementation 
of the design elements of Pynchon's Gate.

"So if we like Pynchon Gate, the path forward also involves fixing 
Mixminion. And mixminion needs love."



-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#2432

On 2014-04-18, Mike Easter wrote:
> Actually it has a number of flaws from a security viewpoint.
>
> There was a recent in-depth evaluation by Tom Ritter, called 
> De-Anonymizing Alt.Anonymous.Messages and presented at the DefCon 21 
> conference.  It is a 116 p. .pdf doc and there are discussions about the 
> 'revelations' such as:
>
> // It seems there are issues with AAM, many of them related to the size 
> of the mixmaster network, the poor tools available, and the sloppy 
> operational practices of the people who use it... //
>
> Ritter did a lot of analysis of metadata as well as a little cracking by 
> acquiring 1.1 million messages over the last 10 years and 'digesting' them.
>
> There are plenty of places to get the .pdf and here's Ritter's page 
> intro'ing http://ritter.vg/blog-deanonymizing_amm.html
>

Thanks for posting this, I just watched his talk.  Very informative.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web