On 09-Nov-08 19:14, Darren New wrote:
> andrel wrote:
>> - IP owners try to restrict the use of any technology that *could* be 
>> used to transmit content that they own.
>>
>> This seems to be the major motivation of this paper. 
> 
> I think that's one motivation. The other, of course, is being executed 
> for what you write online. :-)
> 
>> - The internet is used for SPAM, viruses, trojans, identity theft etc.
>>
>> No mention of that as far as I can see, apart from his reassurance 
>> that it has been taken care of. But I don't see any substantiation of 
>> that.
> 
> I think he means that you won't be able to send anonymous spam through 
> the system onto the general internet. Nobody is going to be using this 
> to threaten political figures via email without getting identified, 
> because nothing that's anonymous will actually go onto the non-anonymous 
> internet without someone specifically approving it.

I doubt that. We do have servers in the regular internet that will hide 
the IP address of a client already. The same will happen if this gets 
implemented. Some machines (many of them actually, knowing or unknowing) 
will connect this anonymous world to the real world. And that will also 
happen with youtube and the 18+ variants of that, servers will accept AP 
traffic and pass it on as genuine IP traffic to youtube.

>> - Content on the internet may contain child porn, attack plans from 
>> terrorist groups and other things that any government wants to block.
> 
> My search of the document revealed none of the words "child" nor 
> "terror" nor "government". I'm not sure where in the document you saw that.

There isn't anything in there about that and that was my point. Just 


above) exploiting this anonymity to commit serious crimes like those in 

and taken care of in the design of the protocol too, in one of the most 
clean and beautiful of ways possible.' That is the only reference of 
misuses of the internet anonymity that I could find.

>> - Content on the internet may contain information that some 
>> governments might want to block.
>>
>> Claimed to be solved by this protocol, however page 19: '(remember, it 
>> is not a secret that you are connected to the anonymous network, only 
>> who you are communicating with on this network, and what you are 
>> communicating!). Unless this protocol is used in a myriad of other 
>> ways, if you live in a country that restricts the internet to sites 
>> that they agree with, being connected to this network will be a 
>> problem. Besides you can be pretty sure that cross border anonymous 7
>> communication will be impossible too.
> 
> Near the end of the paper, he recommends that it run over the normal SSL 
> mechanisms on the normal 443 port number, to make it difficult or 
> impossible to distinguish this traffic from normal e-commerce type 
> traffic, and to make it financially difficult to filter it out 
> automatically.

Didn't see that, not sure if that would matter.

>> - Companies try to restrict bandwidth use by restricting traffic to 
>> work related activities.
>>
>> This is an on going problem. I think companies have a point if the 
>> block e.g. youtube. If you can use another protocol to circumvent that 
>> at the extra expense of a bit more overhead, I would not be happy as a 
>> company.
> 
> Except that youtube would have to explicitly serve their content onto 
> the anonymous network. 

See above, anyone could provide that 'service' to youtube.

> Not that they couldn't, but if you're going to 
> have an anonymous protocol at all, this is exactly the sort of thing you 
> can't stop - some particular group of people getting to particular stuff.

My 'guess' is that it would be used for anything that is not allowed in 
the day world and little else. The only other reason to use something 
like this would be if it would have provided a mechanism to reduce SPAM 
at the same time. I did have some hope that he was on to something when 
I read that paragraph at page 7 that I quoted above. Quod non.

>> There is also the related problem of leaking of IP (trade secrets) and 
>> privacy information. The firewall of my hospital is already leaky 
>> enough, I don't need another tunnel, thank you very much.
> 
> You already have one. SSL is a killer in this regard. That fight was 
> lost 15 years ago, as soon as people started tunneling inappropriate 
> content over HTTP explicitly to bypass firewalls. Why do you think Java 
> .code files get served as application/octet-string instead of something 
> that actually says it's Java?

I said I knew it was leaky already. The point is that I don't want any 
physician to regularly use a tunnel because the technology is so 
abundant that you don't know you are doing it. I know how to compromise 
the privacy of patients in our hospital, but I know what I am doing and 
though about it. So I won't do it. I am deliberately not using tunnels 
even though it could make my life a bit easier.

Post a reply to this message