Tom Ritter

> Yet you provide no options for Tor, as in https://simplex.chat/docs/server.html your idea for anonymizing users is... For the user to hop through roughly 20 page document of dozens of commands to create the equivalent of personal VPN server, and amidst it, to connect anonymously to contacts' servers, you need to install...

You need to understand things you criticise. There is no contradiction here. We don't think Tor should be default, because Tor has bad threat model for many people, and bad usability for most people.

This is a separate conversation, but you think that Tor is panacea for anonymity and that it provides "good enough" anonymity for most people, you need to read this rather old presentation: https://ritter.vg/p/tor-v1.6.pdf, in particular the pages titled "Guards - Math". In short, the conclusion should be that Tor provides ok anonymity for web browsing, with only occasional streams being de-anonymised, but it provides really bad anonymity for hidden services, because it is enough to deanonymise one stream to deanonymise the hidden service IP address - which is a catastrophic failure of threat model.

So, persistent hidden services simply should not be used as means to provide anonymity, and yet they are used as permanent user addresses in Cwtch... If you think I am wrong, we can debate it further, but you really should not be recommending Tor as panacea without understanding limitations of its threat model.

Yet, some people do like using Tor, both to…

There has been some research done on this particular anonymous newsgroup.

“Deanonymising alt anonymous messages”

https://www.youtube.com/watch?v=l5JBMyxvuH8

The accompanying blog post is here:

https://ritter.vg/blog-deanonymizing_amm.html

The inherent security of the technique is actually quite strong. The tooling is terrible and many other problems exist with AAM, but in general the idea of having a shared “inbox” is good for anonymity. There is no way to tell which message is intended for whom. Receiving messages is unlinked, which is obviously good for anonymity. Sending requires a different set of technologies to ensure that the message delivery is unlinked. Tor solves part of this problem.

AAM had serious limitations. Things fall down a bit with the underlying technology for newsgroups and PGP and so on not being designed for anonymity, “fail closed” security, or ease of use (and difficulty of misuse).

A bespoke system could work, but the limiting factor is selecting an “inbox” that is widely distributed and heavily used (the anonymity is directly correlated to how many people access the inbox/inbox container.)

# Case Study: YardBird’s group (mostly) escapes arrest

A similar method for secrecy was used by a CSAM group. It was penetrated by the police when they arrested a member who turned informant to reduce his sentence. The police monitored the group from inside for months (I remember it being over a year). Despite having complete access to all the…

Good to see I2P get some attention here.

For those who don't know about I2P:

* Anonymity network similar to TOR in some ways, but rather than focusing on getting someone out to the internet anonymously, I2P is a low-latency mix network with no out proxies. See: https://ritter.vg/blog-mix_and_onion_networks.html

* Virtually every I2P router relays traffic, unlike TOR the network is very "flat". Directory servers are replaced with a DHT called the netDB.

Recently I've been working on a Go implementation of the I2P router: https://github.com/hkparker/go-i2p. It isn't on the network yet, would be really interested in working with anyone who wants to contribute.

I think Colin's bang on here. Now is the time for cryptographers and software developers to act to implement a mature alternative to RSA, but it's not the point for your average joe to switch to an as yet relatively untested/unproven ECC implementation.

For what it's worth, Tom Ritter recently posted his notes on de-anonymizing alt.anonymous.messages[1], something widely believed to be very anonymous and very secure. It's an interesting read and shows why you not only need the crypto to be sound, but the implementation and your own use of it to be right too.

[1] - http://ritter.vg/blog-deanonymizing_amm.html

> Sure, it's complicated if you don't understand the basics of public key encryption, but as soon as you do, GPG is trivial to use.

Do you have any research to support your claims?

Because everything I've seen says that PGP / GPG is hard to use, even for smart tech-literate people who have something to hide.

These are all old. I don't know if it's got much better.

http://reports-archive.adm.cs.cmu.edu/anon/1998/abstracts/98-155.html

https://ritter.vg/blog-deanonymizing_amm.html

https://people.eecs.berkeley.edu/~tygar/papers/Why_Johnny_Cant_Encrypt/OReilly.pdf

One brittle, brute force method to do this (RSA-style) a decade ago was LD_PRELOAD vs. the RNG:

Phidelius: Constructing Asymmetric Keypairs From Mere Passwords For Fun and PAKE

https://dankaminsky.com/2012/01/03/phidelius/

Non-Persistent PGP Keys (2011)

https://ritter.vg/blog-non_persistent_pgp.html

--

Also related: https://github.com/jpf/lokey, "a tool for converting between cryptographic key formats". Unfortunately it needs maintenance.