5 ms·

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I hav

It feels like we need to include anonymity in the Internet Bill of Rights: 1. I have a right to read or write public information in an anonymous way. 2. I have a right to prevent you from reading or writing MY private information in an anonymous way, even if the intent is to obtain the right to exercise #1 in the process. 3. Using someone else's infrastructure/compute/power to enable #1 without breaking #2 requires you pay for it. I would also propose my private information is available at a price. Expecting the right to anonymity by removing the rights of others in the process places an individual in cognitive dissonance. It's not a good place to be. With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while.

devconsole 13y ago
With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful honeypot, you may risk legal consequences. If you're unable to prove your innocence (the request for the CP did come from your IP address, after all) then you may be very screwed. I invite the community to toss around ideas about how to protect against this. I hypothesize that it's an unsolvable problem: if you enable strong anonymity, that anonymity will immediately be used for child porn. One way to combat this would be to have some kind of credentialing, where you are able to generate credentials for the anonymous party to use. Assuming your infrastructure is set up as a Tor hidden service, then it's possible for them to use your infrastructure anonymously, and then you can revoke the credentials for individual violators. However, under that scheme, your IP address(es) are shared by every user. 4chan will immediately ban all of them as soon as it becomes clear you're a proxy, for example. It may still be worth exploring, but it needs some thought. Tor itself still doesn't have "endpoint bridges," that is, endpoints which aren't publicly listed. Meaning it's very easy to ban all of Tor, as far as I know.
- drdaeman 13y ago
  > unable to prove your innocence Here's the issue. Return presumption of innocence back and problem's solved. Obviously, that's impossible in a real world. > credentials for the anonymous party to use That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.
  - devconsole 13y ago
    It could be possible to enable someone you trust to use your infrustracture. You don't have to know who this person is. For example, this devconsole HN account that I'm using now is an anonymous HN account, meaning as long as Tor is secure, and I don't reveal myself through e.g. text analysis or timing correlations, it should be hard to figure out who I am. If I were to come to you and ask to use your infrastructure to help me maintain my anonymity, you may read my comment history and decide that you trust me not to do illegal things. Providing such a service would be extremely valuable, because if Tor is indeed not completely impervious, your extra layer of anonymity may be all that preserves one's privacy. If an authority were to come to you and demand you cooperate in determining my identity, then there would be no way for you to oblige, except by providing them with a log of the VPN activity, or allowing them to set up a pen trap to log the VPN activity. At that point, the privacy is still as strong as the Tor network, so both Tor and this extra layer would have to fall in order to be unmasked. (In practice, it's more complicated than that: your infrastructure would be a fixed endpoint, meaning that if it's compromised then an adversary would gain a log of your activity. That would provide an overall picture of what you're up to on the internet. Tor rotates endpoints, making it hard to piece together that info. So in practice a user should want your service to be something like a middleman between two different anonymity services. But that's outside the scope of this comment for now.) This becomes a pretty attractive idea, because it's not necessarily a great idea to assume that Tor should be the world's one realistic defense. Since Snowden used Tor, you can be absolutely certain that various powers are going to take a keen interest in penetrating Tor. They may use dirty tricks to do it, such as joining the Tor project as an apparently-trustworthy developer. Extra layers of defense such as the one outlined above may be worth pursuing.
drdaeman 13y ago
Could you provide a definition for "in an anonymous way" in #1 and "prevent from reading" in #2? My concerns are: As for anonymity: Internet protocols require addressing - without an address where to send packets back you can only communicate unidirectionally - sending information but not receiving any. Does being identified by an address still considered "anonymous"? As for prevention: I'm not sure why need any sort of law to do so. Is there any case - except for law enforcement situations - where one's prevented from disclosing their private information? Also, writing "requires you pay for it" may have bad consequences. For example, in Russia we had a copyright law that said quite similar thing - a statement that any software license must explicitly define payment process (or explicitly declare rights being provided free of charge) - and this led to issue with perceived legality of some FLOSS licenses that don't say anything about. To my knowledge, this hadn't been ever examined in a court and had been fixed in laws since then, but hope you see the point.
Zigurd 13y ago
The Bill of Rights already explicitly says it isn't the List of Rights.
- kordless 13y ago
  The intent of it is a framework, right? i.e. it's not inclusive of all rights, just ones that are currently applicable and a template of intent for future ones.
  - Zigurd 13y ago
    The answer is in the assumption that powers are enumerated and rights are not. That's why the BoR contains that disclaimer.

devconsole 13y ago

With the advent of cryptocurrencies, we're finally in a place someone can pay me to use a portion of my infrastructure for enabling their anonymity. I'm willing to contribute to the cause as long as it's worth my while. Your infrastructure will immediately be used to download or upload child pornography. If you're exceptionally unlucky, the FBI will come knocking and, if you're unable to provide them with a useful honeypot, you may risk legal consequences. If you're unable to prove your innocence (the request for the CP did come from your IP address, after all) then you may be very screwed. I invite the community to toss around ideas about how to protect against this. I hypothesize that it's an unsolvable problem: if you enable strong anonymity, that anonymity will immediately be used for child porn. One way to combat this would be to have some kind of credentialing, where you are able to generate credentials for the anonymous party to use. Assuming your infrastructure is set up as a Tor hidden service, then it's possible for them to use your infrastructure anonymously, and then you can revoke the credentials for individual violators. However, under that scheme, your IP address(es) are shared by every user. 4chan will immediately ban all of them as soon as it becomes clear you're a proxy, for example. It may still be worth exploring, but it needs some thought. Tor itself still doesn't have "endpoint bridges," that is, endpoints which aren't publicly listed. Meaning it's very easy to ban all of Tor, as far as I know.

drdaeman 13y ago
> unable to prove your innocence Here's the issue. Return presumption of innocence back and problem's solved. Obviously, that's impossible in a real world. > credentials for the anonymous party to use That wouldn't be anonymous anymore. And there's no way to realistically force a single human to have only one credential - if one's banned they'll just generate a new one.
- devconsole 13y ago
  It could be possible to enable someone you trust to use your infrustracture. You don't have to know who this person is. For example, this devconsole HN account that I'm using now is an anonymous HN account, meaning as long as Tor is secure, and I don't reveal myself through e.g. text analysis or timing correlations, it should be hard to figure out who I am. If I were to come to you and ask to use your infrastructure to help me maintain my anonymity, you may read my comment history and decide that you trust me not to do illegal things. Providing such a service would be extremely valuable, because if Tor is indeed not completely impervious, your extra layer of anonymity may be all that preserves one's privacy. If an authority were to come to you and demand you cooperate in determining my identity, then there would be no way for you to oblige, except by providing them with a log of the VPN activity, or allowing them to set up a pen trap to log the VPN activity. At that point, the privacy is still as strong as the Tor network, so both Tor and this extra layer would have to fall in order to be unmasked. (In practice, it's more complicated than that: your infrastructure would be a fixed endpoint, meaning that if it's compromised then an adversary would gain a log of your activity. That would provide an overall picture of what you're up to on the internet. Tor rotates endpoints, making it hard to piece together that info. So in practice a user should want your service to be something like a middleman between two different anonymity services. But that's outside the scope of this comment for now.) This becomes a pretty attractive idea, because it's not necessarily a great idea to assume that Tor should be the world's one realistic defense. Since Snowden used Tor, you can be absolutely certain that various powers are going to take a keen interest in penetrating Tor. They may use dirty tricks to do it, such as joining the Tor project as an apparently-trustworthy developer. Extra layers of defense such as the one outlined above may be worth pursuing.

drdaeman 13y ago

Could you provide a definition for "in an anonymous way" in #1 and "prevent from reading" in #2? My concerns are: As for anonymity: Internet protocols require addressing - without an address where to send packets back you can only communicate unidirectionally - sending information but not receiving any. Does being identified by an address still considered "anonymous"? As for prevention: I'm not sure why need any sort of law to do so. Is there any case - except for law enforcement situations - where one's prevented from disclosing their private information? Also, writing "requires you pay for it" may have bad consequences. For example, in Russia we had a copyright law that said quite similar thing - a statement that any software license must explicitly define payment process (or explicitly declare rights being provided free of charge) - and this led to issue with perceived legality of some FLOSS licenses that don't say anything about. To my knowledge, this hadn't been ever examined in a court and had been fixed in laws since then, but hope you see the point.

Zigurd 13y ago

The Bill of Rights already explicitly says it isn't the List of Rights.

kordless 13y ago
The intent of it is a framework, right? i.e. it's not inclusive of all rights, just ones that are currently applicable and a template of intent for future ones.
- Zigurd 13y ago
  The answer is in the assumption that powers are enumerated and rights are not. That's why the BoR contains that disclaimer.