Hacker News Reader

Comment by jasonkostempski | Hacker News Reader

This may be a stupid question but I've got to ask because I'm not 100% sure. Is there no practical way data can be sent and received anonymously? If no one, except the people trying to communicate, knows who encrypted or decrypted anything, how could they enforce such a law? Since a well encrypted message should be safe to broadcast, it can be sent to the whole world with only the intended recipients being able to decrypt it. Even if it's inconvenient to coordinate such a thing, I'm sure the perverts and terrorists would deal with it if they had to.

View on HN

Once upon a time, we imagined a cypherpunk future, where speech was free and the internet was the great frontier of autonomous anonymity.

It turns out, though, that we leave fingerprints on everything we touch. And many of the conveniences and indeed basic user experience we've come to expect leave plenty of markers of who we are for anyone who might be listening. This makes it easy for hacker news to remember who I am, and easy for advertisers to target ads, and governments to track individuals.

So yeah, tools exist, sort of, but require a lot of inconvenience. We've seen instances of ISPs inserting their own cookies on headers of outgoing customer traffic, meaning there are still times when your precautions don't matter at all. When I've thought about totally anonymous internet usage, my guess is that you need to go buy a fresh laptop with cash, and then only use it on large public networks, with good encryption...

Yes, it is possible, if your attacker isn't too powerful. However, there will be a lot of tradeoffs and the software is not quite finished yet.

The software which is currently closest to this is ricochet [0] which communicates directly between Tor hidden services. Since there is no central server, there is no one to record metadata (at least in a trivial fashion). However there is still a lot of work left to do before ricochet is something that could be mainstream. Also, some metadata can be leaked, such as when one is online, and (until proposal 224 is out) how much people are communicating based on the number of lookups on the hidden service directories corresponding to the service (since there is no randomness in the system yet, afaik, you can brute force values to get into the right place in the ring. I haven't read the Tor specifications in a while tho, so I may be wrong)

You could also use some sort of mixnet system, although you would probably end up leaking who is sending messages to their ISP. To stop the ISP from determining when, you could send o constant stream of encrypted traffic, although that would be inefficient. (I need to read more research on this)

However, weather people will actually use these systems is in entirely different problem.

[0] https://ricochet.im

because when you send messages, they go from your computer to your ISP, then to the internet. so anyone watching you at the ISP level sees you sent something.

Then, it depends where you sent it. Email goes to one person, so receipt of the message is seen on their ISP's side.

Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files. In order for the receiver to find what they wanted, they would have to browse the public folder to find what they needed, and this act of browsing strips the anonymity away.

The other problem is that you have to exchange the decryption keys with the person you intend to communicate with. You either need to physically give/mail them to the recipient (loss of anonymity in the case of mail), or else you need to exchange them electronically, which usually requires an A<->B exchange, or you can post your public key and let the recipient find it.

Basically, if you are a government watching all the communication from above, you can usually tell what path information takes, even if its posted publicly.

Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files.

I think USENET and nntp came really close to fulfilling most of "single public folder for the whole world", but unfortunately has fallen out of popular use (and it needs to be popular enough to increase the anonymity) because it wasn't walled-garden enough to make money from.

Couldn't bad players just send and receive through other peoples connections, maybe even pretend to be someone else on purpose, in order to get them arrested? It's pretty trivial to jump on someone's wi-fi, and use throw away emails.

I think it depends on what you do with someone else's connection. A criminal could definitely get an innocent person's house raided, but cops aren't stupid either. If they do their homework first and see Aunt Mildred only goes to facebook and cooking-network.com, and suddenly she's sending death threats to public officials, they might knock on her door and politely ask to put a wifi surveillance device in her home to pinpoint the intruder's signal.

Sure you could steal signals or go to starbucks (which has cameras of course ) a few times and maybe get away with it, but to do it reliably, on demand, is very difficult.

Reply on news.ycombinator.com