double-blind vs single-blind

> -------------------------------------------------------------------------
> To find out more about the anon service, send mail to help@anon.penet.fi.
> Due to the double-blind, any mail replies to this message will be anonymized,
> and an anonymous id will be allocated automatically. You have been warned.
> Please report any problems, inappropriate use etc. to admin@anon.penet.fi.

I have a remailer question.

I see a letter posting an offer on the net.
The person making the offer is not anonymous.
I wish to be anonymous, so I decide to use a remailer to reply.
My reply includes a anNNN reply address.
If the original poster replies back, an anonymous id will be allocated to him.

  This isn't any good.  When the reply arrives, I will see the new 
anonymous id of a user whos real username and address I know!  My
pen-pal would compromise his ability to post anonymously in the future.
How can I send an anonymous message that allows a reply that is not
anonymous?

Keep in mind my pen-pal may not know anything about remailers yet.
(I have yet to use them myself :-)

Peter Baumbach
baumbach@atmel.com

baumbach@atmel.com (Peter Baumbach) raise the problem with the
anon.penet.fi remailer: he sends email to someone who does not have an
ID on the server. They reply, causing the server to automatically
allocate them an ID. He now knows their anonymous ID. This can also
happen if somebody `accidentally' responds to a message directed to
their `cleartext identity' (not sent through the server) anonymously
through the server.

Since no one else has posted on this yet I will.  The short answer is
that you can tell them to use your address `na[x]' and their anonymous
identity won't be revealed, and if they are using the server they might
know that (is it stated in the introduction material? it sure should be).

The collective list psyche realized this was a problem in an epiphany
about 6 months ago (due credit, I recall it was Deadbeat who brought it
to everyone's attention). It was a very lively exchange because J.
Helsingius was also involved simultaneously. (In fact, I'd call it one
of the few great testaments to cypherpunk prowess.) The problem is
rooted in two circumstances:

(1) the server was mainly intended for posting to newsgroups at its
origination, where the automated anonymizing (J. Helsingius' term:
`automated double blinding') makes sense. If someone posts to a
newsgroup anonymously, it is harmless and perhaps beneficial for
replies to that posting to be automatically anonymized.

(2) however, a major use of the server is email-to-email mail, so to
speak. in this case the scenario raised by Deadbeat in the past &
Baumbach recently reveals the pitfalls in the `feature'.

the automated anonymizing feature, implemented with the best of
intentions, has come back to haunt J. Helsingius rather rudely--it is
perhaps the greatest weakness of the server, other than the corrected
`forge-without-passwords' aspect (where someone can forge an email
message from: address and possibly determine anonymous-to-identity
mappings through trial and error if no passwords are used).

J. Helsingius has announced grand visions for the amazing, spectacular,
and impending Mark II server that will incorporate full encryption
(user keys mappings and a server key), along with a new default in
which replies to anonymous email will not be automatically anonymized.
Arriving `sometime in the fall'. If anyone wants it sooner, donate a
hard drive or something to this great living cypherpatriot, who has
personally monitored contributed to the list for suggestions and
maintenance over many months span.

There are multitudes of treacherous pitfalls to anonymity, far more
complex than the mere simplicity of keeping a password secret, and it
requires almost superhuman attention, precision, and cleverness to
avoid them all. It is like juggling multiple identities. In fact, the
studies on multiple personality disorder are very fascinating in this
light. Under an anonymous identity, one must respond as if certain
knowledge is known and other aspects are *not* known. This reminds me
of cases of MPD in which one personality can drive a car, and the other
cannot, for example. Analogously, if I revealed in some anonymous
message that I knew some secret or private aspect of one of my other
identities, `the jig is up'.

In fact, it would be very useful to try to enumerate all the various
pitfalls of maintaining an anonymous identity. One trick might go like
this: carry on a conversation with a person anonymously. Then, suppose
one has a pretty good guess of the person's identity. Send the next
snippet in the dialogue to the cleartext identity of your suspect. If
s/he responds as if nothing was different in the conversation, carrying
it on further, using the anonymous ID or even the regular one, you have
it nailed. If you get the response `what are you talking about?' the
test was inconclusive. This shows the absolute importance of looking to
*whom* a message you received was addressed to! was it to *you* or to
*you* or to ...

Ah--anonymity is such a delicate facade, and it is an apt symbolism on
multiple levels when the only difference between silent secrecy and
horrifying exposure teeters precariously [as if] on the order of the
two typed keystrokes `na'!

p.s. I would like to know if there is a way to (1) automatically get
traffic statuses from anon.penet.fi, and (2) get a list of supported newsgroups.

> Since no one else has posted on this yet I will.  The short answer is
> that you can tell them to use your address `na[x]' and their anonymous
> identity won't be revealed, and if they are using the server they might
> know that (is it stated in the introduction material? it sure should be).

It shure should be in the help file. But the whole help file needs
to be rewritten. I'm running as fast as I can!

> (1) the server was mainly intended for posting to newsgroups at its
> origination, where the automated anonymizing (J. Helsingius' term:
> `automated double blinding') makes sense.

I hate the automatic anonymizing myself, but for historical reasons that
had to be done. Can be fixed in the next reincarnation of the server
if documented clearly enough.

> (2) however, a major use of the server is email-to-email mail, so to
> speak. in this case the scenario raised by Deadbeat in the past &
> Baumbach recently reveals the pitfalls in the `feature'.

Right. There is a solution, but it has to wait for MK II.

> the automated anonymizing feature, implemented with the best of
> intentions, has come back to haunt J. Helsingius rather rudely--it is
> perhaps the greatest weakness of the server, other than the corrected
> `forge-without-passwords' aspect (where someone can forge an email
> message from: address and possibly determine anonymous-to-identity
> mappings through trial and error if no passwords are used).

Right.

> J. Helsingius has announced grand visions for the amazing, spectacular,
> and impending Mark II server that will incorporate full encryption
> (user keys mappings and a server key), along with a new default in
> which replies to anonymous email will not be automatically anonymized.

Right. Amazing, spectacular - maybe, but impending... Sigh...

> p.s. I would like to know if there is a way to (1) automatically get
> traffic statuses from anon.penet.fi,

stats@anon.penet.fi.

> and (2) get a list of supported newsgroups.

No. Simply to reduce bandwith - the list is something like 4000 groups
(200K).

	Julf