"Dr." Fred

The most charitable explanation for "Dr." Fred is that
he's degenerated into the professional equivalent of
those pathetic aging former chess masters who try to
eek out a subsistence living by charging five bucks a
game. People often play with them out of sympathy, or
for the novelty of having lost to a past great. It's
part of the chess culture, and it's basically harmless
and sort of quaint.

The difference, of course, is that its almost impossible
to have sympathy for Dr. Fred. His hustle is for a hell
of a lot more than subsistence. He was also never actually
a master of his field, a fact that becomes increasingly
obvious as our exposure to him goes on. Now he's reduced
himself to trying to collect someone else's winnings.

In article <199511010235.DAA00908@utopia.hacktic.nl>,
Anonymous <anon-remailer@utopia.hacktic.nl> wrote:
> The difference, of course, is that its almost impossible
> to have sympathy for Dr. Fred. His hustle is for a hell
> of a lot more than subsistence. He was also never actually
> a master of his field, a fact that becomes increasingly
> obvious as our exposure to him goes on. Now he's reduced
> himself to trying to collect someone else's winnings.

So, what part of your analogy was valid?
-- 
Shields.

> The most charitable explanation for "Dr." Fred is that
> he's degenerated into the professional equivalent of
> those pathetic aging former chess masters who try to
> eek out a subsistence living by charging five bucks a
> game. People often play with them out of sympathy, or
> for the novelty of having lost to a past great. It's
> part of the chess culture, and it's basically harmless
> and sort of quaint.

Most of then could still beat your chess game.

> The difference, of course, is that its almost impossible
> to have sympathy for Dr. Fred. His hustle is for a hell
> of a lot more than subsistence. He was also never actually
> a master of his field, a fact that becomes increasingly
> obvious as our exposure to him goes on. Now he's reduced
> himself to trying to collect someone else's winnings.

Sour grapes, and from an anonymous poster too.  Oooo - I'm insulted.

I have been thinking about the issues of anonymity for some time, and I
have been convinced for some time that you can't have both integrity and
anonymity.  I thought there might be ways to accomplish this, but the
cypherpunks have convinced me it isn't true.  Show some integrity and
tell us who you are.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

My turn to rise to the bait...

Dr. Frederick B. Cohen writes:
> I have been thinking about the issues of anonymity for some time, and I
> have been convinced for some time that you can't have both integrity and
> anonymity.  

What's your working definition of "integrity" in this context ?

-Futplex <futplex@pseudonym.com>
"Once anonymous, twice pseudonymous"

> My turn to rise to the bait...
> 
> Dr. Frederick B. Cohen writes:
> > I have been thinking about the issues of anonymity for some time, and I
> > have been convinced for some time that you can't have both integrity and
> > anonymity.  
> 
> What's your working definition of "integrity" in this context ?

Integrity:= 1) Steadfast adherence to a strict moral and ethical code.
	2) A state of being unimpaired; soundness.
	3) The quality or condition of being whole or undivided; soundness
	Also) soundness, completeness,
Alternatively:
	1) Strict personal honesty and independence...
	2) Completeness; unity...
	3) The state of being unimpaired; soundness...''

In this context, I might be misinterpreted as having meant that it is
impossible to have both integrity and anonymity.  That is not what I
meant, although it is probably also true in a very strict sense.

To clarify, I don't think you can assure integrity when you have anonymity.

This follows from my earlier writings (circa 1984-89), which are fairly
extensive, and in which I made the only marginally supported claim that
you can't have (i.e., assure) both integrity and secrecy in a system
with sharing.  This came originally from the result that integrity +
secrecy = no sharing (ala the combination of Biba and Bell-LaPadula)
which was extended into a POset which characterizes the extent to which
integrity and secrecy can be maintained based on transitive information
flow.

The less mathematical reasoning is that in order to be able to verify
integrity, you have to be able to examine the information that is
secret, while having secrecy requires that you not be able to have
independent verification.  Thus the two limit each other. 

Anonymity, in this copntext, can be thought of as secrecy.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

Dr. Frederick B. Cohen writes:
> I have been convinced for some time that you can't have both integrity and
> anonymity.  
[and in a followup]
> I might be misinterpreted as having meant that it is impossible to have
> both integrity and anonymity. That is not what I meant, [...]

Er, thanks for the clarification....

> Integrity:= 1) Steadfast adherence to a strict moral and ethical code.
> 	2) A state of being unimpaired; soundness.
> 	3) The quality or condition of being whole or undivided; soundness
> 	Also) soundness, completeness,
> Alternatively:
> 	1) Strict personal honesty and independence...
> 	2) Completeness; unity...
> 	3) The state of being unimpaired; soundness...''
> 
> In this context, I might be misinterpreted as having meant that it is
> impossible to have both integrity and anonymity.  That is not what I
> meant, although it is probably also true in a very strict sense.

All right, what makes you think that ?  Lest we wave our hands too much and
totally misunderstand each other, let me lay down a more concrete scenario.
If you have a substantially different scenario in mind, let me know.

Suppose that I send an anonymous message to a public forum such as this. I
and the message seem to "have anonymity" by any standard I can presently
imagine. Now, in what ways might I or the message lack integrity in this
situation ?  

I haven't broken my personal ethical codes, although perhaps
I've violated someone else's. I have been honest, at least as much as I am
generally honest in anything I write. I am not lying by donning the cloak of
anonymity; I have not misrepresented my identity, merely refused to reveal
it. The content of the message can be considered sound as much as anything
else can. The message is incomplete in the sense that it does not include
the true identity of the author -- is this what you would claim as a
failure of integrity ?  All messages are incomplete in the sense that
various important facts are absent from them.

> To clarify, I don't think you can assure integrity when you have anonymity.
> 
> This follows from my earlier writings (circa 1984-89), which are fairly
> extensive, and in which I made the only marginally supported claim that
> you can't have (i.e., assure) both integrity and secrecy in a system
> with sharing.  This came originally from the result that integrity +
> secrecy = no sharing (ala the combination of Biba and Bell-LaPadula)
> which was extended into a POset which characterizes the extent to which
> integrity and secrecy can be maintained based on transitive information
> flow.
> 
> The less mathematical reasoning is that in order to be able to verify
> integrity, you have to be able to examine the information that is
> secret, while having secrecy requires that you not be able to have
> independent verification.  Thus the two limit each other. 
> 
> Anonymity, in this copntext, can be thought of as secrecy.

I understand the nature of the information flow argument, but I don't see
that it's applicable. You appear to contend that the assurance of the
integrity of an anonymous message depends upon the examination of
information that is "secret", that is, _not part of the message_. But no
message is complete -- all messages have many such associated "secrets" not
available as part of the messages. So the claim seems to be vacuous: we
can assure the integrity of neither anonymous nor verinymous messages.

Perhaps the rejoinder will be that anonymous messages have a 
_characteristic_ piece of missing "secret" information, namely the senders'
True Names. But you have yet to offer any argument that only certain special
"secrets" must be examined in order to verify integrity.

-Futplex <futplex@pseudonym.com>

> Dr. Frederick B. Cohen writes:
> > I have been convinced for some time that you can't have both integrity and
> > anonymity.  
> [and in a followup]
> > I might be misinterpreted as having meant that it is impossible to have
> > both integrity and anonymity. That is not what I meant, [...]
> 
> Er, thanks for the clarification....

A typical quotation taken out of context.  You missed the part after "I
meant" where I explained that I meant you couldn't assure ...  - That
is, you could have both or not have both, but you couldn't be certain
that you had both.

> > Integrity:= 1) Steadfast adherence to a strict moral and ethical code.
> > 	2) A state of being unimpaired; soundness.
> > 	3) The quality or condition of being whole or undivided; soundness
> > 	Also) soundness, completeness,
> > Alternatively:
> > 	1) Strict personal honesty and independence...
> > 	2) Completeness; unity...
> > 	3) The state of being unimpaired; soundness...''
> > 
> > In this context, I might be misinterpreted as having meant that it is
> > impossible to have both integrity and anonymity.  That is not what I
> > meant, although it is probably also true in a very strict sense.
> 
> All right, what makes you think that ?  Lest we wave our hands too much and
> totally misunderstand each other, let me lay down a more concrete scenario.
> If you have a substantially different scenario in mind, let me know.
> 
> Suppose that I send an anonymous message to a public forum such as this. I
> and the message seem to "have anonymity" by any standard I can presently
> imagine. Now, in what ways might I or the message lack integrity in this
> situation ?  

If the message was not of any particular import to anyone, integrity
would not be a very big issue, but suppose you took quotes out of
context and cleverly tried to construct a picture of the other person
as not being reputable.  People who read the message might believe that
what you said was true, or at least had a grain of truth to it.  That
sort of message lacks integrity, and the reason it lacks integrity is
because it has anonymity, not just because it's false and misleading.

To clarify even further, I seem to recall a posting some months ago from
an anonymous source declaring a new on-line for-sale forum called the
Internet Security Newsletter (or some such thing).  The anonymity of the
poster in the context of asking for money and the fact that one of the
people who was claimed to be on the board of editors was not, in fact, a
participant, led to the question of who the person was.  It turned out
that this person had a substantial history of putting forth falsehoods
as well as other related things that might have been very helpful in
evaluating the credence of his statements.  It turned out that the
newsletter was, at least in some sense and without making value
judgements, legitimate; but the anonymity of the person making the posts
made it harder to assure the integrity of the statements made, which
exacerbated the assurance issue. 

> I haven't broken my personal ethical codes, although perhaps
> I've violated someone else's. I have been honest, at least as much as I am
> generally honest in anything I write. I am not lying by donning the cloak of
> anonymity; I have not misrepresented my identity, merely refused to reveal
> it. The content of the message can be considered sound as much as anything
> else can. The message is incomplete in the sense that it does not include
> the true identity of the author -- is this what you would claim as a
> failure of integrity ?  All messages are incomplete in the sense that
> various important facts are absent from them.

I don't know you, which also means that I don't know your motives.  This
brings up the problem that, even though your postings may be true and
your motives honorable, they may not be, and there is no way to look
into your background and evaluate your history in order to assess your
statements.  In many cases, I believe statements because of their source
and my experience with that source.

I understand that over time, reputations can be built up for pseudonyms
(which are not necessarily anonyms) but then, with a pseudonym we might
reasonably ask what the motive is for hiding the real identity.  Is it
for fun? Because it's there? In solidarity for those who have legitimate
reasons for remaining anonymous? Or is it a means to influence others
for personal or national gain? Is it a way of spreading disinformation?
Is it a way to escape liability for slanderous statements? Is it a way
to keep people from finding out that there is a personal grudge being
played out? Without knowing the motive, how can we assess the
statements? In fact, how can we know that the original pseudonym still
applies? Someone could kill you and take over your pseudonym, and even
though we might hear of your death, the pseudonym might continue based
on your reputation but with another actual source.

It's an interesting concept that each statement should/could be taken on
its own and evaluated independently of the rest of a person's life
context, but in my experience, that has serious problems.

> > To clarify, I don't think you can assure integrity when you have anonymity.
> > 
> > This follows from my earlier writings (circa 1984-89), which are fairly
> > extensive, and in which I made the only marginally supported claim that
> > you can't have (i.e., assure) both integrity and secrecy in a system
> > with sharing.  This came originally from the result that integrity +
> > secrecy = no sharing (ala the combination of Biba and Bell-LaPadula)
> > which was extended into a POset which characterizes the extent to which
> > integrity and secrecy can be maintained based on transitive information
> > flow.
> > 
> > The less mathematical reasoning is that in order to be able to verify
> > integrity, you have to be able to examine the information that is
> > secret, while having secrecy requires that you not be able to have
> > independent verification.  Thus the two limit each other. 
> > 
> > Anonymity, in this copntext, can be thought of as secrecy.
> 
> I understand the nature of the information flow argument, but I don't see
> that it's applicable. You appear to contend that the assurance of the
> integrity of an anonymous message depends upon the examination of
> information that is "secret", that is, _not part of the message_. But no
> message is complete -- all messages have many such associated "secrets" not
> available as part of the messages. So the claim seems to be vacuous: we
> can assure the integrity of neither anonymous nor verinymous messages.

An important point.  The more we know, the more certain we can be.  With
computer-based anonymity as it is practiced today, and ignoring the
examples of the pseudonyms that were broken by legal warrant, we have
very little knowledge about the originator of a message, and thus we
have very little assurance of the integrity of their messages.  The
history built up over time for a given pseudonym certainly increases the
assurance associated with it, but there are other problems with this.

Example: I have two (N) pseudonyms that put forth different points of
view specifically directed to create different kinds of credence to
different audiences.  If the audiences knew that both (several) of the
pseudonyms were in fact the same person, they would have very different
beliefs about the individual given the combined picture than they might
get from any one of the pictures.

> Perhaps the rejoinder will be that anonymous messages have a 
> _characteristic_ piece of missing "secret" information, namely the senders'
> True Names. But you have yet to offer any argument that only certain special
> "secrets" must be examined in order to verify integrity.

It's not only the True Name that's at issue.  It's the association of a
set of messages and historical information with a source.  For example,
if we knew you were a KGB agent working in the disinformation and
economic espionage branches, we might evaluate your postings differently
than if we knew you were a high-school student from Deluth whose father
taught her a lot about cryptography when she was young.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

Dr. Frederick B. Cohen writes:
> To clarify even further, I seem to recall a posting some months ago from
> an anonymous source declaring a new on-line for-sale forum called the
> Internet Security Newsletter (or some such thing).  The anonymity of the
> poster in the context of asking for money and the fact that one of the
> people who was claimed to be on the board of editors was not, in fact, a
> participant, led to the question of who the person was.  

The poster wasn't actually anonymous, but rather pseudonymous, in that case.
(The pseudonym was the name of the publication, as I recall.)

> It turned out
> that this person had a substantial history of putting forth falsehoods
> as well as other related things that might have been very helpful in
> evaluating the credence of his statements.  It turned out that the
> newsletter was, at least in some sense and without making value
> judgements, legitimate; but the anonymity of the person making the posts
> made it harder to assure the integrity of the statements made, which
> exacerbated the assurance issue. 

It seems to me that the integrity of the statements was rather easily verified
based on the merits of the statements themselves. In particular, one or two
participants in the forum denied the claims made that they were members of
the editorial board.

Granted, some people would have been more inclined to look askance at the
messages if they had known the author's True Name. But as the saying goes,
"past performance is not a guarantee of future results". You can choose to
doubt or believe a message because of the author's past reputation. But
reputation is not a reliable predictor of the integrity of future assertions.
It's a nice psychological crutch, but reliance on a "rational expectation" is
a long way from anything I would call "assurance" or "verification". It
doesn't prove anything. The only acceptable method of assurance I can see is
careful analysis of the propositions posited, and empirical verification of
the facts presented. Leaning on past reputation is accepting an odd form of
Proof by Authority.

As it happened I had never heard of the True Name of the sender, so the
knowledge wasn't useful to me.

> I understand that over time, reputations can be built up for pseudonyms
> (which are not necessarily anonyms) but then, with a pseudonym we might
> reasonably ask what the motive is for hiding the real identity.  
[possible motives...]
> Without knowing the motive, how can we assess the statements? 

By asking yourself if they seem to make sense, checking them against known
facts and beliefs, etc. The same methods, IMHO, that are mainly appropriate
to assess anyone's statements.

> In fact, how can we know that the original pseudonym still
> applies? Someone could kill you and take over your pseudonym, and even
> though we might hear of your death, the pseudonym might continue based
> on your reputation but with another actual source.

Of course, the is-a-person problem has been discussed at great length. 
Digital signatures are as effective for pseudonyms as for anyone else.
The messages we've seen "from Alice de `nonymous" might all have come from
different senders. They exhibit a common tone and style, but that doesn't
assure us of anything. In a sense that makes them more inviting,
since there's always the chance that a third party is attempting a clever
parody or a sly bit of character assassination.

[...]
> It's an interesting concept that each statement should/could be taken on
> its own and evaluated independently of the rest of a person's life
> context, but in my experience, that has serious problems.

In my experience, that's about all I can usually do in network communication.
In principle I _could_ devote scads of time to background investigations of
my correspondents, for all except strongly anonymous and strongly 
pseudonymous parties, but I don't find that approach realistic.

-Futplex <futplex@pseudonym.com>

Futplex <futplex@pseudonym.com> opines:

... [example was here - saving bandwidth]...

> It seems to me that the integrity of the statements was rather easily verified
> based on the merits of the statements themselves. In particular, one or two
> participants in the forum denied the claims made that they were members of
> the editorial board.
> 
> Granted, some people would have been more inclined to look askance at the
> messages if they had known the author's True Name. But as the saying goes,
> "past performance is not a guarantee of future results". You can choose to
> doubt or believe a message because of the author's past reputation. But
> reputation is not a reliable predictor of the integrity of future assertions.
> It's a nice psychological crutch, but reliance on a "rational expectation" is
> a long way from anything I would call "assurance" or "verification". It
> doesn't prove anything. The only acceptable method of assurance I can see is
> careful analysis of the propositions posited, and empirical verification of
> the facts presented. Leaning on past reputation is accepting an odd form of
> Proof by Authority.

You are correct in stating that it doesn't prove anything, but that, it
seems to me, is universally true.  Nothing you can ever do can prove
absolute integrity.  The issue then comes down to whether you get more
integrity by knowing (or having access to) the full body of informaiton
about a source.  I think you do.

> As it happened I had never heard of the True Name of the sender, so the
> knowledge wasn't useful to me.

But with the name, if you had chosen to, you could have done a great
deal to learn about the history of the individual - through his
published works, the many fine and not so fine things he has done in his
career, etc.  It is the availability of this reference material that
makes the identity that much more useful. 

> > I understand that over time, reputations can be built up for pseudonyms
> > (which are not necessarily anonyms) but then, with a pseudonym we might
> > reasonably ask what the motive is for hiding the real identity.  
> [possible motives...]
> > Without knowing the motive, how can we assess the statements? 
> 
> By asking yourself if they seem to make sense, checking them against known
> facts and beliefs, etc. The same methods, IMHO, that are mainly appropriate
> to assess anyone's statements.

It is interesting that you take this line, especially in a forum where
so many people trust so much that is posted without verifying it.  For
example, who on the cypher punks list verified the posting made by the
people from MIT regarding Java?  Was it simply the trusted MIT name that
caused you to take int on faith?

One of the underlying assumptions of the scientific establishment, and
in fact science itself, is that results be published and verifiable, but
in reality, almost all results are not verified, and even the most
startling results aren't verified before many people begin to place
trust in them.

Example of a relatively quick response to such an assertion was the Cold
Fusion situation a few years ago.  On the other hand, the professor at
the University of Pittsburgh who published results based on faked data
(this is a gross simplification, I know) was widely believed for many
years.

The fact is that, today, there are simply too many results to verify
them all along with the underlying data they depend on, the software
used to generate them, etc.  As a result, we are increasingly left with
trusting the people rather than the results.  Another issue is that the
resources required to reproduce "big science" are not available to most
people.  Has anyone reproduced Adleman's experiments on bilogical
computation? I know of nobody that has, and would love to do it myself,
but I don't have the necessary equipment.  This is an Earthshaking
result with enormous long-term consequences, and I'm certain it's right
because I agree with the underlying theory and don't see any reason for
anyone to lie about it, but if Nostragnia of the Crydon Republic had
published it anonymously, I would be much more hesitant to accept it
and so would you (all).

> > In fact, how can we know that the original pseudonym still
> > applies? Someone could kill you and take over your pseudonym, and even
> > though we might hear of your death, the pseudonym might continue based
> > on your reputation but with another actual source.
> 
> Of course, the is-a-person problem has been discussed at great length. 
> Digital signatures are as effective for pseudonyms as for anyone else.
> The messages we've seen "from Alice de `nonymous" might all have come from
> different senders. They exhibit a common tone and style, but that doesn't
> assure us of anything. In a sense that makes them more inviting,
> since there's always the chance that a third party is attempting a clever
> parody or a sly bit of character assassination.

The question is not whether the signature is right, but rather, are
there other reasons to believe or not believe - trust or not trust -
etc.  the sender.  The less anonymity, the better this is revealed.

> [...]
> > It's an interesting concept that each statement should/could be taken on
> > its own and evaluated independently of the rest of a person's life
> > context, but in my experience, that has serious problems.
> 
> In my experience, that's about all I can usually do in network communication.
> In principle I _could_ devote scads of time to background investigations of
> my correspondents, for all except strongly anonymous and strongly 
> pseudonymous parties, but I don't find that approach realistic.

The point of non-pseudonyms is that if you want to know you can try to
find out.  If others know additional relevant information and decide to
reveal it, you can tell that much the better.  It also reuces blatant
character assasination (which brings some level of civility) and forces
people to take personal responsibility for what they say and do.  All
of these things, in my opinion, increase integrity.

-- 
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

> My turn to rise to the bait...
> 
> Dr. Frederick B. Cohen writes:
> > I have been thinking about the issues of anonymity for some time, and I
> > have been convinced for some time that you can't have both integrity and
> > anonymity.  
> 
> What's your working definition of "integrity" in this context ?

Come on.. we're never gonna get Dr. Fred to go away if we keep giving
him attention.

Christopher