Re: IDEA: "Site Cloaking" Technology

Anybody would care to comment on this?

At 11:43 AM 12/26/96 -0800, Chris Hind <chind@juno.com>  wrote on the
Extropian list:

>A few weeks ago, I came up with this idea for a new technique I like to
>call "Site Cloaking". It's possible to create a Perl CGI script that would
>grab a file or webpage from another site & display it for the user without
>telling the user the original location like a proxy. This way you could put
>a CGI script on your website with links to country-specific censored texts
>or webpages and not tell anyone the site locations so that they can't shut
>them down. A person could put up a so-called subversive webpage in that
>specific country and tell this proxy the address and thus protect the site
>without giving out it's real address forcing the ISPs in that country to
>scan ALL WEBPAGES on their servers making the process more difficult. You
>could put up any so-called subversive and censored information on your
>webpage and people could access them without getting shutdown because only
>the CGI script would know where the source site is and you could even
>cipher the script's site list so even the owner of the proxy website can't
>locate the sites. You could then have a website or even a web search tool
>where you'd load all these sites into and acquire even more sites because
>you'd be offering protection and the sites would stay up indefinately. If
>the FEDS get pissed, simply wipe the file and the list is gone but the
>sites remain. 
>
>A person I talked to over IRC claimed that a CGI Perl script such as this
>isn't all that difficult to do but I myself have zero experience in
>programming Perl. Perhaps someone on this list who can program in Perl can
>try it?
>
>"Some people dream about worthy accomplishments while others stay
> awake and do them."
>
>-----------------------------------------------------------------------
>Chris Hind (chind@juno.com)                    Upward, Outward, ACTION!
>NeoReality (Personal)      http://www.geocities.com/CapeCanaveral/6810/
>Ethereal Outlook (Extropian)
>http://www.geocities.com/CapeCanaveral/6810/outlook.htm
>
>

This seems complimentary to anonymous browsing (e.g., www.anonymizer.com).
I doubt that ciphering the site list can assure that the site can't
be found, as somebody could match incoming and outgoing requests.
A chain of "Anonymous Rewebbers" / Recloakers could help here.
An important thing here would be to make sure that the search engines can
still find the sites.  Other difficulties would be caching and getting
credits for ads.

Do you think it's worth doing?

---------------------------------------------------------------------------
Alexander Chislenko   Home page:  <http://www.lucifer.com/~sasha/home.html>
Firefly Website recommendations:  <http://my.yahoo.com> ---> "Firefly"
---------------------------------------------------------------------------

On Thu, 26 Dec 1996, Alexander Chislenko wrote:

> This seems complimentary to anonymous browsing (e.g., www.anonymizer.com).
> I doubt that ciphering the site list can assure that the site can't
> be found, as somebody could match incoming and outgoing requests.
> A chain of "Anonymous Rewebbers" / Recloakers could help here.
> An important thing here would be to make sure that the search engines can
> still find the sites.  Other difficulties would be caching and getting
> credits for ads.
> 
> Do you think it's worth doing?

This sounds a lot like Ray Cromwell's program, "decense".  It's more or less
the web equivalent of the penet remailer.  It is possible to attack even if
requests and responses are encrypted with traffic analysis.  The main objective
of such a system would be to make it very difficult to match a "real" URL with
the "anonymous" one, but not virtually impossible.  Encrypting the site list
won't help because the key would have to be stored somewhere on the system.
Many web servers have a security hole in them where the source code for a
CGI script can be requested instead of actually executing the script.  It's
not a good idea to assume that the executable will not be readable by anyone.

Decense is available at http://www.clark.net/pub/rjc/decense.html

Mark
-- 
finger -l for PGP key
PGP encrypted mail prefered.
0xf9b22ba5 now revoked