Popular Net anonymity service back-doored

[Thomas C. Greene]

Popular Net anonymity service back-doored
=46ed-up Feds get court order
http://theregister.co.uk/content/55/32450.html

The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and=
=20
goings across the Internet, has been back-doored by court order. The servic=
e=20
is currently logging access attempts to a particular, and unnamed, Web site=
=20
and reporting the IP addys of those who attempt to contact it to the German=
=20
police.

We know this because the JAP operators immediately warned users that their =
IP=20
traffic might be going straight to Big Brother, right? Wrong. After taking=
=20
the service down for a few days with the explanation that the interruption=
=20
was "due to a hardware failure", the operators then required users to insta=
ll=20
an "upgraded version" (ie. a back-doored version) of the app to continue=20
using the service.

"As soon as our service works again, an obligatory update (version 00.02.00=
1)=20
[will be] needed by all users," the public was told. Not a word about Feds =
or=20
back doors.

=46ortunately, a nosey troublemaker had a look at the 'upgrade' and noticed=
some=20
unusual business in it, such as:

"CAMsg:rintMsg(LOG_INFO,"Loading Crime Detection Data....\n");"
"CAMsg:rintMsg(LOG_CRIT,"Crime detected - ID: %u - Content:
\n%s\n",id,crimeBuff,payLen);"

and posted it to alt.2600.

Soon the JAP team replied to the thread, admitting that there is now a "cri=
me=20
detection function" in the system mandated by the courts. But they defended=
=20
their decision:

"What was the alternative? Shutting down the service? The security=20
apparatchiks would have appreciated that - anonymity in the Internet and=20
especially AN.ON are a thorn in their side anyway."

Sorry, the Feds undoubtedly appreciated the JAP team's willingness to=20
back-door the app while saying nothing about it a lot more than they would=
=20
have appreciated seeing the service shut down with a warning that JAP can n=
o=20
longer fulfill its stated obligation to protect anonymity due to police=20
interference.

Admittedly, the JAP team makes some good points in its apology. For one, th=
ey=20
say they're fighting the court order but that they must comply with it unti=
l=20
a decision is reached on their appeal.

Jap is a collaborative effort of Dresden University of Technology, Free=20
University Berlin and the Independent Centre for Privacy Protection=20
Schleswig-Holstein, Germany (ICPP). A press release from ICPP assures users=
=20
that JAP is safe to use because access to only one Web site is currently=20
being disclosed, and only under court-ordered monitoring.

But that's not the point. Disclosure is the point. The JAP Web site still=20
claims that anonymity is sacrosanct: "No one, not anyone from outside, not=
=20
any of the other users, not even the provider of the intermediary service c=
an=20
determine which connection belongs to which user."

This is obviously no longer true, if it ever was. And that's a serious=20
problem, that element of doubt. Anonymity services can flourish only if use=
rs=20
trust providers to be straight with them at all times. This in turn means=20
that providers must be absolutely punctilious and obsessive about disclosin=
g=20
every exception to their assurances of anonymity. One doesn't build=20
confidence by letting the Feds plug in to the network, legally or otherwise=
,=20
and saying nothing about it.

Justifying it after the fact, as the JAP team did, simply isn't good enough.

Telling us that they only did it to help catch criminals isn't good enough=
=20
either. Sure, no normal person is against catching criminals - the more the=
=20
merrier, I say. But what's criminal is highly relative, always subject to=20
popular perception and state doctrine. If we accept Germany's definition of=
=20
criminal activity that trumps the natural right to anonymity and privacy,=20
then we must accept North Korea's, China's and Saudi Arabia's. They have la=
ws=20
too, after all. The entire purpose of anonymity services is to sidestep sta=
te=20
regulation of what's said and what's read on the basis of natural law.

The JAP Web site has a motto: "Anonymity is not a crime." It's a fine one,=
=20
even a profound one. But it's also a palpably political one. The JAP projec=
t=20
inserted itself, uncalled, into the turbulent confluence between natural la=
w=20
and state regulation, and signaled its allegiance to the former. It's tragi=
c=20
to see it bowing to the latter. =AE

[Florian Weimer]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

"Thomas C. Greene " <thomas.greene@theregister.co.uk> writes:

> traffic might be going straight to Big Brother, right? Wrong. After takin=
g=20
> the service down for a few days with the explanation that the interruptio=
n=20
> was "due to a hardware failure", the operators then required users to ins=
tall=20
> an "upgraded version" (ie. a back-doored version) of the app to continue=
=20
> using the service.

This is technically incorrect. As far as I know, the client update is
completely unrelated.

The logging functionality has been implemented in the mixes
themselves, otherwise you would be able to circumvent it by using a
different client. The CVS commit occured on 2003-06-27. Logging is
implemented this way: if the last mix in the cascade (which sees the
request in the clear) detects a suspicious request, it is logged
together with an ID. The ID is transmitted (through the cascade) to
the first mix, which logs the ID and the IP address. Combining the
two log files, it is possible to collapse the cascade and backtrack
the requests. This exploits that TU Dresden operates both the first
and last mix in the Dresden--Dresden cascade (which is the only that
works reliably, AFAIK).

An employee of TU Dresden described this scheme in an interview with
Heise Online, a German online news site, back in October 2001. He
announced an implementation within the next six months, but I don't
know at the moment if he was speaking for the JAP project as a whole,
or if he was just expressing his own ideas.

According to the news sources I have read, the court requested
surveillance based on the target IP address. However, the source code
does not contain code to monitor specific (target) IP addresses, but
an elaborate URL screening facility, based on regular expressions.
Just by specifying ".*", it should be possible to log all requests
(and the corresponding IP addresses). I don't know why the source
code doesn't implement the surveillance based on IP addresses, as the
court allegedly requested.

> "What was the alternative? Shutting down the service? The security
> apparatchiks would have appreciated that - anonymity in the Internet
> and especially AN.ON are a thorn in their side anyway."

Note that this kind of target-based monitoring would be much harder on
the plain Internet unless the remote site is willing to cooperate. A
broken anonymizer makes this type of surveillance quite easy.

> But that's not the point. Disclosure is the point. The JAP Web site still=
=20
> claims that anonymity is sacrosanct: "No one, not anyone from outside, no=
t=20
> any of the other users, not even the provider of the intermediary service=
can=20
> determine which connection belongs to which user."

The official declaration ("Selbstverpflichtung") of the mixes, which
promises that neither logging will be enabled nor backdoors will be
implemented, hasn't been updated either.

However, perhaps the JAP team at TU Dresden hadn't much choice. I
haven't seen the court order, but I could imagine that they weren't
allowed to inform the users because it would have harmed the criminal
investigation. Following the order while fighting it within the legal
system is perhaps a wiser choice than just resisting it (and thus
breaking the law yourself). But I agree that it takes them awfully
long to update their web site, now that some information is public.

Finally, they could have avoided all the hassle if they hadn't
published the source code. Why did they publish? I don't believe
it's an accident.

For BUGTRAQ readers: Symantec strips message headers. The original
To: and Cc: are:

To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Cc: "Thomas C. Greene " <thomas.greene@theregister.co.uk>
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.2-cvs (GNU/Linux)

iQEVAwUBP0URumOpx4pWo0FrAQLTXQf/aJLMGYtvLpzbB8BtYNFqdoHEQlu/QUmv
gzouWH76cIL6zVJLK7eAM6nNI29itfOm/mJRfAJvU5B7FVAbFfPyhwEuBr4bUCYj
wkIwdM0tQihu+SBdIEIKdrSlfpNbstGJiKkQkPPpa2EREqqVYL adGk95KughJ1AG
f9HJzUG5jbPS/FEXrEYSqudJeVQPVPGUdmXbl0ayq8y2+AtZnk9NCJIFbXlBXf9 P
/zK+AoORdDl6t8fzKfUwi/qTu4qads/+eHklAbaKo2EyghjquKubTQdWpQodpt17
2CB/D25ULum2e8LWN6el2AW+PjkyaxeVBenKQV8Rw9Zv2JLenZsWrQ =3D=3D
=3DsN0C
=2D----END PGP SIGNATURE-----

[Andreas Kuntzagk]

Am Don, 2003-08-21 um 06.56 schrieb Thomas C. Greene :
> Popular Net anonymity service back-doored
> Fed-up Feds get court order
> http://theregister.co.uk/content/55/32450.html
....

Please see the news release of the AN.ON project:
http://www.datenschutzzentrum.de/mat...e/anonip_e.htm

"... Since it is not permissive to release information about current
proceedings according to German law, the project partners did not inform
the public at first. Based on the fact that the developed software has
been released in the source code since the beginning of the Open Source
Project, also the implemented recording function was of course released.
...."

Andreas

[MightyE]

Do you suppose that the JAP operators were under a court order to not
disclose that they were logging these attempts? The text you quoted
from the application simply screams LOOK AT ME, and may have been a
deliberate attempt to get someone to notice. They may have been ordered
to install the back door, not tell anyone about it, and not tell anyone
that they weren't allowed to talk about it. Once it was public
knowledge, however, they may have been able to discuss that there was
indeed a court order to this effect, but still perhaps forbidden from
discussing the limitations on talking about it. I'm not sure what
German law is, but it's also further possible that they were ordered to
bring the service back up with the back door in place, removing any
capacity for them to behave in the manner that you state they should have.

People who hold ideals like the JAP operators, and stick their necks out
for those ideals by doing things like offering anonymizing services
don't strike me as the sort of people who are given to compromise these
ideals given that they have any option on the matter. JAP operators are
not interested in sheltering criminals, and thus are not likely
interested in BEING criminals themselves when faced with a court order
requiring them to do something against their ideals.

-MightyE

Thomas C. Greene wrote:

>Popular Net anonymity service back-doored
>Fed-up Feds get court order
>http://theregister.co.uk/content/55/32450.html
>
>The popular Java Anonymous Proxy (JAP), used to anonymise one's comings and
>goings across the Internet, has been back-doored by court order. The service
>is currently logging access attempts to a particular, and unnamed, Web site
>and reporting the IP addys of those who attempt to contact it to the German
>police.
>
>We know this because the JAP operators immediately warned users that their IP
>traffic might be going straight to Big Brother, right? Wrong. After taking
>the service down for a few days with the explanation that the interruption
>was "due to a hardware failure", the operators then required users to install
>an "upgraded version" (ie. a back-doored version) of the app to continue
>using the service.
>
>"As soon as our service works again, an obligatory update (version 00.02.001)
>[will be] needed by all users," the public was told. Not a word about Feds or
>back doors.
>
>Fortunately, a nosey troublemaker had a look at the 'upgrade' and noticed some
>unusual business in it, such as:
>
>"CAMsg:rintMsg(LOG_INFO,"Loading Crime Detection Data....\n");"
>"CAMsg:rintMsg(LOG_CRIT,"Crime detected - ID: %u - Content:
>\n%s\n",id,crimeBuff,payLen);"
>
>and posted it to alt.2600.
>
>Soon the JAP team replied to the thread, admitting that there is now a "crime
>detection function" in the system mandated by the courts. But they defended
>their decision:
>
>"What was the alternative? Shutting down the service? The security
>apparatchiks would have appreciated that - anonymity in the Internet and
>especially AN.ON are a thorn in their side anyway."
>
>Sorry, the Feds undoubtedly appreciated the JAP team's willingness to
>back-door the app while saying nothing about it a lot more than they would
>have appreciated seeing the service shut down with a warning that JAP can no
>longer fulfill its stated obligation to protect anonymity due to police
>interference.
>
>Admittedly, the JAP team makes some good points in its apology. For one, they
>say they're fighting the court order but that they must comply with it until
>a decision is reached on their appeal.
>
>Jap is a collaborative effort of Dresden University of Technology, Free
>University Berlin and the Independent Centre for Privacy Protection
>Schleswig-Holstein, Germany (ICPP). A press release from ICPP assures users
>that JAP is safe to use because access to only one Web site is currently
>being disclosed, and only under court-ordered monitoring.
>
>But that's not the point. Disclosure is the point. The JAP Web site still
>claims that anonymity is sacrosanct: "No one, not anyone from outside, not
>any of the other users, not even the provider of the intermediary service can
>determine which connection belongs to which user."
>
>This is obviously no longer true, if it ever was. And that's a serious
>problem, that element of doubt. Anonymity services can flourish only if users
>trust providers to be straight with them at all times. This in turn means
>that providers must be absolutely punctilious and obsessive about disclosing
>every exception to their assurances of anonymity. One doesn't build
>confidence by letting the Feds plug in to the network, legally or otherwise,
>and saying nothing about it.
>
>Justifying it after the fact, as the JAP team did, simply isn't good enough.
>
>Telling us that they only did it to help catch criminals isn't good enough
>either. Sure, no normal person is against catching criminals - the more the
>merrier, I say. But what's criminal is highly relative, always subject to
>popular perception and state doctrine. If we accept Germany's definition of
>criminal activity that trumps the natural right to anonymity and privacy,
>then we must accept North Korea's, China's and Saudi Arabia's. They have laws
>too, after all. The entire purpose of anonymity services is to sidestep state
>regulation of what's said and what's read on the basis of natural law.
>
>The JAP Web site has a motto: "Anonymity is not a crime." It's a fine one,
>even a profound one. But it's also a palpably political one. The JAP project
>inserted itself, uncalled, into the turbulent confluence between natural law
>and state regulation, and signaled its allegiance to the former. It's tragic
>to see it bowing to the latter. ®
>
>
>
>

[Thomas C. Greene]

I agree that the dirty work has to be done on the proxy, but it's reasonable
to imagine that the client update was issued to maintain compatibility with
whatever was done to the proxy software. Maybe the two are unrelated as the
group says, but how can I trust them when they continue to soft-pedal the
security implications of the back door?

Yes, the code sort of shouts at you, and this may well be a deliberate heads
up. However, the group is still in denial, insisting that their service is
secure (see the press release linked in the Register story). It's not secure,
and claiming that it is taints anything else they may be doing on behalf of
users. They're *still* saying it's impossible for anyone to intercept users'
traffic or identify them. That simply isn't true.

It's likely were legally prevented from issuing a clear warning, which is why
I say they should have taken the service down in protest. I don't know
German law, but I'd be surprised if the courts can force you to provide a
communications service just so the Feds can use it.

Leaving a hint in the source and waiting for someone to call them on it may be
a legal strategem, but it's not a good way of maintaining user trust. It
took too long for this to become public. A better way to maintain trust
would be to stage a protest shutdown, or, if that's legally risky, a silent
shutdown and a subsequent leak to the press. No decent reporter would reveal
their source in a case like this, and approaching a journo based in another
country would add another layer of protection.

chrz,
t.

On Thursday 21 August 2003 11:38, Florian Weimer wrote:
> "Thomas C. Greene " <thomas.greene@theregister.co.uk> writes:
> > traffic might be going straight to Big Brother, right? Wrong. After
> > taking the service down for a few days with the explanation that the
> > interruption was "due to a hardware failure", the operators then required
> > users to install an "upgraded version" (ie. a back-doored version) of the
> > app to continue using the service.
>
> This is technically incorrect. As far as I know, the client update is
> completely unrelated.
>
> The logging functionality has been implemented in the mixes
> themselves, otherwise you would be able to circumvent it by using a
> different client. The CVS commit occured on 2003-06-27. Logging is
> implemented this way: if the last mix in the cascade (which sees the
> request in the clear) detects a suspicious request, it is logged
> together with an ID. The ID is transmitted (through the cascade) to
> the first mix, which logs the ID and the IP address. Combining the
> two log files, it is possible to collapse the cascade and backtrack
> the requests. This exploits that TU Dresden operates both the first
> and last mix in the Dresden--Dresden cascade (which is the only that
> works reliably, AFAIK).
>
> An employee of TU Dresden described this scheme in an interview with
> Heise Online, a German online news site, back in October 2001. He
> announced an implementation within the next six months, but I don't
> know at the moment if he was speaking for the JAP project as a whole,
> or if he was just expressing his own ideas.
>
> According to the news sources I have read, the court requested
> surveillance based on the target IP address. However, the source code
> does not contain code to monitor specific (target) IP addresses, but
> an elaborate URL screening facility, based on regular expressions.
> Just by specifying ".*", it should be possible to log all requests
> (and the corresponding IP addresses). I don't know why the source
> code doesn't implement the surveillance based on IP addresses, as the
> court allegedly requested.
>
> > "What was the alternative? Shutting down the service? The security
> > apparatchiks would have appreciated that - anonymity in the Internet
> > and especially AN.ON are a thorn in their side anyway."
>
> Note that this kind of target-based monitoring would be much harder on
> the plain Internet unless the remote site is willing to cooperate. A
> broken anonymizer makes this type of surveillance quite easy.
>
> > But that's not the point. Disclosure is the point. The JAP Web site still
> > claims that anonymity is sacrosanct: "No one, not anyone from outside,
> > not any of the other users, not even the provider of the intermediary
> > service can determine which connection belongs to which user."
>
> The official declaration ("Selbstverpflichtung") of the mixes, which
> promises that neither logging will be enabled nor backdoors will be
> implemented, hasn't been updated either.
>
> However, perhaps the JAP team at TU Dresden hadn't much choice. I
> haven't seen the court order, but I could imagine that they weren't
> allowed to inform the users because it would have harmed the criminal
> investigation. Following the order while fighting it within the legal
> system is perhaps a wiser choice than just resisting it (and thus
> breaking the law yourself). But I agree that it takes them awfully
> long to update their web site, now that some information is public.
>
> Finally, they could have avoided all the hassle if they hadn't
> published the source code. Why did they publish? I don't believe
> it's an accident.
>
> For BUGTRAQ readers: Symantec strips message headers. The original
> To: and Cc: are:
>
> To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
> Cc: "Thomas C. Greene " <thomas.greene@theregister.co.uk>

[Drew Copley]

Conscience wise, their only absolution I could see is if one of them
leaked this information to the Usenet under an assumed name. If I was in
this situation, I would do that. Maybe they did. Otherwise, they should
have spoken up and risked jail. How can you so deceive people otherwise?


Patriotism or the cause has nothing to do with it. If the government
wants to hack their criminals, let them find their own security holes.
If they want to tap their own wires, let them work this out with their
own people. But, if they want to trojanize software secretly, software
which has an international userbase... This is illegal outside of their
own nation.

German police have no jurisdiction in the US, for instance, just as the
US police have no jurisdiction in Germany -- apart from whatever
agreement Germany has made with the US regarding post-WWII treaties or
whatever.

Still, I do not think anyone would be pleased if it was found that the
NSA backdoored a US product. How much moreso of a problem would this be
if local police backdoored a system such as this anonymity system?

This kind of crime sends a message to would be hackers. It says that it
is okay to hack if the end is justified. Hackers, you may not have
jurisdiction in Germany, but if you are hacking pedophiles or Neo-Nazis,
they are law breakers, so your means must be okay. Do people really want
this? Can anyone really be trusted with this? Wouldn't they hit the
wrong people and make all sorts of bad mistakes for which they would not
be held accountable for?


> -----Original Message-----
> From: Andreas Kuntzagk [mailto:andreas.kuntzagk@mdc-berlin.de]
> Sent: Thursday, August 21, 2003 9:42 AM
> To: bugtraq@securityfocus.com
> Subject: Re: Popular Net anonymity service back-doored
>
>
> Am Don, 2003-08-21 um 06.56 schrieb Thomas C. Greene :
> > Popular Net anonymity service back-doored
> > Fed-up Feds get court order
> > http://theregister.co.uk/content/55/32450.html
> ...
>
> Please see the news release of the AN.ON project:
> http://www.datenschutzzentrum.de/material/them> en/presse/anonip_e.htm
>
> "... Since it is not permissive to release information about
> current proceedings according to German law, the project
> partners did not inform the public at first. Based on the
> fact that the developed software has been released in the
> source code since the beginning of the Open Source Project,
> also the implemented recording function was of course released. ..."
>
> Andreas
>
>

[Aron Nimzovitch]

Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
From: "Thomas C. Greene " <thomas.greene@theregister.co.uk>
Organization: The Register

Leaving a hint in the source and waiting for someone to call them on it may be
a legal strategem, but it's not a good way of maintaining user
trust.

Only a fool would blindly depend on someone else's software to gain
anonymity without examining the code. If you need anonymity, then you
should easily be willing to invest sweat equity, or have a contractual
arrangement when the threat is only financial. For more serious
threats requiring anonymity, not reviewing the source when it is
available seems beyond stupid. I could unserstand your ire if you
were one of our clients, but this was a free service wasn't it?

FAR

[Drew Copley]

> -----Original Message-----
> From: Aron Nimzovitch [mailto:crypto@clouddancer.com]
> Sent: Thursday, August 21, 2003 2:42 PM
> To: thomas.greene@theregister.co.uk
> Cc: fw@deneb.enyo.de; bugtraq@securityfocus.com;
> full-disclosure@lists.netsys.com
> Subject: Re: Popular Net anonymity service back-doored
>
>
>
> Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
> From: "Thomas C. Greene " <thomas.greene@theregister.co.uk>
> Organization: The Register
>
> Leaving a hint in the source and waiting for someone to
> call them on it may be
> a legal strategem, but it's not a good way of maintaining user
> trust.
>
> Only a fool would blindly depend on someone else's software
> to gain anonymity without examining the code.

Why stop at anonymity software?

What about all software?



>If you need
> anonymity, then you should easily be willing to invest sweat
> equity, or have a contractual arrangement when the threat is
> only financial. For more serious threats requiring
> anonymity, not reviewing the source when it is available
> seems beyond stupid. I could unserstand your ire if you were
> one of our clients, but this was a free service wasn't it?
>
> FAR


So, then, if I gave you free code which was trojanized for my own
interests, you deserve to be trojanized?

I fail to see the reasoning behind this.

Perhaps, in your isolating anonymity software from all other types of
software you have come up with this conclusion. But, that is an
artificial wall, so I do not see why that should even be considered.

In fact, this is a bit like me going around and beating people up and
then saying, "What a fool you are, you should have been working out two
hours a day every other day like I do".

Who reasons like this?

Look, if you don't want to condemn these actions, great. You have a
right to do that. Just be sure and don't condemn anyone if you ever run
their software and get trojanized because you did not bother to
carefully examine the source.

As for me, I will condemn this thing, as I would not do it to someone
else, and I would not like it to be done to me... Regardless of the type
of software it is.

What other software has the German police trojanized? Is it just this?

[Richard Stevens]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

first, let me make one thing clear, I think what happened is very bad. They=
=20
should have done anything else but secretly bug their system. But your logi=
c=20
is seriously flawed.

> German police have no jurisdiction in the US, for instance, just as the
> US police have no jurisdiction in Germany -- apart from whatever
> agreement Germany has made with the US regarding post-WWII treaties or
> whatever.

Very unpleasant for sure but also higlhly irrelevant. The people running AN=
=2EON=20
are German entities operating under German laws being situated in Germany.=
=20
They were the ones that received the court order so they had to do somethin=
g.=20
If there are international users or not is really highly irrelevant in this=
=20
case. Nobody claimed that German police or courts had juristiction in the U=
S.=20

> Still, I do not think anyone would be pleased if it was found that the
> NSA backdoored a US product. How much moreso of a problem would this be
> if local police backdoored a system such as this anonymity system?

Well, you can be sure, people are not pleased here, either. But do you real=
ly=20
think if american police or better yet the FBI would demand some kind of=20
tracking for an anonymizer in the US, they'd care about international users=
?=20
Maybe the individuals operating the anonymizer would react better but I'd b=
e=20
surprised if american law enforcement agencies wouldn't use similar measure=
s=20
if they could by law (not sure about american laws).=20

> This kind of crime sends a message to would be hackers. It says that it
> is okay to hack if the end is justified. Hackers, you may not have
> jurisdiction in Germany, but if you are hacking pedophiles or Neo-Nazis,
> they are law breakers, so your means must be okay. Do people really want
> this? Can anyone really be trusted with this? Wouldn't they hit the
> wrong people and make all sorts of bad mistakes for which they would not
> be held accountable for?

Not really. It's not a crime. You can argue about the correctness of their=
=20
decision to secretly implement this backdoor in an *anonymizer* instead of=
=20
standing up and tearing the service down. But following a valid court order=
=20
is not a crime. Even though I really don't like those laws but spying on=20
people seems to be hip after the events of Septembre 11th.=20

Regards,

Richard
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/RUkkCfA4EwqVdIQRAh7JAJ9Tgt7ZqhaQAuJ7eWt+bp0AlStjaA Cg7Hrc
W0PYxdAfEnCot0ORC2LlS+s=3D
=3D25Si
=2D----END PGP SIGNATURE-----

[Alex Russell]

On Thursday 21 August 2003 07:05, Thomas C. Greene wrote:
> I agree that the dirty work has to be done on the proxy, but it's
> reasonable to imagine that the client update was issued to maintain
> compatibility with whatever was done to the proxy software. Maybe the t=
wo
> are unrelated as the group says, but how can I trust them when they
> continue to soft-pedal the security implications of the back door?
>
> Yes, the code sort of shouts at you, and this may well be a deliberate
> heads up. However, the group is still in denial, insisting that their
> service is secure (see the press release linked in the Register story).

For them, the people that know the changes they made, they can still trus=
t the=20
system as much as they ever have. I have no doubt that for them it is as=20
secure as ever and I think that helps explain why they cling to this clai=
m.=20
You and I, however, don't have that advantage and therefore can't trust i=
t.

> It's not secure, and claiming that it is taints anything else they may =
be
> doing on behalf of users. They're *still* saying it's impossible for an=
yone
> to intercept users' traffic or identify them. That simply isn't true.

To the extent that you ever trusted this statement, it is still as true a=
s it=20
ever was. What has changed is more likely your realization that the syste=
m=20
relies on resources necessarialy beyond your control and inspection. If t=
heir=20
statement isn't true now, it wasn't true then.

> It's likely were legally prevented from issuing a clear warning, which =
is
> why I say they should have taken the service down in protest. I don't =
know
> German law, but I'd be surprised if the courts can force you to provide=
a
> communications service just so the Feds can use it.

I wouldn't be so suprised at such a ruling, although I'd really like to h=
ear=20
from someone with familiarity with German law.

> Leaving a hint in the source and waiting for someone to call them on it=
may
> be a legal strategem, but it's not a good way of maintaining user trust=
=2E=20
> It took too long for this to become public. A better way to maintain t=
rust
> would be to stage a protest shutdown, or, if that's legally risky, a si=
lent
> shutdown and a subsequent leak to the press. No decent reporter would
> reveal their source in a case like this, and approaching a journo based=
in
> another country would add another layer of protection.

If this is their proverbial cry for attention, then I kind of like the=20
strategy. Consider that with explicit external notification of any sort=20
(anonymous remailer, etc...), they are the ones taking action to subvert =
the=20
system intentionally. Assuming that the opponent in this situation is a=20
governmental entity with local physical enforcement power, then there's n=
ot a=20
lot of situations in which they can imagine being verifiably unobserved i=
n=20
making any kind of public statement. Putting this in a CVS commit, howeve=
r,=20
allows them to claim that they were just trying to comply (wink wink) and=
=20
doesn't run larger risks since there's nothing out of the ordinary to den=
y.

This doesn't mean I trust them, but it is probably one of the better ways=
for=20
them to subvert the order IMO.

Regards.

--=20
Alex Russell
alex@burstlib.net
alex@netWindows.org

[nordi]

On Thursday, 21. August 2003 14:05, Thomas C. Greene wrote:
> It's not secure, and claiming that it is taints anything else they may be
> doing on behalf of users. They're *still* saying it's impossible for anyone
> to intercept users' traffic or identify them.


Actually, this is absolutely not what they are saying. When you visit the
website of the JAP project http://anon.inf.tu-dresden.de/ it says in big, red
letters:

"Aus aktuellem Anlass weisen wir noch einmal ausdrücklich daraufhin, dass
sich die JAP Software in Entwicklung befindet und noch nicht maximale
Sicherheit bietet. (siehe unten ... )"

In English this means something like

"Due to recent events we explicitly inform you of the fact that the JAP
software is still being developed and does not yet provide maximum security.
(see below ...)"

As I said: big, red letters at the top of their main page. And when you click
that "see below" link it says there "Attention! [...] This version does NOT
yet implement the security features described above and desired by us. But it
does alread protect you against atackers that control the net only locally at
one place such as [...] the owner of a mix."

So by the time you download that software you should have already read _two_
statements telling you that JAP is not as secure as it could be. It also
tells you that in the current configuration, the JAP people can see all your
traffic if they want to: Note that it says it will protect you against "the
owner of _A_ mix". But if you take the Dresden-Dresden cascade, the JAP
people obviously control _all_ of them. And the above statement already
implies that in this case, JAP cannot protect you.


If you still want to use JAP,
http://www.heise.de/newsticker/data/uma-20.08.03-000/ (in German) tells you
how to do it securely: simply use just a single mix that is not controlled by
the JAP project and you'll be fine. The court order is only valid for the JAP
people, so everybody else in Germany (and elsewhere of course) can offer a
non-backdoored mix which will make the cascade secure. This actually means
that all cascades but the Dresden-Dresden one are secure.


MfG
nordi


--
Denn der Menschheit drohen Kriege, gegen welche die vergangenen wie armselige
Versuche sind, und sie werden kommen ohne jeden Zweifel, wenn denen, die sie
in aller Öffentlichkeit vorbereiten, nicht die Hände zerschlagen werden.
Bertolt Brecht, 1952

[Bernhard Kuemel]

Hi!

Aron Nimzovitch wrote:
> Only a fool would blindly depend on someone else's software to gain
> anonymity without examining the code. If you need anonymity,
> then you should easily be willing to invest sweat equity, or
> have a contractual arrangement when the threat is only
> financial. For more serious threats requiring anonymity,
> not reviewing the source when it is available seems beyond
> stupid.

And surely you would apply your opinion to any kind of
cryptography like pgp, ssl, etc. There are millions of users out
there who do not have the skills (programming, mathematics) to
verify such code. Calling them beyond stupid for that is
inappropriate. Blindly relying on software may be foolish, but if
you keep an open eye for warnings from those that have the skills
and do verify the code of popular software it is ok.

And - who guarantees that the code that is published is the same
that is used on the servers? So reviewing code only helps if you
compile and use it yourself or maybe in situations like remailer
chains you rely on the assumption that at least one remailer will
use the published code. But JAP IMO is not a chain of independent
systems.

Bernhard

--
Low end Serverhousing ab 25 e inkl. 1x 11 e/GB, etc.: http://bksys.at