From: UFLTAI%MEMSTVX1.bitnet@CUNYVM.CUNY.EDU
Date: Thu, 17 Dec 92 15:33:28 PST
To: cypherpunks@toad.com
Subject: abusing the system?
Message-ID: <9212172333.AA12866@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


Hiya,
        One of the newsgroups I was reading have this persistant "tester" who
uses the anon service in Finland.  Anyway, there were several different
postings, all with different ids, but same kinds of "this is a test, nyah nyah"
contents.
        As I was one of those "stop it" people, and seeing more of the same
bullshit by that guy, I got slightly pissed off, and started thinking.  Already
that person is using about 3 different anonymous ids.  If he is introduced to
the remailers here, conceivably he could generate more anonymous ids for
himself (ie, kill files won't work then, unless you want to kill a whole site)
by routing his mail thru the remailers.  Each remailer would give him another
userid at that anon service.  And if he uses it to loop back to the
remailers...  And then loop to that Australian anon service... and so on.  He
could "legitimately" have a hundred or so different anon_ids, from one original
userid.
        What if someone who realises this was to use that capability to post
some really "colorful" material to news?  Suddenly you have a hundred or so
weirdos posting "I want nude pictures of a gerbil, please" to alt.binaries.
pictures.erotica... you get the idea.  Is there anyway to stop this from
happening?  And this is on top of the real weirdos (ie, those who know how to
post anonymously, like most of the readers of this list... :))
        So far, the net has functioned as it's own sieve with regards to the
"weirdos" but if the remailers is generally available (as it should be!), the
potential for abuse is much much greater.  Any way to slow it down?  "Hey,
look, a flame war, let's join in..."
        Of course, if someone was to forge a mail to the anon service... don't
even need to know about the remailers...  but with forged mail, the anon
service can at least "check" to see the validity of your address.
        I realise that this is probably not important in the overall scheme of
things... but I am curious about what can be done to reduce such potential
abuse.
        Ciao.

-Tai
ps:  Any tips on tracing anonymous mail and newspostings?  I mean beyond the
"from" and "path" things... ie, trace to the userid...  Someone tried to forge
a posting in my name... (yes, that's what got me thinking :))