From: Eric Hughes <hughes@soda.berkeley.edu>
Date: Sun, 28 Feb 93 09:58:36 PST
To: cypherpunks@toad.com
Subject: anon user on cypherpunks list
In-Reply-To: <9302281238.aa19179@penet.penet.FI>
Message-ID: <9302281755.AA13087@soda.berkeley.edu>
MIME-Version: 1.0
Content-Type: text/plain



I have changed the subscription name in the list to the "na" form, so
the immediate problem for cypherpunks is fixed.

But this problem will persist.  Many, if not most, mailing lists are
running automated list software and the address given in the
subscription request is the address added.  Even if the administrator
manually changes the entry, the old one can be added right back.
Mailing list software could be changed to notice penet anonymous
addresses, but don't hold your breath for that to be deployed soon.

There are two problems with the current anon@penet design that I see
as fundamental.  The first, widely discussed and the proximate cause
of the above problem, is automatic pseudonym generation.  The second
is ensured by the first and is subtler: the remailer does not allow
multiple pseudonyms per incoming email address.

Multiple pseudonyms allow compartmentalization and has two benefits.
The first benefit is unlinkability.  I have sometimes wanted to argue
both sides of an issue, but refrained because that is too confusing
for most to follow.  (The semiotics of "consistency/ignorability" and
"one mind/one opinion" are fascinating and, here, digressing.)  I
might also wish to argue in two completely different fora and not have
these seen as the same person.

For every reason you might want a pseudonym in the first place, you
might also want a "pseudonym from your pseudonym," especially if you
use it a lot.

The second benefit of compartmented identities happens when the
pseudonym is revealed, either by choice or by chance.  There are many
situations when a temporary identity might be desired; I leave it to
others to list them.  With the current single-pseudonym system, one
revelation of identity reveals all others.  When there is no
particular benefit to being seen as the same identity, I would rather
have multiple identities for exactly this reason.

As far as implementations go, having multiple pseudonyms requires that
a separate "request for pseudonym" be added, as well as a way to
indicate from which pseudonym (or none of them) mail should be from.
I would suggest bouncing mail to "an" style addresses unless a
pseudonym has been declared; the bounce message would, of course,
contain instructions on how to obtain a pseudonym or use the "na"
form.

Therefore, I would suggest that a second version of the pseudonymous
system at penet do away with automatic generation and support multiple
pseudonyms.

Eric