Online Privacy – Remailers

Remailers

Email anonymity is difficult to achieve because a user provides proof of their identity in the “From field” of a message and the header information contains the email address, the address of the ISP’s outgoing email server and other information.  For email to be anonymous this information must be removed from the message header.

A remailer is a service that allows a user to send email without revealing their name, e-mail address, IP address or the ISP used to the receiver or anyone who attempts to monitor the email traffic.  There are several flavors of remailers, each with their advantages and disadvantages

  • Pseudo Anonymous – This replaces the sender email address with a pseudonym before remailing it to the recipient.
  • Cypherpunk – This strips the sender’s email address from the message before remailing it to the recipient.  A consequence of this is that the recipient can’t answer the email.
  • Mixmaster – This sends messages in fixed sized packets that have been reordered to prevent messages being traced.  These remailers require that the user use special software to create the messages.
  • Mixminion – Similar to Tor, Mixminion messages are split into packets then sent via separate paths through the mix network.  Each packet is encrypted with the public key of each server in its path before it is sent.  At each server the packet is decrypted and the message re-ordered before being sent to the next server in the path.

Many remailers operate outside the United States and Europe to avoid the possibility of being forced to divulge customer information to law enforcement agencies.

Online Privacy – Anonymizers

Web browsing is a lot less anonymous than most people realize. Not only do many sites require their visitors to register, sites also track site visits via cookies. Traffic monitoring software can follow a person from site to site and monitor the pages visited on each site. This software also captures the IP address of the computer visiting the site which makes it relatively easy to find out the geographical location of the computer and which ISP was used to access the internet.

The United States government, like many other governments around the world, is increasingly likely to monitor a person’s online activities, ostensibly for stopping terrorism. However, the net is cast so wide that millions of law-abiding citizens are also caught in it. Government agencies are also increasing their ability to monitor online activity by tapping into the growing amount of consumer data collected by the private sector. This data collection is becoming more and more automated so increasing the odds of a person being tracked by a government agency even if their activities are completely innocent.

Anonymizers

An anonymizer can be used to help to hide a user’s presence on the internet. In general, free anonymizers work by acting as a proxy for the users by routing all requests and stripping off the header of each data packet, thereby making the request anonymous. The requested page is then fed through the anonymizer back to the web browser.

source:http://images.books2…179/f2601_0.jpg

Web-Based Anonymizers

Web-based anonymizers only protect web browsing and don’t support other web activities such as e-mail. To use this type of service a user first goes to the anonymizer web page and browses from there by entering the URLs to be visited.  This type of anonymizer is normally free and doesn’t normally support encrypted sites.

Proxy Anonymizers

A web proxy anonymizer acts as a proxy for users by routing all requests and replacing the user’s IP address in the header with that of the anonymizer server. Users configure their browser to use a proxy which sits between the user’s computer and the internet.  Socks proxies are another option.  These proxies can only be used with browsers that support the Socks protocol.  Most Socks proxy anonymizers are commercial and only mask a user’s IP address.  Many proxy anonymizers provide security by using SSH or SSL encryption.  Both web proxy and Socks proxy connections can be passed through an encrypted tunnel.

VPN Tunneling

VPN tunneling requires that a VPN client be installed that connects securely to the Anonymizer service provider.  Customers then have a choice of servers in different locations around the country or world from which to browse the web.  In this way customers browse the web from encrypted connections via constantly changing IP addresses.

Networked Anonymizers

Networked anonymizers route traffic through a network of internet servers between the request and the destination.  Tor (Torrential Onion Routing) is an example of a networked anonymizer.  It consists of a network of private user computers that act as relays for Tor messages. The Tor network is a daisy chained network of anonymizing proxies.  Instead of encrypting user traffic from end to end Tor creates a series of encrypted connections between the relays in the network.

Summary

Web-based and proxy anonymizers provide limited protection and are for the occasional surfer who is not too concerned about security.  A big disadvantage of free proxy anonymizers is that many of them use free proxy lists that log user activity.  VPN anonymizers provide much more secure surfing than web-based or proxy anonymizers by sending encrypted traffic from the user’s computer to the exit point server.  They also provide other services such as remailers (discussed in the next post) and user aliases for web-site registering.  A network anonymizer is similar to a VPN anonymizer in that traffic is encrypted but bounces traffic from server to server in its network to hide its origin before it finally leaves the at exit point.