Slashdot Log In
Fling:Anonymous Protocol Suite
Posted by
CmdrTaco
on Mon Jul 10, 2000 09:23 AM
from the who-said-that? dept.
from the who-said-that? dept.
_endgame writes "Fling is a new suite of internet protocols that perform the function of DNS, TCP, and UDP in a manner that's both untraceable and untappable. Fling protects clients from servers, servers from clients, and both from an eavesdropper in-between. The result is that anyone can serve or retrieve any data, without fear of censure."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Don't Want To Be A Spoilsport But... (Score:5)
Wouldn't have been better to post this when there was actually news to report? Simply because someone has an idea and backs it up with a webpage does not a headline make.
PS: That said, I wish them luck.
Sounds Interesting - for possibly the wrong reason (Score:4)
One of the things that always strikes me as interesting about things like this is the posiblities for abuse. No - I'm not talking about things like trading warez, porn, MP3, or whatever the hot semi-illegal commodity of the week is.
I'm more interested in the possible effects for companies that keep wanting to do things like map out the Internet (see article last week here on /. about the group maping the 'net for advertising purposes) but don't want to really tick off admins who's machines they are adding to thier map. Same goes for script kiddies looking for machines (using nothing more than ping to see who responds) but want to keep from possibly alerting the admin at some company they are maping out.
Just a thought - I could, of course, be completely wrong!
Re:Don't Want To Be A Spoilsport But... (Score:3)
Re:Don't Want To Be A Spoilsport But... (Score:5)
...phil
Two problems... (Score:3)
In addition, crypto without a pre-arranged way to mutually verify both parties is trivial to crack. The NSA will certainly not mind you exporting this protocol overseas. :P But that is just a footnote to the above problem I mentioned. You can probably derive the encryption keys by monitoring the beginning of the conversation with the server and thus decrypt the contents of the packet(s). However, I am no expert in this, so I may be incorrect about being able to derive the keys - specifically, I know nothing about the duffie-hellmann(sp?) public key exchange stuff, beyond "it works", so YMMV.
The other problem I can see is that you're sending up a big red flag saying "Here I am! Look at me, I'm up to no good!" to your network administrators. Net admins are notoriously paranoid, moreso now with the proliferation of scripts. This means that if you use it at work, you stand a good chance of having your network access monitored/revoked and/or you getting your ass canned. Yeah! Go crypto!
The ideal protocol for this would be one where monitoring would a) do an attacker no good (which means you have to verify the authenticity of the server somehow before you communicate over the unsecured channel (the 'net)) and b) look like normal traffic. This is important - either you encrypt everything, even non-sensitive material, or you encrypt nothing and rely on stenography. I like stenography better myself.. and it'll become more important as governments crack down on conventional crypto - witness new zealand, I believe, which made it a law forcing you to divulge the keys of every encrypted thing on your system under penalty of jail.. even when they can't prove you ever had them!
Imagine an HTTP request to www.someplace.com where the downloaded JPEG contains the information requested and the POST contents contained the key+query. E-commerce cookies can easily look like crypto keys. Rewrite a few doubleclick cookies and no one will be the wiser.
In principle it's cool (Score:3)
Plus if my PC ends up routing mp3 files for other people using my 128k connection I wont exactly be pleased.
Added to this I would expect that there will be quite a reasonable bandwidth overhead given all the layers of encryption.
Certainly as a system for trading textual data it's reasonably sound but then usenet probaly works just as well for most people.
Added to this for a user to keep information persistantly on the network they still must be permanantly connected... which isn't really an option for opressed tibetan monks is it..?
Anti-tax philosophy (Score:3)
...phil
Re:Don't Want To Be A Spoilsport But... (Score:3)
Well, we're not really willing to simply *trust* that the law will protect us. We want to ensure that the scumbags can never be censored. If that happens, then we find upstanding citizens can also never be censored.
The rest of the world... (Score:3)
The economy is globalizing quickly, and daily interaction across the globe is paramount. So considering China just recently picked Linux over Windows95/98 because it can examine the source code to make sure there aren't any caveats that the US could use to sabotage them in a crisis, and on the other hand, the US is so paranoid about other countries being super-secretive that they delayed the release of Apple's G4 machine because it could perform well in encryption/decryption. Would the US allow China to have this Fling technology? Would it not try to stop certain countries (*cough* Iran, China, Lebanon, North Korea *cough*) from utilizing "super-secure" technology to transport data?
This project may be doomed to the "oh-that-was-a-neat-trick-but-where-is-it-now?" hall of fame from the start.
Re:Don't Want To Be A Spoilsport But... (Score:5)
In a word: Yes. We do. For the simple reason that there _is no way_ for any of us to exert our simple right to anonymity without having a way to pass round child porn too.
This is one of those circumstances where people will have to choose between a greater evil and a lesser evil. At risk of making myself very unpopular, I would suggest the evils that can come from denial of freedom of speech could be an awful lot worse than the evils coming from the hampering of one of the ways the police use to track down a class of particularly unpleasant criminals.
Put it this way: would you like every tiny piece of data about yourself in big government database, even though this would clearly help to catch many criminals, probably including some child pornographers? Supposing you didn't mind this. Now would you make it compulsory for _everyone_ to be in this database? That's what you're asking.
Supposing the goverment could identify the profile of a child pornographer with 90% accuracy from this data. So they imprison all the people with these characteristics. This is another way the government could reduce child porn, but few would argue that the benefits outweighed the drawbacks.
Re:Don't Want To Be A Spoilsport But... (Score:3)
It's more difficult than some people think. It's just as difficult as defining pornography. There's some people that know it when they see it. Funnily enough, to those people, nipples and clitorae are pornographic. To me, when I see guns, violence, and Microsoft Windows, those things look like pornography.
Without defining what a scumbag is, you cannot hope to censor them. If you misdefine what a scumbag is, then you'll certainly censor a person who doesn't deserve it.
The only solution is to allow all people to transmit, without censorship. We don't live in a safe society. The world is dangerous. Boo Hoo! All in all, I'd rather use my intellect to avoid or combat messages that I don't like. Every other animal has to use their feet to avoid a wolf's teeth that they don't like. What chance do the sheep have of ever "censoring" the actions of the wolves? None at all. The choice is clear: We can act like humans, using our brains to fight ideas we disagree with in an absolutely free forum, or we can act like animals and hope the wolf doesn't like the taste of woolly fleece.
Damned if you Do, Damned if you don't (Score:4)
Protection from criminal actions by governments, and more specifically criminals in governments, big business, financial instituations, etc. who use and write the "law" to protect their own limited criminal interests is vitally important. Equally, protection from individuals who use such protection to justify and protect their own individual thievery and rape of the creative elements in the society is important as well.
What we have is a war between the criminal elements that make up and contribute to the current internet and global culture. It is a war between criminal organisations who want to maintain their monopolies, and individuals who have been driven to criminal behavior by the rip offs in the world around them. It becomes a part of the culture. It is extraordinarily difficult to treat everyone you deal with with some sort of "code of ethics" or "code of honor" if you run into the argument that "only losers pay full price", as noted in a recent Salon Article; or you are trapped in the culture of "Net Slaves" [salon.com]
Falacies (Score:5)
- for i in `cat
/usr/dict/words`; do register $i; register $i.$i; done
And the internet is hereby mine!!! Muhahahaa.Re:This is JUST a theory... (Score:3)
Seriously, though, you need to reveal your IP address so the server can send back the information you requested. That's what servers do.
Overhead and untraceable protocols (Score:3)
Secure protocols will have more overhead because they need certain things beyond simply getting the data to the target. To avoid traffic pattern analysis you try to pad packets to fixed lengths, split streams up and send some junk so that bursts don't stand out, send dummy packets when traffic is low, and so on.
You need secure low level protocols to give yourself a fighting chance at anonymous exchanges. Running such protocols at a higher level over something that is essentially an end-to-end protocol just points out the path used to route the `crypted data. At that point the unfriendly government steps in and has you blocked or arrested.
The same technologies taht allow you to publish your anti-government newspapaer in a totalitarian state allow the distribution of porn and information on controlled substances. Sorry, information is information; differing states have declared diffeerent bits of information "bad" at times, the tools to supress one type can supress all types of information
As for Fling specifically, I noticed that it uses IP4 addresses putting it behind current tech. I'd like it better if it's internal addresses were larger than IP6.
Re:Don't Want To Be A Spoilsport But... (Score:3)
This is one of the weirder things about
I've seen this happen many times now, where a headline states that something cool is *going* to happen, but no posts when the thing *actually* happens.
Two issues (Score:5)
Ushers will eat latecomers.
Re:Pedophilia (Score:4)
Obviously kiddie porn inclus photos of 3 year olds involved in sex acts, but what about the other possible cases including:
*a 17 year old 45 year old man
* a 17 year old with an 18 year old man
* two 6 year olds holding hands
* a 4 year old swimming naked at the beach with his family
* a 6 month old taking a bath
* a 2 week old nursing at his mother's breast
You get the point. I remember how surprised I was when my very own grandmother demonstrated a suprising amount of anger at seeing a baby nursing at his mother's breast in a parenting magazing. She was absolutely of the opinion that it was pornographic - kiddie porn even.
So, how do you define those fringe cases? How can you reconcile your definition of kiddie porn with my grandmothers?
When I said that censorship should be absolutely banished, I meant it knowing the consequences. It means that kiddie porn will be uncensorable, and to prosecute it you'll have to actually catch people with it on their computers, or in production. You won't be able to catch it in transmission.
Freedom exacts a horrible price. The penalty in blood from wars and in cases like your example is very high. I am still of the opinion that the penalty of censorship is still higher.
Reinventing Onion Routing / Pipenet (Score:3)
I had trouble telling what the technical goals of the project were - are they addressing traffic analysis, or only protecting content? They're describing a bunch of complex shuffling, but don't indicate why they chose those methods and what attacks they're trying to protect against. Some of the earlier projects like Pipenet and Onion Routing found that there are theoretical weaknesses if you only send traffic when you have real traffic, or if you do anything that makes it possible for an eavesdropper to tell what the boundaries between messages are, because the eavesdropper can do enough correlation to identify reasonably accurately where the traffic is going. The alternative is to build connections between sites that always have constant traffic levels, using filler traffic when there's no real traffic. This has a major cost/performance impact that affects the willingness of servers to support this kind of application. By contrast, IPSEC gives you all the privacy you need by encrypting, but doesn't try very hard to block the user identification.
Privacy servers like this also depend on having lots of users - if there are only two people using it, it's easy to tell who's communicating with whom. It's nice to do technology, but you also need to work on a social or business model that encourages lots of people to run the client, and if it's got separate servers, to run servers as well. That's one of the cool things about Zero Knowledge [zks.net] - they've got a model that they hope will achieve this, though whether they succeed will depend on whether they implement it well enough for users to accept it and whether they can market it well enough to really take off. Some things are overnight successes - Hotmail, Napster - while others limp along at a low level for a long time, like the current remailer networks, mainly because they're annoying to administer and responding to complaints when they're abused is annoying. I wish the Fling folks good luck - but there's a lot of work they've got ahead of them to make it working and accepted.