Re: [Sks-devel] GDPR (equine corpse)

[brent s.]

On 8/17/19 11:46 AM, Stefan Claas wrote:
> Anonymity is a very important point when one likes to communicate securely
> and anonymously!
> 
> For that purpose Anonymous Remailers with a Nym account are in service
> for many years. It requires on the users side that he / she is familiar
> with GPG, to create a Nym account.
> 
> http://is-not-my.name/
> 
> The Remailer Software itself (Mixmaster) is included in Linux distributions.
> Windows users have Mixmaster clients too. One only needs a free Usenet
> account to pick up messages from the News Group alt.anonymous.messages.

Except no, because now you aren't talking about email anymore, you're
adding an *additional* layer of complexity. Additionally, I'm talking
about a key with *no email address whatsoever*. Again, this is an OPSEC
issue. Your proposal still requires an additional external piece of PII,
as "anonymous" as it may be.

> 
> Then there are probably still free anonymous Tor email accounts available.
> 
> Another option would be to set-up an email to Bitmessage Gateway (like
> Mailchuck) so that GPG users can submit their keys from within the Bitmessage
> client to the key server via the email Gateway.
> 
> https://github.com/V07D/bitmessage-email-gateway

Again, see above. This is no longer email you're talking about. Further,
it still requires *a valid PII to validate the key reception*. Further
still, it creates an additional dependence on a third-party provider. No
bueno.

> 
> The other points you have mentioned, like the signer cannot upload a key,
> well that's true but I wonder how you guys like then to solve the problem
> with uploading flooded key material to the key servers. I think you can
> not have all options, but I am all ears.
> 
> Regards
> Stefan
> 

Hence the original discussion, yes. The only way to do it that I can
think if is one (or both) of:

- blacklisting keys, which makes the server peering *incredibly* more
complex (and, it can be made the case for, impossible) - if you were
following this mailing list for a while, you'd have seen us discuss this
very issue many, many times. For something like 8 months now. Check the
archives.

- heuristic analysis, which is always going to be faulty to some degree
and just ends up as a cat-and-mouse game.



-- 
brent saner
https://square-r00t.net/
GPG info: https://square-r00t.net/gpg-info

signature.asc
Description: OpenPGP digital signature