First, I wanted to note I just wrapped up an effort that involved design review, and now I am beginning an effort that is primarily development. For whatever reason, writing code generally stops me from writing blog posts. (Almost every long period of silence on this blog stemmed from such times.) So, this is probably the last post for a while, unless I break from that trend.
Next, I thought it prudent to point out that I am not static and my view of the world does change. In particular, my current views on anonymity and pseudonymity may not mesh with everything I have said in the past. More so, I often use flawed language to talk about these concepts, although, internally, my logic may be consistent to me (see my previous post for an example of this, and see the second to last paragraph of this post for clarification).
Now, I have yet to figure it out, but people seem to get offended or irritated when I comment on anonymity and pseudonymity, and then I suffer through discussions of little merit blunted only by imperial pints of Guinness or gorgeous faces. This may become more so when I wonder out loud about things like showing ID in airports (thoughts about which seem to frighten people), but even the basic terminology seems to cause unhappy feelings among those that know of such things. Most of these people are quite bright and yet they seem to debate basics with me (much like these discussions about whether availability is part of security), so I wonder if the stupidity really lies with me.
Anyway, here I endeavor to explain myself with regards to actions, and anonymity and pseudonymity. I do so in a ramble, which might make labeling this as an explanation more of a pipe dream than a reality. Regardless, onward…
-
When it comes to anonymity and pseudonymity and my discussion here, I am talking from the perspective of actions, and, in particular, the unlinking of actions from the entities performing, or requesting to be performed, said actions. So, from that window, lets see what we can see.
With respect to actions, anonymity refers to the ability to take, or request to be taken, actions that cannot be linked to an entity as the originator of said actions. For my purposes here, anonymity can be thought of as having this core property – that actions cannot be linked to the entity that performed, or requested to be performed, said actions given knowledge of the actions and/or the entity but not the link between them. There are degrees of “cannot,” of course – we are not speaking in absolutes. For example, compare the degree of “cannot” when using a single proxy server to mask your IP from a web server versus using Tor to mask your IP from a web server. And, before someone points out that I have said nothing about recipients here, I treat the act of receiving as an action in and of itself – think dead drops.
For example, say you want sender anonymity in email, and you use a remailer chain as part of this goal. What is the action here that is to be anonymous? The act of sending the email from you to the recipient is to be anonymized such that the exit of your message from the remailer chain cannot be linked back to the entry of your message into that chain. Well, what does that action include? Simple enough – the sending of the message by the sender to the first remailer in the remailer chain, the progression of the message through said chain, and the message’s delivery to the recipient’s mail server from the final remailer in the chain.
Ok, so it should be noted that just because an action itself is anonymous does not mean the actions before and after that action are anonymous. Sticking with our email example, the entry into the remailer chain is not anonymous – this action can be observed and linked to the sender of the message.
It should also be noted that just because an action itself can be anonymous does not mean it has to be used for anonymity. Which also means that just because anonymity is possible does not mean it is a given. Back to our email example, the content of the message being sent anonymously may be in plaintext and contain, say, your home phone number. As such, the final remailer (and other observers) as well as the recipient can know who you, the sender, are.
Now, I don’t feel anonymity precludes the ability to tie actions together. Not knowing the entity performing an action is not the same as not knowing two actions are part of a particular sequence of actions, but it may be that this sequence of actions itself could be labeled as a distinct action. Back to the anonymous email example, the action of sending an email is composed of many actions, such as the hop from remailer to remailer through the chain. As distinct actions start to be bound together though, an identity begins to take shape and we cross over into the world of pseudonymity.
With respect to actions, pseudonymity refers to the ability to take, or request to be taken, actions that can be linked to an identity. For my purposes, pseudonymity can be thought of as having this core property – that an identity cannot be linked to the entity assuming that identity given knowledge of the entity and/or the identity but not the link between them. Like with anonymity, there are degrees of “cannot.” For example, if a trusted third party provides your pseudonym service, such as a webmail service like gmail, then perhaps a court order could be used to force that third party to reveal you as the owner of that pseudonym. Or, take IM services, which sometimes provide a searchable database to map names to pseudonyms.
Unlike with anonymity, the logic of coming to that core property of concern to us for pseudonymity is not necessarily transparent, so lets elaborate slightly. When we are dealing strictly with actions, pseudonymity is dealing with identities and actions taken by those identities. Since identities and actions are linked together, we can think of actions as indistinct from identities, and, thus, the disconnect between an entity and its actions must stem from a disconnect between an entity and its identity, from which reasoning that property is derived.
So, back to our email and remailer example, I may use a distinctive writing style and dedicated private key (to sign all my email messages from that nym) and then send it through a remailer chain, such that all messages can be fairly well established as originating from this nym, but mapping that nym back to me is difficult (assuming I don’t make it easy by, say, including my home phone number in such messages, or writing said messages in a style that clearly belongs to me, with me being the person behind the nym).
Clearly, pseudonymity does not mind actions being tied to an identity. In fact, this linking is a major reason pseudonymity is chosen over anonymity in many cases. History, reputation, and all those fun things are often quite important in the world and these can all be bound to an identity, even if that identity cannot be mapped back to an entity.
Now, you are probably saying something to yourself here – anonymity and pseudonymity seem like different ways of looking at the same thing, which, here, is unlinking actions from entities. True enough. From this actions perspective, I would go as far as to say pseudonymity and anonymity are equivalent. The reasoning is quite simple –
Anonymity says nothing about identity, it just unlinks actions from entities. Pseudonymity links actions to identities, but unlinks identities from entities. If an action is bound to an identity but that identity is not bound to an entity, then that action is not bound to an entity either. In other words, being pseudonymous is also being anonymous.
Going the other way, pseudonymity links identities to actions. As such, those actions themselves can be thought of as identities. (This can be illustrated by thinking of assigning a distinct action to each and every instance of an action.) With actions being identities, then the unlinking of actions from entities provided by anonymity is, in effect, pseudonymity.
With everything pseudonymous also anonymous, and everything anonymous also pseudonymous, anonymity and pseudonymity are one in the same; however, there is still a very important distinction here – anonymity knows nothing about identity, while pseudonymity is built from identity. If the identity behind actions is meaningless to you, then you are looking for anonymity in actions. Sure, this will also be pseudonymity, but the identities will be reduced to meaninglessness, which begs the question of why to even think about pseudonymity. And so on in the other direction. (Many people don’t agree with me here.)
(Such disagreements led to arguments over my comments on voting back in a post from over a year ago. While my language was poorly chosen and probably just plain wrong, I still think my point remains – pseudonymity is a more appropriate way to think of USA style voting than anonymity. Think “blind signatures for untraceable payments.” Or, via Emergent Chaos, look at kits put out there by Credentica. Or even just think about authorization of action as identity, like your driver’s license.)
Ok, so you are probably noticing something else – anonymity is often a building block in breaking the link between an identity and an entity, which is to say, anonymity is a tool for creating unlinkable pseudonyms. For example, creating and using a webmail account through Tor. The webmail account is pseudonymous, and accessing it through Tor helps to break the link between yourself and your webmail pseudonym.
And now you are asking yourself, why even talk about them separately? In fact, why point out actions as pseudonymous versus anonymous, when distinguishing between them seems by itself to be a contradiction? Easy – it comes down to goals and, by virtue, what perspective makes sense for those goals. If your goal is to do away with, or ignore, identity, then anonymity may be the most appropriate perspective – you want actions to be identities, or completely ephemeral pseudonyms. Other than that, pseudonymity is most likely the appropriate perspective. For example, generally speaking, Tor is anonymous, but web browsing is not. As such, generally speaking, Tor exit node operators should not maintain logs, but web site operators should. And, as a user of Tor browsing the web, these two realities can help to both set the user’s expectations and achieve that user’s goals.
Finally, you are probably realizing the most important point – pseudonymity is far more interesting than anonymity. In fact, you are probably recognizing that virtually everything you do in cyberspace is pseudonymous. You may even be thinking about how you use pseudonymity in meatspace as well. Good for you. We are now on the same page.
So here goes.