Re: Remop inbreeding, or, the 'kidnap Len' attack

[Len Sassaman <rabbi@abditum.com>]

On Wed, 5 Mar 2003, Tim Haughton wrote:

> What say ye? Is any remailer user worth spending 2 years inside for?
> Away from you friends and family? Does a web of trust work here? Trust
> levels and so forth?

RIP is actually a rather mundane attack. On the scale of
government-sanctioned, openly legal attacks, it's nasty -- but if people
are serious enough about getting access to keys at all costs, (to the
extent that they would be willing to kidnap), you probably won't be
threatened with "two years inside". You'll have your toe nails removed, to
start.

I am sure that all of us would break under torture, threats or harm
against our families, and so forth. The reason that the "Kidnap Len
attack" could be so dangerous (as opposed to the "kidnap Len's loved ones"
attack), is that presumably a good number of you care about my well-being.
Sure, nabbing an individual remailer operator's spouse, sister, parent,
etc., might have a high probability of getting you his remailer's key --
but it only works on that one remop. You have to go through the steps for
each and every remop at once, or sequentially down the chain. It's
infeasible to pull off successfully.

If there were one person that a kidnaper could take, in order to influence
all of us, the attack then becomes feasible. Which is why we need to have
a diverse emotionally unattached group. Or have the determination and
resolve to sacrifice your fellow remops (who may also be your friends) if
necessary.

At this point, the "kidnap Len attack" isn't a threat we have to really
worry about. At some point, it may be. Remops need to ask themselves:
could you make a decision to destroy your keys rather than save the life
of another remop? If you can't, you may want to get out of the game.