[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] cleaner tables, lots of reformatting
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03
Modified Files:
econymics.bib econymics.pdf econymics.tex
Log Message:
cleaner tables, lots of reformatting
Index: econymics.bib
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.bib,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -d -r1.9 -r1.10
--- econymics.bib 16 Sep 2002 02:34:12 -0000 1.9
+++ econymics.bib 16 Sep 2002 17:39:33 -0000 1.10
@@ -39,6 +39,13 @@
year = 1998
}
+@Book{fudenberg-tirole-91,
+ author = {Drew Fudenberg and Jean Tirole},
+ title = {Game Theory},
+ publisher = {MIT Press},
+ year = 1991
+}
+
@InProceedings{mix-acc,
author = {Roger Dingledine and Michael J. Freedman and David
Hopwood and David Molnar},
@@ -74,6 +81,15 @@
month = {February}
}
+@Article{rubinstein-82,
+ author = {Ariel Rubinstein},
+ title = {Perfect Equilibrium in a Bargaining Model},
+ journal = {Econometrica},
+ year = 1982,
+ volume = 50,
+ pages = {97-110}
+}
+
@InProceedings{Serj02,
author = {Andrei Serjantov and George Danezis},
title = {Towards an Information Theoretic Metric for Anonymity},
@@ -207,4 +223,3 @@
publisher = {Springer Verlag, LNCS 2009},
note = {\url{http://citeseer.nj.nec.com/syverson00towards.html}}
}
-
Index: econymics.pdf
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.pdf,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -d -r1.1 -r1.2
Binary files /tmp/cvsnrbzpd and /tmp/cvsIw22dh differ
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.24
retrieving revision 1.25
diff -u -d -r1.24 -r1.25
--- econymics.tex 16 Sep 2002 08:29:53 -0000 1.24
+++ econymics.tex 16 Sep 2002 17:39:33 -0000 1.25
@@ -493,25 +493,32 @@
systems.
Consider a set of $n_{s}$ agents interested in sending anonymous
-communications. Imagine that there is only one system which can be used
-to send anonymous messages, and one other system to send non-anonymous
+communications. Imagine that there is only one system which can be used to
+send anonymous messages, and one other system to send non-anonymous
messages. Each user has three options: only send her own messages through
the mix-net; send her messages but also act as a node forwarding messages
from other users; or don't use the system at all (by sending a message
without using the mix-net, or by not sending the message at all). Thus
-initially we do not consider the strategy of choosing to be a bad
-node, or additional honest strategies like creating and receiving dummy
-traffic. We represent the game as a simultaneous-move, repeated-game
-because the large number of participants, plus the fact that earlier
-actions indicate only a weak commitment to future actions [elaborate],
-suggest against using a sequential approach \textit{a la} Stackleberg.
-[cite]
-With a large group size there might be no discernable nor agreeable order
-for the actions of all participants, so actions can be considered
-simultaneous. The limited commitment produced by earlier actions allow us to
-consider a repeated-game scenario. We also imagine that the need to send a
-message at each period is high enough that a ``war of attrition'' framework
-is not applicable. [briefly explain war of attrition]
+initially we do not consider the strategy of choosing to be a bad node, or
+additional honest strategies like creating and receiving dummy traffic. We
+represent the game as a simultaneous-move, repeated-game because of the large
+number of participants, plus the fact that earlier actions indicate only a
+weak commitment to future actions. With a large group size there might be no
+discernable nor agreeable order for the actions of all participants, so
+actions can be considered simultaneous. The limited commitment produced by
+earlier actions allow us to consider a repeated-game scenario.\footnote{%
+In Section \ref{sec:model} we have highlighted that for both nodes and
+simpler users variable costs are more significant than fixed costs.} These
+two considerations suggest against using a sequential approach of the
+Stackelberg type.\cite[Ch. 3]{fudenberg-tirole-91} For similar reasons we
+also avoid a ``war of attrition/bargaining model'' framework.\footnote{%
+Wars of attrition and bargaining games (see for example \cite{rubinstein-82})
+are timing games where the relative impatience of players plays an important
+role. We have seen in the previous Section and we will confirm again below
+that agents with high sensitivity to anonymity actually have an interest in
+being among the (first and few) nodes in the system. %Hence a timing game
+%approach does not seem appropriate in our scenario.
+}
\subsection{Adversary}
@@ -525,11 +532,11 @@
nodes being compromised --- all nodes not run by the agent are assigned the
same probability of being compromised. This factor influences their
assessment of the anonymity of messages they send. A purely passive
-adversary is unrealistic in most settings, e.g., it assumes that
-hostile users never selectively send messages at certain times or
-routes, and nodes and links never selectively trickle or flood messages
-\cite{trickle02}. Nonetheless, a \emph{global} passive adversary is still
-quite strong, and thus a typical starting point of anonymity analyses.
+adversary is unrealistic in most settings, e.g., it assumes that hostile
+users never selectively send messages at certain times or routes, and nodes
+and links never selectively trickle or flood messages \cite{trickle02}.
+Nonetheless, a \emph{global} passive adversary is still quite strong, and
+thus a typical starting point of anonymity analyses.
\subsection{Honest agents}
@@ -542,19 +549,18 @@
at a time. We also assume that routes are chosen randomly by users, so that
traffic is uniformly distributed among the nodes. If a user decides to be a
node, costs increase with the traffic; we focus here on the traffic-based
-variable costs. Given that
-there are no active bad nodes (our adversary is restricted to watching
-messages), reliability is deterministically complete ($p_{r}=1$). We also
-assume that all agents know the number of agents using the system and the
-number of them acting as nodes, and that each specific agent's actions are
-observable. Furthermore, we initially assume that the type of an agent is
-publicly known (a high sensitivity type cannot pretend to be a low
-type). We later relax this assumption. We also assume that all agents
-perceive the level of anonymity in the system (based on traffic and number
-of nodes) the same way. Further, we imagine that both agent types use the
-system because they want to avoid potential losses from not being anonymous.
-This sensitivity to anonymity can be represented with the variable $v_{i}$,
-which we treat as uniformly distributed between 0 and 1.
+variable costs. Given that there are no active bad nodes (our adversary is
+restricted to watching messages), reliability is deterministically complete (%
+$p_{r}=1$). We also assume that all agents know the number of agents using
+the system and the number of them acting as nodes, and that each specific
+agent's actions are observable. Furthermore, we initially assume that the
+type of an agent is publicly known (a high sensitivity type cannot pretend
+to be a low type). We later relax this assumption. We also assume that all
+agents perceive the level of anonymity in the system (based on traffic and
+number of nodes) the same way. Further, we imagine that both agent types use
+the system because they want to avoid potential losses from not being
+anonymous. This sensitivity to anonymity can be represented with the
+variable $v_{i}$, which we treat as uniformly distributed between 0 and 1.
These assumptions let us reformulate the framework above in a simpler way.
The utility function can be re-written as:
@@ -564,10 +570,10 @@
-c_{s}a_{i}^{s}-c_{h}\left( n_{s},n_{h},n_{d}\right) a_{i}^{h}-c_{n}
\end{equation*}
-Thus each agent $i$ tries to \textit{minimize}
-the costs of sending messages and the risk of being tracked. $1-p_{a}\left(
-n_{s},n_{h},n_{d},a_{i}^{h}\right) $ is the probability that anonymity
-will be lost given the number of agents sending messages, the number of them
+Thus each agent $i$ tries to \textit{minimize} the costs of sending messages
+and the risk of being tracked. $1-p_{a}\left(
+n_{s},n_{h},n_{d},a_{i}^{h}\right) $ is the probability that anonymity will
+be lost given the number of agents sending messages, the number of them
acting as honest and dishonest nodes, and the action $a$ of agent $i$
itself. $v_{i}$ is the disutility an agent derives from its message being
exposed, assumed to be a continuous variable $v_{i}=\left[ \text{\b{v}},\bar{%
@@ -604,8 +610,7 @@
non-anonymously, or not sending it at all, depending on which option
maximizes the expected benefits or minimizes the expected losses.
Thereafter, we can simply compare the two other actions (being a user, or
-being also a node) to the locally optimal exit strategy.
-%\footnote{%
+being also a node) to the locally optimal exit strategy. %\footnote{%
%For example, sending an anonymous message might be so expensive, and sending
%it through a non anonymous channel so potentially costly, that the user
%might prefer not to send a message at all. We discuss again some more
@@ -627,7 +632,7 @@
Then if
\begin{gather*}
-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
\\
<-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right) \right)
-c_{s}
@@ -635,7 +640,7 @@
and
\begin{gather*}
-v_{i}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{i}^{h}%
-\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
\\
<-v_{i}-c_{n}
\end{gather*}
@@ -667,11 +672,11 @@
larger anonymity sets than asynchronous networks where traffic is divided
among the nodes). Nevertheless we can highlight the economic rationale
implicit in the above equation. In the first comparison agent $i$ is
-comparing the contribution to her own anonymity of acting as a node to
-the costs of doing so. Acting as a node dramatically increases anonymity,
-but it will also bring more traffic-related costs to the agent. Agents
-with high privacy sensitivity (high $v_{i}$) will clearly be more likely
-to accept the trade-off and become nodes.
+comparing the contribution to her own anonymity of acting as a node to the
+costs of doing so. Acting as a node dramatically increases anonymity, but it
+will also bring more traffic-related costs to the agent. Agents with high
+privacy sensitivity (high $v_{i}$) will clearly be more likely to accept the
+trade-off and become nodes.
\subsubsection{Strategic Agents: Simple Case}
@@ -687,15 +692,50 @@
about the other agents' types.
We can consider agent $i$ and agent $j$. Each agent will have to consider
-the other agent's reaction function in her decision process:
+the other agent's reaction function in her decision process. Let:
+
+\begin{equation*}
+A_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+2,n_{d},a_{w}^{h}%
+\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n}_{h}+2,n_{d}\right)
+\end{equation*}
+
+\begin{equation*}
+B_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
+\right) -c_{s}
+\end{equation*}
+
+\begin{equation*}
+C_{w}=-v_{w}-c_{n}
+\end{equation*}
+
+\begin{equation*}
+D_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d},a_{w}^{h}%
+\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+2,\bar{n}_{h}+1,n_{d}\right)
+\end{equation*}
+
+\begin{equation*}
+E_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d},a_{w}^{h}%
+\right) \right) -c_{s}-c_{h}\left( \bar{n}_{s}+1,\bar{n}_{h}+1,n_{d}\right)
+\end{equation*}
+
+\begin{equation*}
+F_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+2,\bar{n}_{h},n_{d}\right)
+\right) -c_{s}
+\end{equation*}
+
+\begin{equation*}
+G_{w}=-v_{w}\left( 1-p_{a}\left( \bar{n}_{s}+1,\bar{n}_{h},n_{d}\right)
+\right) -c_{s}
+\end{equation*}
+
+Then we can represent the payoff matrix as:
\begin{equation*}
\begin{tabular}{cccc}
{\tiny Player i / Player j} & $a_{j}^{h}$ & $a_{j}^{s}$ & $a_{j}^{n}$ \\
-$a_{i}^{h}$ & [see appendix for values - do not fit table yet] & ... & ...
-\\
-$a_{i}^{s}$ & ... & ... & ... \\
-$a_{i}^{n}$ & ... & ... & ...
+$a_{i}^{h}$ & $A_{i},A_{j}$ & $D_{i},B_{j}$ & $E_{i},C_{j}$ \\
+$a_{i}^{s}$ & $B_{i},D_{j}$ & $F_{i},F_{j}$ & $G_{i},C_{j}$ \\
+$a_{i}^{n}$ & $C_{i},E_{j}$ & $C_{i},G_{j}$ & $C_{i},C_{j}$%
\end{tabular}
\end{equation*}
@@ -706,12 +746,11 @@
other is honest or not, and how much he knows about the other player's
sensitivity to privacy. %extend
When $v_{i}>>v_{j}$ then equilibrium with free-riding can be sustained: the
-problem can be mapped to \cite{palfrey-rosenthal-89}.
+problem can be mapped to \cite{palfrey-rosenthal-89}.
%show proof with prob. distribition here, simplygfiy
-Also when the other agent's type is unknown the system can have
-equilibria with free-riding, under certain probability distribution over
-other player's type. This can be proved again following \cite
-{palfrey-rosenthal-89}.
+Also when the other agent's type is unknown the system can have equilibria
+with free-riding, under certain probability distribution over other player's
+type. This can be proved again following \cite{palfrey-rosenthal-89}.
\subsubsection{Strategic Agents: Multi-player Case}
@@ -723,24 +762,23 @@
the agents might tend not to use the trigger strategy. But then, more agents
will tend to deviate and the cooperative equilibrium might collapse.%
\footnote{%
-``Defection'' would be, for example, acting only as a user and refusing to be
-a node: the agents start realizing that there is
-enough anonymity in the system and they do not need to be a node any longer.
-But if too many agents act this way, the system might break down for lack of
-nodes, after which everybody would have to resort to non anonymous channels.
-A trigger strategy would punish an agent by making the system unavailable.
-Of course a high sensitivity user will also suffer itself because of
-this strategy
-[[extend on this]]} This can be seen as a public good with free-riding type
-of problem \cite{cornes-sandler-86}. Under which conditions will this not
+``Defection'' would be, for example, acting only as a user and refusing to
+be a node: the agents start realizing that there is enough anonymity in the
+system and they do not need to be a node any longer. But if too many agents
+act this way, the system might break down for lack of nodes, after which
+everybody would have to resort to non anonymous channels. A trigger strategy
+would punish an agent by making the system unavailable. Of course a high
+sensitivity user will also suffer itself because of this strategy [[extend
+on this]]} This can be seen as a public good with free-riding type of
+problem \cite{cornes-sandler-86}. Under which conditions will this not
happen?
-One of the interesting economic aspects of this scenario is that the
-highly sensitive agents \textit{do} want some level of free-riding, from the
-less sensitive types that will provide traffic and therefore noise. On the
-other side, they might not want too much free-riding if this involves too
-high traffic costs. This latter point however must be specified: highly
-privacy sensitive types, at parity of traffic, prefer to be a node (because
+One of the interesting economic aspects of this scenario is that the highly
+sensitive agents \textit{do} want some level of free-riding, from the less
+sensitive types that will provide traffic and therefore noise. On the other
+side, they might not want too much free-riding if this involves too high
+traffic costs. This latter point however must be specified: highly privacy
+sensitive types, at parity of traffic, prefer to be a node (because
anonymity and reliability will increase) and prefer to work in systems with
fewer nodes (otherwise traffic gets too dispersed and the anonymity sets get
too small). So, if $-v_{i}-c_{n}$ is particularly high, i.e. if the cost of
@@ -767,39 +805,37 @@
The problems however start if we consider now a different situation. Rather
than having a continuous distribution of evaluations $v_{i}$, we consider
-two types of agents: the agent with a high valuation, $v_{H}$, and the
-agent with a low valuations, $v_{L}$. Fudenberg and Levine \cite
-{fudenberg88} have a model where each player plays a set of identical
-players,
-each of which is ``infinitesimal'', i.e. its actions cannot affect the
-payoff of the first player. In this setup what we want to study is, instead,
-the concatenated interactions in a large but finite set of players.
-The approach in this case is to define the payoff of each player as the
-average of his payoffs against the distribution of strategies played by the
-continuum of the other players. In other words, for each type, we will
-have: $u_{H}=\sum_{n_{s}}u_{H}\left( s_{H},s_{-H}\right) $ where the
-notation represents the comparison between one specific $H$ type and all the
-others. We can assume that the $v_{L}$ agents will simply participate
-sending traffic if the system is cheap enough for them to use, and we can
-also assume that this will not pose any problem to the $v_{H}$ type, which
-in fact has an interest in having more traffic. This allows us to focus
-on the interaction between a subset of users: the identical high-types.
-Here the marginal argument discussed above will not work, and coordination
-might be costly especially when nodes do not trust each other. In this
-scenario where the mix-net system is self-sustaining and free and the agents
-are of high and low types, the actions of the agents must be visible and the
-agents themselves must agree on reacting together to respond to any
-deviation of a marginal player, thus re-establishing the trigger strategy of
-the 2-agents case. %{extend}
+two types of agents: the agent with a high valuation, $v_{H}$, and the agent
+with a low valuations, $v_{L}$. Fudenberg and Levine \cite{fudenberg88} have
+a model where each player plays a set of identical players, each of which is
+``infinitesimal'', i.e. its actions cannot affect the payoff of the first
+player. In this setup what we want to study is, instead, the concatenated
+interactions in a large but finite set of players. The approach in this case
+is to define the payoff of each player as the average of his payoffs against
+the distribution of strategies played by the continuum of the other players.
+In other words, for each type, we will have: $u_{H}=\sum_{n_{s}}u_{H}\left(
+s_{H},s_{-H}\right) $ where the notation represents the comparison between
+one specific $H$ type and all the others. We can assume that the $v_{L}$
+agents will simply participate sending traffic if the system is cheap enough
+for them to use, and we can also assume that this will not pose any problem
+to the $v_{H}$ type, which in fact has an interest in having more traffic.
+This allows us to focus on the interaction between a subset of users: the
+identical high-types. Here the marginal argument discussed above will not
+work, and coordination might be costly especially when nodes do not trust
+each other. In this scenario where the mix-net system is self-sustaining and
+free and the agents are of high and low types, the actions of the agents
+must be visible and the agents themselves must agree on reacting together to
+respond to any deviation of a marginal player, thus re-establishing the
+trigger strategy of the 2-agents case. %{extend}
In realistic scenarios, however, this will involve very high
transaction/coordination costs, and will require an extreme (and possibly
-unlikely) level of rationality on the side of the agents. One option
-to help reduce coordination costs is to maintain the distributed trust
-structure but centralize other elements of the system. We consider some
-other mechanisms that can make mix-net systems economically viable in
-the next section.
+unlikely) level of rationality on the side of the agents. One option to help
+reduce coordination costs is to maintain the distributed trust structure but
+centralize other elements of the system. We consider some other mechanisms
+that can make mix-net systems economically viable in the next section.
\section{Alternate incentive mechanisms}
+
\label{sec:alternate-incentives}
As the self-organized system might collapse under some of the conditions
@@ -807,18 +843,24 @@
alternative mechanisms.
\begin{enumerate}
-\item Usage fee. Imagine a scenario where each participant in the
-system has to pay. The public good with free-riding problem discussed
-above turns into a ``clubs'' scenario. Participating agents can elaborate
-a pricing mechanism related to how much they expect to use the system or
-how sensitive they are (which involves mechanism design and revelation
-mechanism [explain]). The Anonymizer offers
-basic service at low costs to low sensitivity types (there is a
-cost in the delay and the hassles of using the free service), and offers
-better service for money. With usage fees, the cost of being a node
+\item Usage fee. Imagine a scenario where each participant in the system
+has to pay. The public good with free-riding problem discussed above turns
+into a ``clubs'' scenario. Participating agents can elaborate a pricing
+mechanism related to how much they expect to use the system or how sensitive
+they are (which involves mechanism design and revelation mechanism).%
+\footnote{%
+A ``mechanism'' is a game where agents send messages and a certain
+allocation that depends on the realized messages (for a textbook
+introduction, see \cite{fudenberg-tirole-91}). The mechanism is designed to
+maximize the expected utility - for example of a ``principal'' agent.
+According to the revelation principle the principal can concentrate on
+mechanisms where all the agents truthfully reveal their types. } The
+Anonymizer offers basic service at low costs to low sensitivity types (there
+is a cost in the delay and the hassles of using the free service), and
+offers better service for money. With usage fees, the cost of being a node
is externalized, and then paid to some entity. A hybrid solution involves
distributed trusted mixes, supported through entry-fees paid to a central
-authority and redistributed to the nodes.
+authority and redistributed to the nodes.
\item Bilateral contracts. Bilateral or multilateral contracts between
agents can lead them to agree on cooperation and punishments for breaching
@@ -830,57 +872,54 @@
service. The risks here are congestion and non-optimal use \cite
{mackiemason-varian-95}.
-\item Public rankings and reputation. The incentives regarding reputation
+\item Public rankings and reputation. The incentives regarding reputation
can come in the form of wanting a higher reputation to get more cover
-traffic, but also as one of the rewards for the ``special agents''
-above. Just as the statistics pages for seti@home \cite{seti-stats}
-encourage more participation, publically quantifying and ranking
-generosity creates an incentive to participate. The incentives of public
-recognition and wanting to donate service for the public good are very
-important to consider, even if they don't fit in our model very well,
-because to date that's where most node operators come from.
-
-If we publish a list of mixes ordered by safety (based on number of
-messages each message is expected to be mixed with),
-the high sensitivity users will gravitate to safe mixes, causing
-more traffic, and improving their safety further (and lowering the safety
-of other nodes). Based on our model the system will stabilize with one
-or a few remailers. One reason it won't stabilize in reality is because
-$p_a$ is influenced not just by $n_h$ but also by jurisdictional diversity
---- a given high sensitivity sender is happier with a diverse set of
-mostly safe nodes than with a set of very safe nodes run in the same
-zone. Another reason it may not stabilize is that at some point latency
-will begin to suffer, and the low sensitivity users will go elsewhere,
-taking away the nice anonymity sets. (On the other hand, current Mixmaster
-use levels are nowhere near that point.)
+traffic, but also as one of the rewards for the ``special agents'' above.
+Just as the statistics pages for seti@home \cite{seti-stats} encourage more
+participation, publically quantifying and ranking generosity creates an
+incentive to participate. The incentives of public recognition and wanting
+to donate service for the public good are very important to consider, even
+if they don't fit in our model very well, because to date that's where most
+node operators come from.
-More generally, a mix that chooses a frequent batching time may get lots
-of messages from the low sensitivity people, and thus end up providing
-\emph{better} anonymity than one that fires only infrequently. Is a
-message from a high sensitivity sender ''better'' than a message from a
-low sensitivity sender? Certainly a dummy message which ends at a mix is
-''worse'' than a message that ends at an actual recipient.
+If we publish a list of mixes ordered by safety (based on number of messages
+each message is expected to be mixed with), the high sensitivity users will
+gravitate to safe mixes, causing more traffic, and improving their safety
+further (and lowering the safety of other nodes). Based on our model the
+system will stabilize with one or a few remailers. One reason it won't
+stabilize in reality is because $p_a$ is influenced not just by $n_h$ but
+also by jurisdictional diversity --- a given high sensitivity sender is
+happier with a diverse set of mostly safe nodes than with a set of very safe
+nodes run in the same zone. Another reason it may not stabilize is that at
+some point latency will begin to suffer, and the low sensitivity users will
+go elsewhere, taking away the nice anonymity sets. (On the other hand,
+current Mixmaster use levels are nowhere near that point.)
-\item Micropayments for service. Mojo Nation \cite{mojo} was a
-peer-to-peer design for robustly distributing resources (e.g. file
-sharing). It employed a digital cash system, called \emph{mojo}, to help
-protect against abuse of the system. In addition to the usual operations
-of publish and retrieve, users could also pay nodes to indirect traffic
-through them, both so they can participate in the system from behind NATs
-and so they can gain some measure of anonymity. Participants in the
-system pay mojo to other participants in exchange for a service that
-uses resources. Thus Mojo Nation reduces the potential for damage from
-resource flooding attacks. Further, this credit and reputation system
-allows the interactions to be streamlined based on trust built up from
-past experience.
+More generally, a mix that chooses a frequent batching time may get lots of
+messages from the low sensitivity people, and thus end up providing \emph{%
+better} anonymity than one that fires only infrequently. Is a message from a
+high sensitivity sender ''better'' than a message from a low sensitivity
+sender? Certainly a dummy message which ends at a mix is ''worse'' than a
+message that ends at an actual recipient.
-While Mojo Nation's currency design was a fascinating idea for building
-a stable economic ecosystem, the system ultimately fell apart due to
-more mundane concerns such as usability and lack of funding. Even if it
-had succeeded to the point of being able to offer anonymity services,
-though, there would have been many more problems to face. We detail some
-of these in the next section.
+\item Micropayments for service. Mojo Nation \cite{mojo} was a peer-to-peer
+design for robustly distributing resources (e.g. file sharing). It employed
+a digital cash system, called \emph{mojo}, to help protect against abuse of
+the system. In addition to the usual operations of publish and retrieve,
+users could also pay nodes to indirect traffic through them, both so they
+can participate in the system from behind NATs and so they can gain some
+measure of anonymity. Participants in the system pay mojo to other
+participants in exchange for a service that uses resources. Thus Mojo Nation
+reduces the potential for damage from resource flooding attacks. Further,
+this credit and reputation system allows the interactions to be streamlined
+based on trust built up from past experience.
+While Mojo Nation's currency design was a fascinating idea for building a
+stable economic ecosystem, the system ultimately fell apart due to more
+mundane concerns such as usability and lack of funding. Even if it had
+succeeded to the point of being able to offer anonymity services, though,
+there would have been many more problems to face. We detail some of these in
+the next section.
\end{enumerate}
\section{A few more roadblocks}
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/