Penet Remailer - Implementation

Implementation

Julf's remailer worked by receiving an e-mail from a person, stripping away all the technical information that could be used to identify the original source of the e-mail, and then remailing the message to its final destination. The result provided Internet users with the ability to send e-mail messages and post to Usenet newsgroups without revealing their identities.

In addition, the Penet remailer used a type of “post office box” system in which users could claim their own anonymous e-mail addresses of the form anxxxxx@anon.penet.fi, allowing them to assign pseudonymous identities to their anonymous messages, and to receive messages sent to their (anonymous) e-mail addresses.

While the basic concept was effective, the Penet remailer had several vulnerabilities which threatened the anonymity of its users. Chief among them was the need to store a list of real e-mail addresses mapped to the corresponding anonymous e-mail addresses on the server. A potential attacker needed only to access that list to compromise the identities of all of Penet’s users. The Penet remailer was on two occasions required by the legal system in Finland (the country where the Penet server hardware resided) to turn over the real e-mail address that was mapped to an anonymous e-mail address. Another potential vulnerability was that messages sent to and from the remailer were all sent in cleartext, making it vulnerable to electronic eavesdropping.

Later anonymous remailer designs, such as the Cypherpunk and Mixmaster designs, adopted more sophisticated techniques to try and overcome these vulnerabilities, including the use of encryption to prevent eavesdropping, and also the technique known as onion routing to allow the existence of pseudonymous remailers in which no record of a user's real e-mail address is stored by the remailer.

Despite its relatively weak security, the Penet remailer was a hugely popular remailer owing to its ease of anonymous account set-up and use compared to more secure but less user-friendly remailers, and had over 700,000 registered users at the time of its shutdown in September 1996.