Crowds: anonymity for Web transactions

Reviewer: Valentin Cristea

The Crowds system implements a new approach to protecting users' privacy when they retrieve information on the Web. The approach is based on the idea of grouping Web users into a geographically diverse collection, called a crowd, and hiding each user's actions among the actions of many other members of the group. To execute Web transactions, a user first joins a group of users. The user's request to a Web server is transmitted by way of a simple randomized routing protocol, to protect the user against attackers. Several degrees of anonymity are defined, ranging from no anonymity to complete anonymity, with several interesting intermediate degrees. The design of the Crowds system is described, with emphasis on the measures it takes to defend against various attacks that result from the way the Web works. The performance, scalability, and limitations of the system are also presented. After the introduction, section 2 presents the anonymity goals of the system and introduces the notion of degree of anonymity. Three intermediate points in the anonymity spectrum are defined: beyond suspicion, probable innocence, and possible innocence. What Crowds does and does not achieve in terms of these degrees of anonymity is discussed. Based on these definitions, in the following section the authors compare Crowds with other approaches to anonymity. The basic Crowds mechanisms are described in section 4 with the help of graphs and pseudocode. The security of Crowds is analyzed in section 5, based on probabilities. The performance and scalability of the system are presented in the next two sections. Response latency as a function of path length, page size, and number of embedded images is presented using diagrams and an analytic model. Section 8 is devoted to crowd membership, and section 9 describes the user interface. The obstacles that firewalls present to wide adoption of Crowds are briefly presented in s ection 10. Section 11 contains conclusions. The organization of the topics is good, and the level of detail is suitable. The reference list includes both recent works and important older papers. This work may be useful to many people interested in Internet security and especially in how to hide their identity from the servers they access.