Anonymous publishing and storage systems will have adversaries. The attacks and pressures that these adversaries employ might be technical, legal, political, or social in nature. The system’s design and the nature of anonymity it provides also affect the success of nontechnical attacks.
We now consider possible attacks on the Free Haven system based on their respective targets: the availability of documents and servnet operation, the accountability offered by the reputation system, and the various aspects of anonymity relevant to anonymous storage and publication, as described earlier in Section 12.2. For a more in-depth consideration of attacks, we refer to Dingledine’s thesis.
This list of attacks is not complete. In particular, we do not have a systematic discussion of what kinds of adversaries we expect. Such a discussion would begin with the most powerful adversaries possible, asking questions like, “What if the adversary controls all but one of the servers in the servnet?” and scaling back from there. In analyzing systems like Free Haven, it is not enough to look at the everyday, plausible scenarios—every effort must be made to provide security against adversaries more powerful than the designers ever expect, because in real life, adversaries have a way of being more powerful than anyone ever expects.
We’ve considered a wide variety of ways for adversaries to stop Free Haven or make it less effective, and some ways ...