JAP -- ANONYMITY & PRIVACY

Responsibilities of Mix Operators

Due to the inherent insecurity of the Internet, all sent and received messages should be signed cryptographically.

Mix certificates

In the process of configuring your Mix with the MixConfig tool, you will create a cryptographic certificate that identifies your Mix and enables it to sign messages. This certificate must be sent to the operators of your neighbouring Mixes, and you must receive their certificates to get the Mixes connected. In the case of dynamic cascades, the certificate distribution is automatically done by the InfoService (but this is not fully functional yet). In a static configuration, you will have to exchange the certificates by e-mail or other means with the neighbouring Operators.

Trust

Certificates and keys itself don't provide communication security, as anyone who has a computer is able to create them. Therefore, so-called certificate infrastructures exist, where trusted authorities sign the certificates and keys of people or organisations that have proven their identity and the ownership of the certificate/key to them. Each Mix Operator has to decide which authorities he will trust. If you operate a first Mix, its certificate must be trusted by the JAP users as well. They need to, like in browsers, have the certificate of the authority that signed your certificate installed in their software. At the moment, the JAP-Team is, by default, the only trusted authority, and its certificate is included in the MixConfig tool, the Mix code, the JAP client and the InfoService. Soon you will be able to add or remove trusted authorities from/to the Mix configuration.

Certificates and keys are uniquely identified by their hash values, too. If you get a certificate from someone that is not signed by an authority you trust in, you can still verify if it is really his/her certificate by comparing the SHA1/MD5 fingerprint with the fingerprint he/she will tell you. This is, for example, the SHA1 fingerprint of the JAP-Team certificate:

4D CF 81 F5 92 4B 11 19 6B 44 2A CD 53 E2 46 E1 0D 9A 16 F6

Secure communication with the JAP-Team

The best way to contact us is by e-mail There is no need to encrypt messages for us, since we will not exchange any secret information. Signing your e-mails is no bad idea, though, as this will provide some transparency and reassurance in case of doubt. Here is the source of our PGP key and it's fingerprint (this key is optional and only for e-mail communication and has nothing to do with the Mix network):

http://anon-inf.tu-dresden.de/jappgp.asc

B965 99E4 05EB 4202 895C 27DC D022 60C9 73EE 1DD1

If you do not know how to sign or how to check the signature of digital documents with PGP/GPG, you will find a short manual here.

If you don't trust this document itself you should confirm the key's fingerprint by some other means, e.g. calling us by phone. If you simply send us your public PGP or GPG key in an unsecured way (e.g. e-mail), we will also not trust it until it has been confirmed by some other means, like a phone call, or a signature by an authority we trust in.

Stable Version
00.10.003

Beta Version
00.10.020

Status of available AN.ON services and information about them.

Announcement: important update Within the next two weeks, we will release an important update for JAP/JonDo The update is essential, as changes in the payment protocol will otherwise lead to broken connections. Moreover, an error has been removed that may lead to broken connections or erroneous data transfers. We also added some important improvements regarding usability and stability of the program. (2008-05-09)

Stop SPAM CookieCooker scrambles cookies, manages your web accounts, protects against SPAM by using trash addresses and blocks (flash) advertisement.