UseNet with SSL

[Lacrimo]

Is it impossible - or far more likely obscenely difficult - to track down someone posting to UseNet with SSL encryption? Anyone around here that's poked around the newsgroups is probably aware of the blatant illegality of some of the posts. I've seen plenty of headers listing, without euphemism, child porn and alt.suicide.methods is interesting to say the least.

Could the police force theoretically get some IPs if they devoted enough resources, or is it just impossible?

[thedotmaster]

IP addresses are logged, so yes, very easily.
SSL just means that browsing cannot be eavesdropped on (well, it can be, but it's near impossible to decrypt).

[myhexhax]

It depends what sort of logs your usenet provider keeps (maybe contact giganews/etc regarding their log retention?) With the sheer number of people that use certain ones (and for 'privacy reasons'), they may not keep any. Or they may have all logs since the beginning of the service. Ask what their policy on the disclosure of those logs is (whether they require a court order/warrant/etc and if they have notification procedures upon disclosure or if they divulge it to arbitrary 3rd parties without informing you like Google)

Can they eavesdrop on the SSL encrypted tunnels? I don't think so (at least without cooperation of your usenet provider)
Can they tell that you are connected to a usenet provider over SSL? Most definitely.

They shouldn't be able to tell what headers you are downloading though.

[thedotmaster]

You can eavesdrop on SSL but you cannot read the contents. Get a copy of WireShark and see for yourself.
Most UseNet providers will keep logs. They will have to give those logs to the feds if they get a court order. Else they themselves get in trouble.

[Lacrimo]

So yes, this more or less falls into the category of "to much bureaucracy" for most any policing agency. Thanks; just trying to get better - if cursory - understanding of the system.

[djmounce553]

I would also guess that some of the people posting that type of stuff may be routing their traffic through an ephemeral proxy server so their IP wouldn't really mean much in the long run.