Anonymous Publishing is Dead

http://cryptome.org/2012/06/anon-pub-dead.htm

by thesteamboat • 14 years ago

257 160 14 years ago

stfu• 14 years ago

At least for the hosting part I guess he didn't search hard enough. Hosts like http://www.mediaon.com/ are accepting even cash via regular mail to start an anonymous website/register a domain.

aw3c2• 14 years ago

https://www.nearlyfreespeech.net/about/mailing seems to allow anonymity as well.

StavrosK2• 14 years ago

How? Don't checks have your name on them, or doesn't the bank know it?

biotech• 14 years ago

Looks like they don't (except under very specific circumstances which include not living within the USA)

https://www.nearlyfreespeech.net/about/faq#Anonymous

wwwtyro2• 14 years ago

1. Drive to coffee shop.

2. Change MAC address?

3. Create new account on Blogger/Tumblr/etc.

4. Publish.

No?

est• 14 years ago

In China coffee shop wifi requires citizen ID to use. At least in Beijing.

Yes fuck Chinese government, but 5 years later western governments will follow this way

naner• 14 years ago

That's oddly similar to network access in Ender's Game.

matt47112• 14 years ago

I was in Beijing a few days ago and in most of the restaurants/cafes I only had to ask the waiter for the wifi password. No id checks required.

Some of the "western" bars even have a vpn running so you can browse facebook when connecting to their wifi.

knowaveragejoe2• 14 years ago

Somehow doubt this will happen - as other posters pointed out, it's not even as strictly enforced as you make it sound.

yhczx• 14 years ago

Meh… It's not a good idea, but thanks to camcorders.

alister4• 14 years ago

> but 5 years later western governments will follow this way

I don't want to minimize the assault on our privacy and anonymity from all directions, but the one positive trend in the US and Canada has been toward less ID or no ID for using Internet cafes.

I remember the early days of Internet cafes in North America, and they very often wanted to see ID.

These days there are lots of public wifi hotspots, where at most they ask for an email address (a throwaway email address works fine). The purpose of collecting an email address appears to be CYA -- they get some assurance that you've agreed to their Terms and Conditions.

lifeguard6• 14 years ago

This would be problematic if there was not rampant corruption in China.

boscomutunga• 14 years ago

A coffee shop somewhere in africa would be ideal,

BlackNapoleon• 14 years ago

Would this work at starbucks?

knowaveragejoe2• 14 years ago

I don't see why it wouldn't.

gouranga5• 14 years ago

That works. There are shit loads of open WiFi networks in London as well. You could wardrive 10-15 of them in a few hours.

lifeguard6• 14 years ago

Your MAC will only be known to the router of the coffee shop and the router's MAC will only be know to their ISP's router/modem. The ISP MAC will be in the logs of all the servers you and other cafe customers access.

wwwtyro2• 14 years ago

Thanks, good to know.

cookiecaper4• 14 years ago

I don't think this is correct. The servers you connect will see an IP address only. This could only be converted into a MAC if the IP was resolvable locally via ARP (i.e., you're on the same LAN).

The danger of retaining your real MAC should be obvious; it's a unique identifier specific to your machine that will at least significantly narrow the scope of the machine/owner your adversaries are looking for if it doesn't give the investigators a direct link back to you (e.g., manufacturer records MAC addresses next to serial numbers, adversary gains access to manufacturer's data and sees "MAC X / Serial No Y sold to consumer Z online").

Depending on the configuration of the router on the open access points, it may be possible to retrieve a list of all connected MACs over the whole lifetime of the router. Then they simply have to correlate, "OK, which machines had a lease when the access from this machine was made?", and then investigate the 5 matches that come up.

This is not very safe, clearly.

EGreg2• 14 years ago

What about freenet?

The problem with anonymous publishing in a world where you have an authoritative server and DNS is clear. Some server is serving a file. And that server's operator apparently wants to know things.

What about uploading static content to various sites under free accounts?

The only difficulty is having DYNAMIC server generated content, i.e. executing programs to handle a request.

cookiecaper4• 14 years ago

freenet is probably the most reasonable alternative since the content is distributed amongst clients, and therefore there is no central point that can be "shut down" by governments. The downside, of course, is that almost no one will see your content on freenet (or a smaller darknet) and whether that still counts as "publishing" in the same sense as getting a publicly-available server connected to the internet. If you are doing something like WikiLeaks where you're really relying on normal news outlets to do the real legwork for you, this may be feasible, but if you aren't doing that for whatever reason, it practically would be the same as saving a text file to your hard drive -- i.e., no one, or almost no one, will ever read it.

EGreg2• 14 years ago

Yeah but as I said, you can upload your html to http://pastehtml.com and upload files to some free accounts, and references them. And bam, anonymous publishing. What's so hard?

weavejester4• 14 years ago

I don't know why the author dismisses Bitcoin as an anonymous payment mechanism. He says he doesn't "trust the blockchain to provide anonymity" but doesn't elaborate as to why.

mindslight3• 14 years ago

Perhaps because it's just a big list of who gave what to whom? sigh.

Karunamon• 14 years ago

All that the blockchain does is say that code UVW signed code XYZ. Tracing that to individual transactions is a lot tougher, especially considering that one person can have multiple randomly generated bitcoin wallets. Who's to say that when 123 signs 456 that he didn't pay for some service somewhere, as opposed to just sending coins to another wallet under his control?

There's no "who". There's a cryptographic hash that may or may not be under the control of a specific person at any given time. If you're smart, the only link an attacker can make is that you used your traceable money to purchase BTC sent to this wallet. Once that BTC leaves that wallet, the chain is broken, because you have no way of tying an identity to that second wallet.

judofyr• 14 years ago

> I don't know why the author dismisses Bitcoin as an anonymous payment mechanism.

As he said: "No bitcoin service accepts any anonymous funding source; most only accept bank transfers." The problem here isn't bitcoin per se, but the initial trading of bitcoin for USD.

Every bitcoin trade can be traced through the blockchain. So if he does use his true identity to buy bitcoins, they will be able find the seller. And you never know how easily the seller will reveal your identity…

crazygringo3• 14 years ago

Wow, I was under the mistaken impression that Bitcoin was anonymous, but researching it more, it's not really.

Does anyone know if this was a deliberate political choice in designing Bitcoin (so it wouldn't solely turn into a network for money laundering), or if there just wasn't any way to make the cryptography work for truly anonymous transactions that could still be verified?

weavejester4• 14 years ago

Once you buy an amount of bitcoins, you can trade those for other bitcoins of equal value from other individuals, or just swap the coins between temporary accounts you've created. Do this several times over the course of a few weeks or so and there's nothing to connect you back to the coins in your account.

kijin• 14 years ago

Most of the author's problems seem to have to do with purchasing and running a VPS anonymously. But why bother? Do you really need to run your own Tor hidden service on your own VPS in order to publish anonymously? What happened to all the free blogging and pastebin services where you can sign up and/or post anonymously? All you need is Tor Browser Bundle and some extra caution. You can stay as anonymous as Tor's security allows, and no money ever changes hands.

Sure, it will be easier for the powers that be to take down something you posted on Tumblr than to take down a Tor hidden service. But that's a completely different matter from publishing anonymously in the first place.

The author also seems to think that publishing images and videos anonymously is harder than publishing ASCII text anonymously. This may be right, but not because of the reasons he cites. If you already have a medium where you can publish ASCII text anonymously, nothing stops you from publishing your media in a base64-encoded form. The real problem with publishing images and videos anonymously is that those media files often contain lots of entropy that could help identify the author, such as location information. No amount of Tor trickery will keep you anonymous unless you thoroughly scrub your media files.

sedev4• 14 years ago

I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.

jrockway• 14 years ago

You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA.

But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause.

The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.

glogla• 14 years ago

Another possibility would be to get one of the little computers that plug into USB or power socket and can do wifi, sneak one into a cafe or somewhere else with open wifi, and run TOR hidden service on that. It will get found and destroyed in time, but for some time, it might work. Or maybe solar powered Rpi that you put on someone's roof?

I'm not sure how well TOR hidden service would work behind a NAT though.

EDIT: another way would be to go to the dark side, and get your own botnet.

ewillbefull• 14 years ago

> I'm not sure how well TOR hidden service would work behind a NAT though.

Just as well as tor works normally.

rorrr3• 14 years ago

> sneak one into a cafe

There are cameras everywhere. If they really want to find you, they will see your face.

rockyleal• 14 years ago

"media files often contain lots of entropy that could help identify the author, such as location information"

Please, please, explain this.

dkulchenko• 14 years ago

As an example, take a photo with a relatively new digital camera and open the JPG up with an EXIF reader. In all likelihood, you'll see GPS coordinates, the exact time you took the picture, along with the unique identifier of your camera.

See http://en.wikipedia.org/wiki/Exchangeable_image_file_format#....

alister4• 14 years ago

Hidden image data in photos that I know about:

(1) Exif meta-data (Exchangeable image file format) which are things like resolution and dates, but can include serial numbers as well. Here's a handy list of cameras (usually high-end ones) that betray your privacy by embedding a serial number:

http://www.stolencamerafinder.com/listmodels

(2) IPTC meta-data (International Press Telecommunications Council), though I have yet to see a photo "in the wild" that uses it.

(3) XMP meta-data (Adobe Extensible Metadata Platform). This is added by Photoshop for example. It's two long numbers (DocumentID and InstanceID) which are different for each image.

(4) DRM and anti-counterfeiting stuff that might be added by image editing tools. (Many color copiers do this in the case of paper prints, for example.)

lifeguard6• 14 years ago

Quick and dirty:

  cat imagefile | strings | less

To obfuscate meta-data in media files, use two different editors to covert file formats three times. eg Use Picasa to convert original to high quality jpeg, then use Gimp to convert jpeg to png

ori_b2• 14 years ago

I gathered that he wants to be able to host a site like wikileaks anonymously.

vasco• 14 years ago

Not breaking the law: Public library, ask to use the computer while someone else is using it with the excuse for it just taking a minute. (If they have logs, its the guy's name)

Breaking the law: Break into someone's house, use internet.

gouranga5• 14 years ago

Access is free at libraries in the UK.

Just crack their wep key :)

icebraining• 14 years ago

I can beat that: here in Portugal our main paid hotspot provider (PT) doesn't know how to secure them - free unauthenticated HTTPS access to everyone!

Coupled with a free VPN over port 443 and you can get access to the whole web.

wahnfrieden• 14 years ago

Libraries have cameras.

talaketu• 14 years ago

as this turd found out: http://www.dailymail.co.uk/news/article-2026267/Paul-Doug-Pe...

m_eiman• 14 years ago

No need to break in, just find an open WLAN.

cs702• 14 years ago

IMO the author is right: truly anonymous publishing is an unattainable goal for most people today, because they have little choice but to rely on one or more third parties to obtain all the layers of hardware and software necessary to publish online, and such third parties either cannot fully protect or ensure the protection of their anonymity or (more commonly) need to know the identity of their customers.

However, I disagree with the author about the impossibility of buying bitcoins anonymously. Bitcoins can be purchased anonymously via local dealers and over-the-counter venues. One sends cash along with a Bitcoin address; one gets bitcoins delivered to an address in the blockchain in return.

Examples: http://www.tradebitcoin.com/ , http://localbitcoins.com/ , http://bitcoin-otc.com/

jerguismi• 14 years ago

Also you can mix your bitcoins using some laundry service or web wallet. Of course then you have to trust the third party (mixer/anonymizer)

ps. I'm the author of localbitcoins.com, thanks for linking to it :)

sergeinono• 14 years ago

Yes and buy with bit instant

rictic• 14 years ago

If you're willing to wait and are willing to throw down some initial capital you can also mine bitcoins directly. Freshly mined bitcoins are difficult to impossible to trace (not even to the machine that mined them) (with small variation in anonymity depending on whether you mine using a pool, and I think whether you can assume that your enemy doesn't control the vast majority of bitcoin miners).

codesuela• 14 years ago

Here is how you do it:

Put on gloves

Stuff cash into an envelope

Send it to the guys at prq.se

???

Publish

crazygringo3• 14 years ago

As far as I know, it's impossible to anonymously pay for anything over the Internet.

He tried to use a prepaid credit card, paid for in cash, but since the PATRIOT act, prepaid credit cards only work in person (and not even always then).

You can't use prepaid credit cards online without supplying your address and SSN to the prepaid credit card provider first, which most prepaid card providers don't even support in the first place.

Question: doesn't Bitcoin provide for anonymous transfers? Or no?

jlgreco3• 14 years ago

Bitcoin transactions are all public. If you want to be safe, you have to use a laundry service, and I don't know how good those are.

Here is a thought though: what if you got a prepaid credit card in another country? I suspect somewhere in Europe would be your best bet.

Also, how would the card company know that the transaction was online? It would be shady as all hell, but couldn't the merchant open a cornerstore and ring up all the online orders as chips and a smoothly?

netcan• 14 years ago

I'm not an expert, but I think credit card companies themselves may be pretty unhappy with something like that. It's a tricky proposition in the first place, accepting CCs as an online (or even brick & mortar) merchant. You are effectively assuming some funky risk. Fraudulent transactions mostly your problem, at least more yours than the credit card company's, the bank's, the credit card owner's or even the fraudster's (in practical terms).

I wouldn't be surprised if by breaking or even nudging their rules comes with a high enough price to kill the whole thing. You would be open to being ripped off painfully and your merchant account would probably be shut down pretty fast.

fleitz3• 14 years ago

What you've described is essentially how credit card processing for online gambling works. Except it's shoe stores and other places that sell stuff similarly priced to what an online gambler might charge his card.

Sniffnoy3• 14 years ago

If you want to pay for something anonymously on the internet, you can use a prepaid gift card. It will generally be accepted just like a credit card (though there do seem to be exceptions). It doesn't require registering your address or SSN. Or at least not in the case of Vanilla Visa (they require, IIRC, a name and zip code, but there's nothing preventing you from faking those). You can't refill it, so you'll have to keep paying for new ones if you intend to do it a lot, but I guess that's the price.

crazygringo3• 14 years ago

You got lucky. Most sites won't let prepaid gift cards go through. For example, neither Amazon nor PayPal, IIRC. Vanilla Visa was exactly the one I had, that ran into the problem, and I'd even put in my name and ZIP on their web site.

The problem seemed to be the lack of a billing address -- what are you supposed to put? Nothing worked. On another site that processed their credit cards via PayPal, it didn't work either. I called PayPal customer service and they explicitly told me they don't support cards that don't provide a means to verify a valid billing address and 3-digit security code.

flatline3• 14 years ago

I used a prepaid VISA gift card online last week, without supplying any personal information whatsoever.

jonknee• 14 years ago

Prepaid American Express is pretty easy, you can call and give them an address, they don't ask for a SSN (many legitimate people won't have one). Just say that you're making an online purchase and need an address for verification.

fleitz3• 14 years ago

Not true, you'll likely have to go through a bunch of prepaid providers but there are certainly providers where all you have to provide is your postal code.

I run pretty much everything through these cards online to avoid fraud / identity theft issues and prefer the ones that are easiest to register for online purchases.

Bitcoin transfers are anonymous but not untraceable, eg. with enough circumstantial evidence surrounding the transfer you can be fairly certain who made it... if you use a wallet service then its not really anonymous at all if you have access to the wallet providers database.

sedev4• 14 years ago

This makes me think that an analog to steganography could be a fruitful direction for privacy efforts to take - not looking like nothing, but looking like something unremarkable. If I remember correctly, Tor is already working on something like this, but what if this concept permeated the whole stack?

systemizer• 14 years ago

I'm sure we could create an anonymous payment system, however, it would come with a lot of constraints. For example, everyone in the network would pay X dollars to be a part of the anonymous network. Each person cannot pay more than X dollars so that money is conserved. When a transaction is executed, use a service like PayPal to choose a random account and transfer the funds where they need to go.

Yes, this is very insecure for various reasons, and your credit card statement will show up with something you didn't actually buy, but, anonymous payments could be achieved.

Of course, you would have to access the service with Tor for it to be completely anonymous.

cabalamat• 14 years ago

In the UK you can get pay-as-you-go internet dongles. I'm not sure if you can buy them for cash in a shop, without ID.

gouranga5• 14 years ago

You can. Currys allow you to buy in cash.

gouranga5• 14 years ago

Replying to my own post here (the shame!) but it's relevant and hopefully slightly interesting:

You can purchase SIM cards from most supermarkets in the UK for around the £1-5 mark and a basic Nokia handset for £10-15. You can top these up using cash at any supermarket checkout with "topup vouchers".

If you top up £15 that gives you 100% unlimited O2->O2 calls and texts for a month.

I reckon with a one time pad system such as the one described at [1], it is the most reliable, anonymous, secure point to point country-wide messaging system that you can create and it's not expensive or complicated.

I might write the whole thing up as an experiment and hopefully I won't get chucked in jail for doing so!

[1] http://users.telenet.be/d.rijmenants/en/onetimepad.htm

rmc3• 14 years ago

Yes, but then they can trace it to where you exactly are. Makes it easy for yourself to get raided.

pavel_lishin• 14 years ago

That's true, but anonymousperson90 has specified that he was willing to use the phone in an "geographically ambiguous location", so he/she would probably willing to do so with an internet dongle as well.

TazeTSchnitzel2• 14 years ago

Drive somewhere. Use dongle. Throw away dongle.

tatsuke956• 14 years ago

There are two ways to do this from the perspective of a journalist.

The first, is to do as the author attempted: that is to find every way possible to hide your identity. It's a lot of work, and maybe impossible.

The second is to put yourself out there. Be a public figure, unafraid of what you are publishing. Allow people to know who you are and what you stand for. Use your fame to your advantage. Call me an optimist, but the powers that be will have a tough time keeping you quiet if you represent a populist movement. In fact, it's eventually to their advantage to support the cause if it's meaningful and popular enough; the game of politics is won by catering to the masses.

At the end of the day, if you want to be a muckraker you can't be scared to get in the muck. I realize there can be repercussions. But it's far easier to support a face than it is some anonymous text.

rmc3• 14 years ago

That presumes you get famous before you start publishing stuff.

martinkallstrom• 14 years ago

In the countries where investigative journalism would do most service to the public, putting yourself out there will get you jailed, beaten up or shot. Entire governments keep their reign in part by controlling media. And some organisations too, like the drug gangs in Mexico. One blogger was literally beheaded by a local Mexican gang. From this perspective it is more than a little naive to stipulate that "if you want to be a muckraker you can't be scared to get in the muck". The need for true anonymity is not fiction, it is very real in the world we live in, right now.

tatsuke956• 14 years ago

I'm not naive. I realize there are repercussions to it. It isn't unique in history, and I'm grateful people have and continue to do so.

When you're publishing things about the Mexican drug cartels, you have to expect that you're going to piss off the gangs. That's part and parcel with what you're doing. Unfortunately, it's sort of how progress is made; if you publish something and get jailed, beat up or even killed, that becomes part of your message. I'm not trying to sound flippant. It's reality. What passes for "anonymity" won't save you, and true anonymity makes it unlikely that what you publish can make a difference. Besides, did truly anonymous publishing ever really exist?

When it comes to getting your message out to make a difference (which I assume is the underlying point), fame and anonymity are opposite sides of the same coin. If you can't achieve one, you're best bet is to focus on the other.

rudiger• 14 years ago

What if you don't represent a populist movement and your views don't cater to the masses?

tatsuke956• 14 years ago

That's a good question.

Would you like it if people could anonymously publish and distribute hate speech? It's tricky.

I'm making an assumption, but in most scenarios it's the powerful few controlling the masses, and doing so through controlling the flow information.

aurelianito3• 14 years ago

Come on!

Just get a fake account in wordpress, blogger or whatever and post using a public wifi. They will do the hosting for you for free and you will be virtually untrackeable. If you need to publish some video, post it on youtube or a clone using the same procedure as before.

You can even use facebook for hosting (!) if you fake the email.

I really don't get why this guy needs to purchase a VPS to publish.

kennywinker3• 14 years ago

Most of these things are subject to being taken down at the whim of U.S. law.

That's a great way to get out a single message, like a video or a photo or document. If you wanted to publish regularly and develop a following, you wouldn't be able to do that on these sites without constantly being taken down and having to re-find your audience. I think that might be the kind of anonymous publishing he is talking about.

aurelianito3• 14 years ago

You are right. But you can use several different free hosts managed by different laws and it would be quite resilient.

javajosh6• 14 years ago

Really, what the OP really wants is unclear to me. Anonymity is one thing, but accessibility in the face of governmental restrictions (especially targeted, rather than general) is quite another.

fl3tch• 14 years ago

That could deanonymize you. Lots of public places have cameras. On the other hand, have you ever tried creating a Google/YouTube or Facebook accout over Tor? They want SMS verification. So you have to buy a prepaid phone somewhere and that store will likely have cameras too. It's more difficult than you think.

aurelianito3• 14 years ago

Just wear some makeup and a wig. Cameras will not be as important. Pay cash.

macspoofing• 14 years ago

Anonymous publishing isn't dead, but rather anonymous payment.

lifeguard6• 14 years ago

I sent this reply to cryptome:

Avoiding Echelon & DMCA

( response to http://cryptome.org/2012/06/anon-pub-dead.htm and I assume reader is in USA )

TL;DR: Emulate spammer ecom hosting techniques and/or look at the Privly project

To resist echelon style wire tapping one must use strong non-AES/DES crypto. Stego is a good idea, too. To resist DMCA style censorship and legal liabilities, publish on servers hosted in one of the BRIC countries (Brazil, Russia, India, China) -- China being the most resistant unless material is related to China. This should be a linux based webserver with a non-AES encrypted file system. Set up a ‘workstation’ in a different BRIC country than where you publish. For less technical people, a MS windows VPS is easiest -- just connect with a remote desktop client. Then run your tools in the remote environment to manage the publishing server. Or just run a ssh server on linux, perhaps with port forwarding. ALWAYS delete the 'workstation' VPS instance when you are finished and create a new one for each use. ISP’s do not retain this type of log data for long and constantly restarting the VPS makes it hard to track because MAC and IP address info can change.

To connect to your ‘workstaion’, start at an internet cafe outside of the district you live in. From there get an account at a Canadian ISP to be your VPN server. Avoid accessing this VPN server from the same cafe/place twice or within 20 miles of your home. Follow published VPN server setup howtos.

On the publishing server, create a fake but plausible cover website for the casual browser. Create a sub-folder that is not linked to or indexed and publish your content here. Hide your content using public key non-AES/DES algorithms with non-standard key length. Publishing with stego inside of image files is one example. Publish links to your stego encrypted files on public classified ad sites like craig’s list. Publish info on how to find the craigslist.org ads on forums your audience reads. Research ‘fast flux DNS’ as a way of mapping urls to your published content and/or use a publishing server that is configured via DHCP if possible. Configure the firewall to block all IP addresses on the 'anti-P2P' and government lists that are published.

Payment is tricky, but not impossible. Look into USPS international money orders as a form of payment. The longer a pre-paid cell phone number is active in the system, the more it is trusted by automated fraud services. Use your ‘workstation’ and pre-paid cell phones to create free email accounts as needed, avoiding major services like hotmail, yahoo, and google.

One could also publish by uploading stego’d pictures to a free porn site via one’s ‘workstation’. The high volume of porn traffic is useful chaff.

Ideally, boot your mobile PC from a Linux live CD and use that environment to work from. Any stored data should be on removable media that has a non-AES encrypted filesystem like Trucryp.

Consider hiring forum spammers to publish links to your content. These folks will not be picky about your debit cards or friendly to law enforcement.

Four layer encrypted connection diagram as proposed:

[mobile PC at cafe, vpn & remote desktop clients] >>> [VPN server at outside USA ISP] >>> [‘workstation’ VPS at BRIC ISP] >>> [publishing server at Chinese ISP]

Essentially each legal jurisdiction one crosses makes government action very difficult. Beware, government corruption can be exploited in these countries if your opponents have enough resources!

bamdad• 14 years ago

how about bitcoin based vps services ?

jsilence• 14 years ago

What happend to Freenet and I2P? They aren't dead, are they?

malandrew• 14 years ago

I think the key to doing anything where you want plausible deniability is not cleaning up after yourself, but in creating so much noise that it becomes cost and time prohibitive to establish your identity.

The more you clean up, the more little clues you forgot to wipe out stick out to a forensic investigator. The best shot you have is to produce so much noise that it requires hundreds of forensic investigators working full time to find evidence that you were there among the noise.

kaybe• 14 years ago

What would a "geographically ambiguous location" be? An airport or a train station, like in the Scotland Yard game maybe?[1]

[1] A team of players tryies to track down a solo player on a map with taxi, bus and subway lines. The solo player is invisible and has to give his location every five moves. The best place to be for this is on a subway station, because it means one can get away in many directions quickly.

lifeguard6• 14 years ago

I think author meant not from one's home, office, friend's home/office, or local star bucks.

stcredzero3• 14 years ago

Could someone create a TOR-like network using mobile devices connected to various WiFi networks? Flunkies could be hired to place and retrieve these devices.

marshray3• 14 years ago

You can use Tor on mobile devices.

I don't see much point in ensuring that all the nodes are on Wifi networks.

stcredzero3• 14 years ago

Well, for one thing, you could put the exit nodes on such devices.

One of the advantages of such devices is being somewhat proof against search warrants. (To use one café's Wifi, you might be next door or around the block on the next street.)

javajosh6• 14 years ago

What about writing a letter, with pictures and everything, and sending it to a bunch of people who then scan it with or without OCR and then post it online? There could even be a group of such people that, as a kind of public service, agree to do this. They could, for example, burn the original.

morsch2• 14 years ago

Better make sure your printer isn't leaking any identifiable data: https://www.eff.org/issues/printers

That's not a problem if your recipients are OCR'ing or transcribing the document and make sure the original is destroyed.

javajosh6• 14 years ago

Yeah, that's why you burn the original.

fleitz3• 14 years ago

Pastebin + Tor?

lsc2• 14 years ago

I wonder... is there anything like geocities anymore?

I mean, I'm thinking that the hosting costs would be close to zero. (now, the phishing prevention... that is probably effort directly in proportion to how anonymous you let the users be, and could be quite expensive.)

But yeah; Yahoo shuttered geocities while I was there. Is there anything analogous now?

Lagged2Death• 14 years ago

Angelfire and Tripod still exist.

jgamman• 14 years ago

create a honeypot ID and use that as a disposable cost of anonymity. i'm assuming that a suitably motivated person can find a passport and then create a persona around that. then you can use all the 'normal' channels but there is a name to go with them, a credit card, an email etc. the fact that it's not you is the whole point. i think it's shneir that said it's not identity that's important, it's intent...

HedgeMage• 14 years ago

Silly boy. You started with a centralized model, and with trying to set up a contract for ongoing service in another country, and you wonder why you failed at anonymity?

1) Choose a suitable pseudonym. Heinlein, Orson Scott Card, or Orwell references in the pseudonym get you extra cool points.

2) Generate a gpg key pair and publish the public key.

3) Write stuff. Sign said stuff with your private key.

4) Using Tor, free wifi four towns away, a small computer stashed in a coffee shop set to log in when you aren't there, or whatever methods make you feel safe, post the signed material to several dozen file sharing, pastebin, or other suitably public sites in several different countries.

5) If anybody cares about what you've written, it won't die there. It'll get passed on from person to person long after anybody gets it taken down from anywhere you originally posted.

guest• 14 years ago

niggah please http://artcrimes.org/

ideaoverload• 14 years ago

In Europe you can buy a prepaid phone card and use your mobile phone/modem to get online anonymously. Phones can be identified by IMEI id but you can physically hide the device or likely swap IMEI when needed using software. Not sure if other ways to remotely identify phone/modem exist.

sireat• 14 years ago

I may be thinking too old school, but isn't there some way of posting to newsgroups anonymously?

I realize access to binaries groups these days is 99% pay, but at least the stuff would be out there.

Anonymous Publishing is Dead

Related Stories