12 ms·

Anonymous Publishing is Dead

257 points by thesteamboat 14y ago

stfu 14y ago
At least for the hosting part I guess he didn't search hard enough. Hosts like http://www.mediaon.com/ http://www.mediaon.com/ are accepting even cash via regular mail to start an anonymous website/register a domain.
- aw3c2 14y ago
  https://www.nearlyfreespeech.net/about/mailing https://www.nearlyfreespeech.net/about/mailing seems to allow anonymity as well.
  - StavrosK 14y ago
    How? Don't checks have your name on them, or doesn't the bank know it?
    - JoshTriplett 14y ago
      Cashier's checks and money orders would just have the merchant's name on them, or no name at all. You can purchase either one with cash.
      - StavrosK 14y ago
        Ah, thank you. That's pretty handy, too bad I'm not in the US.
  - biotech 14y ago
    Looks like they don't (except under very specific circumstances which include not living within the USA) https://www.nearlyfreespeech.net/about/faq#Anonymous https://www.nearlyfreespeech.net/about/faq#Anonymous
wwwtyro 14y ago
1. Drive to coffee shop. 2. Change MAC address? 3. Create new account on Blogger/Tumblr/etc. 4. Publish. No?
- est 14y ago
  In China coffee shop wifi requires citizen ID to use. At least in Beijing. Yes fuck Chinese government, but 5 years later western governments will follow this way
  - naner 14y ago
    That's oddly similar to network access in Ender's Game.
  - matt4711 14y ago
    I was in Beijing a few days ago and in most of the restaurants/cafes I only had to ask the waiter for the wifi password. No id checks required. Some of the "western" bars even have a vpn running so you can browse facebook when connecting to their wifi.
    - SoftwareMaven 14y ago
      Do you look western or Chinese?
      - matt4711 14y ago
        I'm western looking but they gave the password to anyone who asked (including locals)
  - knowaveragejoe 14y ago
    Somehow doubt this will happen - as other posters pointed out, it's not even as strictly enforced as you make it sound.
    - eschulte 14y ago
EGreg 14y ago
What about freenet? The problem with anonymous publishing in a world where you have an authoritative server and DNS is clear. Some server is serving a file. And that server's operator apparently wants to know things. What about uploading static content to various sites under free accounts? The only difficulty is having DYNAMIC server generated content, i.e. executing programs to handle a request.
- cookiecaper 14y ago
  freenet is probably the most reasonable alternative since the content is distributed amongst clients, and therefore there is no central point that can be "shut down" by governments. The downside, of course, is that almost no one will see your content on freenet (or a smaller darknet) and whether that still counts as "publishing" in the same sense as getting a publicly-available server connected to the internet. If you are doing something like WikiLeaks where you're really relying on normal news outlets to do the real legwork for you, this may be feasible, but if you aren't doing that for whatever reason, it practically would be the same as saving a text file to your hard drive -- i.e., no one, or almost no one, will ever read it.
  - EGreg 14y ago
    Yeah but as I said, you can upload your html to http://pastehtml.com http://pastehtml.com and upload files to some free accounts, and references them. And bam, anonymous publishing. What's so hard?
weavejester 14y ago
I don't know why the author dismisses Bitcoin as an anonymous payment mechanism. He says he doesn't "trust the blockchain to provide anonymity" but doesn't elaborate as to why.
- mindslight 14y ago
  Perhaps because it's just a big list of who gave what to whom? sigh.
  - Karunamon 14y ago
    All that the blockchain does is say that code UVW signed code XYZ. Tracing that to individual transactions is a lot tougher, especially considering that one person can have multiple randomly generated bitcoin wallets. Who's to say that when 123 signs 456 that he didn't pay for some service somewhere, as opposed to just sending coins to another wallet under his control? There's no "who". There's a cryptographic hash that may or may not be under the control of a specific person at any given time. If you're smart, the only link an attacker can make is that you used your traceable money to purchase BTC sent to this wallet. Once that BTC leaves that wallet, the chain is broken, because you have no way of tying an identity to that second wallet.
    - mindslight 14y ago
      Tracing mass flows, the concept of guilt by association, and general investigation say otherwise. Please take a look at the properties provided by a system based on http://en.wikipedia.org/wiki/Blind_signature http://en.wikipedia.org/wiki/Blind_signature for a perspective on the guarantees that Bitcoin lacks. (Unfortunately, such schemes require a Bank and are thus not practical for adoption. still it's instructive to see what other properties are actually possible rather than devolving into the technicalities of performing various degrees of untraceable btc transaction in the immediate future) It's really a matter of time until all exchanges routinely report their customers and a list is made of all the major above-board merchants. For the sake of the naive users, let's hope this is done openly rather than covertly. FINCEN has decades of experience tracing pseudonymous transactions.
kijin 14y ago
Most of the author's problems seem to have to do with purchasing and running a VPS anonymously. But why bother? Do you really need to run your own Tor hidden service on your own VPS in order to publish anonymously? What happened to all the free blogging and pastebin services where you can sign up and/or post anonymously? All you need is Tor Browser Bundle and some extra caution. You can stay as anonymous as Tor's security allows, and no money ever changes hands. Sure, it will be easier for the powers that be to take down something you posted on Tumblr than to take down a Tor hidden service. But that's a completely different matter from publishing anonymously in the first place. The author also seems to think that publishing images and videos anonymously is harder than publishing ASCII text anonymously. This may be right, but not because of the reasons he cites. If you already have a medium where you can publish ASCII text anonymously, nothing stops you from publishing your media in a base64-encoded form. The real problem with publishing images and videos anonymously is that those media files often contain lots of entropy that could help identify the author, such as location information. No amount of Tor trickery will keep you anonymous unless you thoroughly scrub your media files.
- sedev 14y ago
  I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.
  - jrockway 14y ago
    You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA. But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause. The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.
vasco 14y ago
Not breaking the law: Public library, ask to use the computer while someone else is using it with the excuse for it just taking a minute. (If they have logs, its the guy's name) Breaking the law: Break into someone's house, use internet.
- gouranga 14y ago
  Access is free at libraries in the UK. Just crack their wep key :)
  - icebraining 14y ago
    I can beat that: here in Portugal our main paid hotspot provider (PT) doesn't know how to secure them - free unauthenticated HTTPS access to everyone! Coupled with a free VPN over port 443 and you can get access to the whole web.
    - gouranga 14y ago
      Nice :) Good for you!
- wahnfrieden 14y ago
  Libraries have cameras.
  - talaketu 14y ago
    as this turd found out: http://www.dailymail.co.uk/news/article-2026267/Paul-Doug-Peters-Gmail-led-police-Madeleine-Pulver-fake-neck-bomb-suspect.html http://www.dailymail.co.uk/news/article-2026267/Paul-Doug-Pe...
- m_eiman 14y ago
  No need to break in, just find an open WLAN.
cs702 14y ago
IMO the author is right: truly anonymous publishing is an unattainable goal for most people today, because they have little choice but to rely on one or more third parties to obtain all the layers of hardware and software necessary to publish online, and such third parties either cannot fully protect or ensure the protection of their anonymity or (more commonly) need to know the identity of their customers. However, I disagree with the author about the impossibility of buying bitcoins anonymously. Bitcoins can be purchased anonymously via local dealers and over-the-counter venues. One sends cash along with a Bitcoin address; one gets bitcoins delivered to an address in the blockchain in return. Examples: http://www.tradebitcoin.com/ http://www.tradebitcoin.com/ , http://localbitcoins.com/ http://localbitcoins.com/ , http://bitcoin-otc.com/ http://bitcoin-otc.com/
- jerguismi 14y ago
  Also you can mix your bitcoins using some laundry service or web wallet. Of course then you have to trust the third party (mixer/anonymizer) ps. I'm the author of localbitcoins.com, thanks for linking to it :)
  - sergeinono 14y ago
    Yes and buy with bit instant
  - rictic 14y ago
    If you're willing to wait and are willing to throw down some initial capital you can also mine bitcoins directly. Freshly mined bitcoins are difficult to impossible to trace (not even to the machine that mined them) (with small variation in anonymity depending on whether you mine using a pool, and I think whether you can assume that your enemy doesn't control the vast majority of bitcoin miners).
    - lsc 14y ago
      Yeah; that was my first thought when the OP wanted to obtain bitcoins anonymously. Of course, getting access to compute power is probably easier for me than for most people, but eh, even so, it seems like the easiest way to go.
codesuela 14y ago
Here is how you do it: Put on gloves Stuff cash into an envelope Send it to the guys at prq.se ??? Publish
crazygringo 14y ago
As far as I know, it's impossible to anonymously pay for anything over the Internet. He tried to use a prepaid credit card, paid for in cash, but since the PATRIOT act, prepaid credit cards only work in person (and not even always then). You can't use prepaid credit cards online without supplying your address and SSN to the prepaid credit card provider first, which most prepaid card providers don't even support in the first place. Question: doesn't Bitcoin provide for anonymous transfers? Or no?
- jlgreco 14y ago
  Bitcoin transactions are all public. If you want to be safe, you have to use a laundry service, and I don't know how good those are. Here is a thought though: what if you got a prepaid credit card in another country? I suspect somewhere in Europe would be your best bet. Also, how would the card company know that the transaction was online? It would be shady as all hell, but couldn't the merchant open a cornerstore and ring up all the online orders as chips and a smoothly?
  - netcan 14y ago
    I'm not an expert, but I think credit card companies themselves may be pretty unhappy with something like that. It's a tricky proposition in the first place, accepting CCs as an online (or even brick & mortar) merchant. You are effectively assuming some funky risk. Fraudulent transactions mostly your problem, at least more yours than the credit card company's, the bank's, the credit card owner's or even the fraudster's (in practical terms). I wouldn't be surprised if by breaking or even nudging their rules comes with a high enough price to kill the whole thing. You would be open to being ripped off painfully and your merchant account would probably be shut down pretty fast.
    - jlgreco 14y ago
      Good point, I didn't take into account fraud on the part of the customers. The legitimate but non-US prepaid card is still something I think could work though. I tried googling about it and didn't really find anything at all though.
sedev 14y ago
This makes me think that an analog to steganography could be a fruitful direction for privacy efforts to take - not looking like nothing, but looking like something unremarkable. If I remember correctly, Tor is already working on something like this, but what if this concept permeated the whole stack?
systemizer 14y ago
I'm sure we could create an anonymous payment system, however, it would come with a lot of constraints. For example, everyone in the network would pay X dollars to be a part of the anonymous network. Each person cannot pay more than X dollars so that money is conserved. When a transaction is executed, use a service like PayPal to choose a random account and transfer the funds where they need to go. Yes, this is very insecure for various reasons, and your credit card statement will show up with something you didn't actually buy, but, anonymous payments could be achieved. Of course, you would have to access the service with Tor for it to be completely anonymous.
cabalamat 14y ago
In the UK you can get pay-as-you-go internet dongles. I'm not sure if you can buy them for cash in a shop, without ID.
- gouranga 14y ago
  You can. Currys allow you to buy in cash.
  - gouranga 14y ago
    Replying to my own post here (the shame!) but it's relevant and hopefully slightly interesting: You can purchase SIM cards from most supermarkets in the UK for around the £1-5 mark and a basic Nokia handset for £10-15. You can top these up using cash at any supermarket checkout with "topup vouchers". If you top up £15 that gives you 100% unlimited O2->O2 calls and texts for a month. I reckon with a one time pad system such as the one described at [1], it is the most reliable, anonymous, secure point to point country-wide messaging system that you can create and it's not expensive or complicated. I might write the whole thing up as an experiment and hopefully I won't get chucked in jail for doing so! [1] http://users.telenet.be/d.rijmenants/en/onetimepad.htm http://users.telenet.be/d.rijmenants/en/onetimepad.htm
    - petitmiam 14y ago
      and if the SIM has international roaming, it can be used in countries like Australia (where prepaid SIMs must be registered).
- rmc 14y ago
  Yes, but then they can trace it to where you exactly are. Makes it easy for yourself to get raided.
  - TazeTSchnitzel 14y ago
    Drive somewhere. Use dongle. Throw away dongle.
tatsuke95 14y ago
There are two ways to do this from the perspective of a journalist. The first, is to do as the author attempted: that is to find every way possible to hide your identity. It's a lot of work, and maybe impossible. The second is to put yourself out there. Be a public figure, unafraid of what you are publishing. Allow people to know who you are and what you stand for. Use your fame to your advantage. Call me an optimist, but the powers that be will have a tough time keeping you quiet if you represent a populist movement. In fact, it's eventually to their advantage to support the cause if it's meaningful and popular enough; the game of politics is won by catering to the masses. At the end of the day, if you want to be a muckraker you can't be scared to get in the muck. I realize there can be repercussions. But it's far easier to support a face than it is some anonymous text.
- rmc 14y ago
  That presumes you get famous before you start publishing stuff.
- martinkallstrom 14y ago
  In the countries where investigative journalism would do most service to the public, putting yourself out there will get you jailed, beaten up or shot. Entire governments keep their reign in part by controlling media. And some organisations too, like the drug gangs in Mexico. One blogger was literally beheaded by a local Mexican gang. From this perspective it is more than a little naive to stipulate that "if you want to be a muckraker you can't be scared to get in the muck". The need for true anonymity is not fiction, it is very real in the world we live in, right now.
  - tatsuke95 14y ago
    I'm not naive. I realize there are repercussions to it. It isn't unique in history, and I'm grateful people have and continue to do so. When you're publishing things about the Mexican drug cartels, you have to expect that you're going to piss off the gangs. That's part and parcel with what you're doing. Unfortunately, it's sort of how progress is made; if you publish something and get jailed, beat up or even killed, that becomes part of your message. I'm not trying to sound flippant. It's reality. What passes for "anonymity" won't save you, and true anonymity makes it unlikely that what you publish can make a difference. Besides, did truly anonymous publishing ever really exist? When it comes to getting your message out to make a difference (which I assume is the underlying point), fame and anonymity are opposite sides of the same coin. If you can't achieve one, you're best bet is to focus on the other.
aurelianito 14y ago
Come on! Just get a fake account in wordpress, blogger or whatever and post using a public wifi. They will do the hosting for you for free and you will be virtually untrackeable. If you need to publish some video, post it on youtube or a clone using the same procedure as before. You can even use facebook for hosting (!) if you fake the email. I really don't get why this guy needs to purchase a VPS to publish.
- kennywinker 14y ago
  Most of these things are subject to being taken down at the whim of U.S. law. That's a great way to get out a single message, like a video or a photo or document. If you wanted to publish regularly and develop a following, you wouldn't be able to do that on these sites without constantly being taken down and having to re-find your audience. I think that might be the kind of anonymous publishing he is talking about.
  - aurelianito 14y ago
    You are right. But you can use several different free hosts managed by different laws and it would be quite resilient.
  - javajosh 14y ago
    Really, what the OP really wants is unclear to me. Anonymity is one thing, but accessibility in the face of governmental restrictions (especially targeted, rather than general) is quite another.
- fl3tch 14y ago
  That could deanonymize you. Lots of public places have cameras. On the other hand, have you ever tried creating a Google/YouTube or Facebook accout over Tor? They want SMS verification. So you have to buy a prepaid phone somewhere and that store will likely have cameras too. It's more difficult than you think.
  - aurelianito 14y ago
macspoofing 14y ago
Anonymous publishing isn't dead, but rather anonymous payment.
lifeguard 14y ago
I sent this reply to cryptome: Avoiding Echelon & DMCA ( response to http://cryptome.org/2012/06/anon-pub-dead.htm http://cryptome.org/2012/06/anon-pub-dead.htm and I assume reader is in USA ) TL;DR: Emulate spammer ecom hosting techniques and/or look at the Privly project To resist echelon style wire tapping one must use strong non-AES/DES crypto. Stego is a good idea, too. To resist DMCA style censorship and legal liabilities, publish on servers hosted in one of the BRIC countries (Brazil, Russia, India, China) -- China being the most resistant unless material is related to China. This should be a linux based webserver with a non-AES encrypted file system. Set up a ‘workstation’ in a different BRIC country than where you publish. For less technical people, a MS windows VPS is easiest -- just connect with a remote desktop client. Then run your tools in the remote environment to manage the publishing server. Or just run a ssh server on linux, perhaps with port forwarding. ALWAYS delete the 'workstation' VPS instance when you are finished and create a new one for each use. ISP’s do not retain this type of log data for long and constantly restarting the VPS makes it hard to track because MAC and IP address info can change. To connect to your ‘workstaion’, start at an internet cafe outside of the district you live in. From there get an account at a Canadian ISP to be your VPN server. Avoid accessing this VPN server from the same cafe/place twice or within 20 miles of your home. Follow published VPN server setup howtos. On the publishing server, create a fake but plausible cover website for the casual browser. Create a sub-folder that is not linked to or indexed and publish your content here. Hide your content using public key non-AES/DES algorithms with non-standard key length. Publishing with stego inside of image files is one example. Publish links to your stego encrypted files on public classified ad sites like craig’s list. Publish info on how to find the craigslist.org ads on forums your audience reads. Research ‘fast flux DNS’ as a way of mapping urls to your published content and/or use a publishing server that is configured via DHCP if possible. Configure the firewall to block all IP addresses on the 'anti-P2P' and government lists that are published. Payment is tricky, but not impossible. Look into USPS international money orders as a form of payment. The longer a pre-paid cell phone number is active in the system, the more it is trusted by automated fraud services. Use your ‘workstation’ and pre-paid cell phones to create free email accounts as needed, avoiding major services like hotmail, yahoo, and google. One could also publish by uploading stego’d pictures to a free porn site via one’s ‘workstation’. The high volume of porn traffic is useful chaff. Ideally, boot your mobile PC from a Linux live CD and use that environment to work from. Any stored data should be on removable media that has a non-AES encrypted filesystem like Trucryp. Consider hiring forum spammers to publish links to your content. These folks will not be picky about your debit cards or friendly to law enforcement. Four layer encrypted connection diagram as proposed: [mobile PC at cafe, vpn & remote desktop clients] >>> [VPN server at outside USA ISP] >>> [‘workstation’ VPS at BRIC ISP] >>> [publishing server at Chinese ISP] Essentially each legal jurisdiction one crosses makes government action very difficult. Beware, government corruption can be exploited in these countries if your opponents have enough resources!
bamdad 14y ago
how about bitcoin based vps services ?
jsilence 14y ago
What happend to Freenet and I2P? They aren't dead, are they?
deleted 14y ago
[deleted]
malandrew 14y ago
I think the key to doing anything where you want plausible deniability is not cleaning up after yourself, but in creating so much noise that it becomes cost and time prohibitive to establish your identity. The more you clean up, the more little clues you forgot to wipe out stick out to a forensic investigator. The best shot you have is to produce so much noise that it requires hundreds of forensic investigators working full time to find evidence that you were there among the noise.
kaybe 14y ago
What would a "geographically ambiguous location" be? An airport or a train station, like in the Scotland Yard game maybe?[1] [1] A team of players tryies to track down a solo player on a map with taxi, bus and subway lines. The solo player is invisible and has to give his location every five moves. The best place to be for this is on a subway station, because it means one can get away in many directions quickly.
- lifeguard 14y ago
  I think author meant not from one's home, office, friend's home/office, or local star bucks.
stcredzero 14y ago
Could someone create a TOR-like network using mobile devices connected to various WiFi networks? Flunkies could be hired to place and retrieve these devices.
- marshray 14y ago
  You can use Tor on mobile devices. I don't see much point in ensuring that all the nodes are on Wifi networks.
  - stcredzero 14y ago
    Well, for one thing, you could put the exit nodes on such devices. One of the advantages of such devices is being somewhat proof against search warrants. (To use one café's Wifi, you might be next door or around the block on the next street.)
javajosh 14y ago
What about writing a letter, with pictures and everything, and sending it to a bunch of people who then scan it with or without OCR and then post it online? There could even be a group of such people that, as a kind of public service, agree to do this. They could, for example, burn the original.
- morsch 14y ago
  Better make sure your printer isn't leaking any identifiable data: https://www.eff.org/issues/printers https://www.eff.org/issues/printers That's not a problem if your recipients are OCR'ing or transcribing the document and make sure the original is destroyed.
  - javajosh 14y ago
    Yeah, that's why you burn the original.
    - morsch 14y ago
      You don't burn anything, you hope your recipients are diligent and follow up on their promises. Making this one of the less safe ways to get out data, because it's not self-reliant.
      - javajosh 14y ago
        Actually, I meant that the recipient burns the letter after transcription. That protects the sender in case someone comes snooping after the sender and tries to hit up the recipient for more details. Regarding self-reliance: theoretically, there is no self-reliant way to "get data out". Every method requires at least the involvement of the recipient. This sounds pedantic but it's a serious point. If you really don't want to rely on anyone, why are you bothering sending people messages anyway? If the message is persistent, then some lasting mark on the world has to be made - and there will always be a non-zero chance that that mark can be associated with you. Methods requiring computers require an unusually large amount of reliance on others, actually. You rely on the hardware and software one is using, up to and including all of the infrastructure between you and your recipients. Computers are fundamentally microscopic phenomena, and yet controlled by other humans: how do you know that your hardware and software is doing what you think it's doing? Without an electron microscope and a great deal of time, you cant. (And even then, the microscope is subject to manipulation, so you can't be fully certain). There's another problem with persistent distribution of anonymous data, which is the denial of service attack. An entity wishing to stop another from speaking can either stop the speech, or they have the option to parrot the speech, but altered enough to constitute noise, and weaken the opponents position, generally confuse the issue. No system is going to prevent a noise counter-measure, since presumably the system is available for anyone for anything.
fleitz 14y ago
Pastebin + Tor?
lsc 14y ago
I wonder... is there anything like geocities anymore? I mean, I'm thinking that the hosting costs would be close to zero. (now, the phishing prevention... that is probably effort directly in proportion to how anonymous you let the users be, and could be quite expensive.) But yeah; Yahoo shuttered geocities while I was there. Is there anything analogous now?
- Lagged2Death 14y ago
  Angelfire and Tripod still exist.
jgamman 14y ago
create a honeypot ID and use that as a disposable cost of anonymity. i'm assuming that a suitably motivated person can find a passport and then create a persona around that. then you can use all the 'normal' channels but there is a name to go with them, a credit card, an email etc. the fact that it's not you is the whole point. i think it's shneir that said it's not identity that's important, it's intent...
HedgeMage 14y ago
Silly boy. You started with a centralized model, and with trying to set up a contract for ongoing service in another country, and you wonder why you failed at anonymity? 1) Choose a suitable pseudonym. Heinlein, Orson Scott Card, or Orwell references in the pseudonym get you extra cool points. 2) Generate a gpg key pair and publish the public key. 3) Write stuff. Sign said stuff with your private key. 4) Using Tor, free wifi four towns away, a small computer stashed in a coffee shop set to log in when you aren't there, or whatever methods make you feel safe, post the signed material to several dozen file sharing, pastebin, or other suitably public sites in several different countries. 5) If anybody cares about what you've written, it won't die there. It'll get passed on from person to person long after anybody gets it taken down from anywhere you originally posted.
guest 14y ago
niggah please http://artcrimes.org/ http://artcrimes.org/
ideaoverload 14y ago
In Europe you can buy a prepaid phone card and use your mobile phone/modem to get online anonymously. Phones can be identified by IMEI id but you can physically hide the device or likely swap IMEI when needed using software. Not sure if other ways to remotely identify phone/modem exist.
sireat 14y ago
I may be thinking too old school, but isn't there some way of posting to newsgroups anonymously? I realize access to binaries groups these days is 99% pay, but at least the stuff would be out there.

257 points by thesteamboat 14y ago

stfu 14y ago

At least for the hosting part I guess he didn't search hard enough. Hosts like http://www.mediaon.com/ http://www.mediaon.com/ are accepting even cash via regular mail to start an anonymous website/register a domain.

aw3c2 14y ago
https://www.nearlyfreespeech.net/about/mailing https://www.nearlyfreespeech.net/about/mailing seems to allow anonymity as well.
- StavrosK 14y ago
  How? Don't checks have your name on them, or doesn't the bank know it?
  - JoshTriplett 14y ago
    Cashier's checks and money orders would just have the merchant's name on them, or no name at all. You can purchase either one with cash.
    - StavrosK 14y ago
      Ah, thank you. That's pretty handy, too bad I'm not in the US.
- biotech 14y ago
  Looks like they don't (except under very specific circumstances which include not living within the USA) https://www.nearlyfreespeech.net/about/faq#Anonymous https://www.nearlyfreespeech.net/about/faq#Anonymous

wwwtyro 14y ago

1. Drive to coffee shop. 2. Change MAC address? 3. Create new account on Blogger/Tumblr/etc. 4. Publish. No?

est 14y ago
In China coffee shop wifi requires citizen ID to use. At least in Beijing. Yes fuck Chinese government, but 5 years later western governments will follow this way
- naner 14y ago
  That's oddly similar to network access in Ender's Game.
- matt4711 14y ago
  I was in Beijing a few days ago and in most of the restaurants/cafes I only had to ask the waiter for the wifi password. No id checks required. Some of the "western" bars even have a vpn running so you can browse facebook when connecting to their wifi.
  - SoftwareMaven 14y ago
    Do you look western or Chinese?
    - matt4711 14y ago
      I'm western looking but they gave the password to anyone who asked (including locals)
- knowaveragejoe 14y ago
  Somehow doubt this will happen - as other posters pointed out, it's not even as strictly enforced as you make it sound.
  - eschulte 14y ago

EGreg 14y ago

What about freenet? The problem with anonymous publishing in a world where you have an authoritative server and DNS is clear. Some server is serving a file. And that server's operator apparently wants to know things. What about uploading static content to various sites under free accounts? The only difficulty is having DYNAMIC server generated content, i.e. executing programs to handle a request.

cookiecaper 14y ago
freenet is probably the most reasonable alternative since the content is distributed amongst clients, and therefore there is no central point that can be "shut down" by governments. The downside, of course, is that almost no one will see your content on freenet (or a smaller darknet) and whether that still counts as "publishing" in the same sense as getting a publicly-available server connected to the internet. If you are doing something like WikiLeaks where you're really relying on normal news outlets to do the real legwork for you, this may be feasible, but if you aren't doing that for whatever reason, it practically would be the same as saving a text file to your hard drive -- i.e., no one, or almost no one, will ever read it.
- EGreg 14y ago
  Yeah but as I said, you can upload your html to http://pastehtml.com http://pastehtml.com and upload files to some free accounts, and references them. And bam, anonymous publishing. What's so hard?

weavejester 14y ago

I don't know why the author dismisses Bitcoin as an anonymous payment mechanism. He says he doesn't "trust the blockchain to provide anonymity" but doesn't elaborate as to why.

mindslight 14y ago
Perhaps because it's just a big list of who gave what to whom? sigh.
- Karunamon 14y ago
  All that the blockchain does is say that code UVW signed code XYZ. Tracing that to individual transactions is a lot tougher, especially considering that one person can have multiple randomly generated bitcoin wallets. Who's to say that when 123 signs 456 that he didn't pay for some service somewhere, as opposed to just sending coins to another wallet under his control? There's no "who". There's a cryptographic hash that may or may not be under the control of a specific person at any given time. If you're smart, the only link an attacker can make is that you used your traceable money to purchase BTC sent to this wallet. Once that BTC leaves that wallet, the chain is broken, because you have no way of tying an identity to that second wallet.
  - mindslight 14y ago
    Tracing mass flows, the concept of guilt by association, and general investigation say otherwise. Please take a look at the properties provided by a system based on http://en.wikipedia.org/wiki/Blind_signature http://en.wikipedia.org/wiki/Blind_signature for a perspective on the guarantees that Bitcoin lacks. (Unfortunately, such schemes require a Bank and are thus not practical for adoption. still it's instructive to see what other properties are actually possible rather than devolving into the technicalities of performing various degrees of untraceable btc transaction in the immediate future) It's really a matter of time until all exchanges routinely report their customers and a list is made of all the major above-board merchants. For the sake of the naive users, let's hope this is done openly rather than covertly. FINCEN has decades of experience tracing pseudonymous transactions.

kijin 14y ago

Most of the author's problems seem to have to do with purchasing and running a VPS anonymously. But why bother? Do you really need to run your own Tor hidden service on your own VPS in order to publish anonymously? What happened to all the free blogging and pastebin services where you can sign up and/or post anonymously? All you need is Tor Browser Bundle and some extra caution. You can stay as anonymous as Tor's security allows, and no money ever changes hands. Sure, it will be easier for the powers that be to take down something you posted on Tumblr than to take down a Tor hidden service. But that's a completely different matter from publishing anonymously in the first place. The author also seems to think that publishing images and videos anonymously is harder than publishing ASCII text anonymously. This may be right, but not because of the reasons he cites. If you already have a medium where you can publish ASCII text anonymously, nothing stops you from publishing your media in a base64-encoded form. The real problem with publishing images and videos anonymously is that those media files often contain lots of entropy that could help identify the author, such as location information. No amount of Tor trickery will keep you anonymous unless you thoroughly scrub your media files.

sedev 14y ago
I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.
- jrockway 14y ago
  You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA. But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause. The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.

vasco 14y ago

Not breaking the law: Public library, ask to use the computer while someone else is using it with the excuse for it just taking a minute. (If they have logs, its the guy's name) Breaking the law: Break into someone's house, use internet.

gouranga 14y ago
Access is free at libraries in the UK. Just crack their wep key :)
- icebraining 14y ago
  I can beat that: here in Portugal our main paid hotspot provider (PT) doesn't know how to secure them - free unauthenticated HTTPS access to everyone! Coupled with a free VPN over port 443 and you can get access to the whole web.
  - gouranga 14y ago
    Nice :) Good for you!
wahnfrieden 14y ago
Libraries have cameras.
- talaketu 14y ago
  as this turd found out: http://www.dailymail.co.uk/news/article-2026267/Paul-Doug-Peters-Gmail-led-police-Madeleine-Pulver-fake-neck-bomb-suspect.html http://www.dailymail.co.uk/news/article-2026267/Paul-Doug-Pe...
m_eiman 14y ago
No need to break in, just find an open WLAN.

cs702 14y ago

IMO the author is right: truly anonymous publishing is an unattainable goal for most people today, because they have little choice but to rely on one or more third parties to obtain all the layers of hardware and software necessary to publish online, and such third parties either cannot fully protect or ensure the protection of their anonymity or (more commonly) need to know the identity of their customers. However, I disagree with the author about the impossibility of buying bitcoins anonymously. Bitcoins can be purchased anonymously via local dealers and over-the-counter venues. One sends cash along with a Bitcoin address; one gets bitcoins delivered to an address in the blockchain in return. Examples: http://www.tradebitcoin.com/ http://www.tradebitcoin.com/ , http://localbitcoins.com/ http://localbitcoins.com/ , http://bitcoin-otc.com/ http://bitcoin-otc.com/

jerguismi 14y ago
Also you can mix your bitcoins using some laundry service or web wallet. Of course then you have to trust the third party (mixer/anonymizer) ps. I'm the author of localbitcoins.com, thanks for linking to it :)
- sergeinono 14y ago
  Yes and buy with bit instant
- rictic 14y ago
  If you're willing to wait and are willing to throw down some initial capital you can also mine bitcoins directly. Freshly mined bitcoins are difficult to impossible to trace (not even to the machine that mined them) (with small variation in anonymity depending on whether you mine using a pool, and I think whether you can assume that your enemy doesn't control the vast majority of bitcoin miners).
  - lsc 14y ago
    Yeah; that was my first thought when the OP wanted to obtain bitcoins anonymously. Of course, getting access to compute power is probably easier for me than for most people, but eh, even so, it seems like the easiest way to go.

codesuela 14y ago

Here is how you do it: Put on gloves Stuff cash into an envelope Send it to the guys at prq.se ??? Publish

crazygringo 14y ago

As far as I know, it's impossible to anonymously pay for anything over the Internet. He tried to use a prepaid credit card, paid for in cash, but since the PATRIOT act, prepaid credit cards only work in person (and not even always then). You can't use prepaid credit cards online without supplying your address and SSN to the prepaid credit card provider first, which most prepaid card providers don't even support in the first place. Question: doesn't Bitcoin provide for anonymous transfers? Or no?

jlgreco 14y ago
Bitcoin transactions are all public. If you want to be safe, you have to use a laundry service, and I don't know how good those are. Here is a thought though: what if you got a prepaid credit card in another country? I suspect somewhere in Europe would be your best bet. Also, how would the card company know that the transaction was online? It would be shady as all hell, but couldn't the merchant open a cornerstore and ring up all the online orders as chips and a smoothly?
- netcan 14y ago
  I'm not an expert, but I think credit card companies themselves may be pretty unhappy with something like that. It's a tricky proposition in the first place, accepting CCs as an online (or even brick & mortar) merchant. You are effectively assuming some funky risk. Fraudulent transactions mostly your problem, at least more yours than the credit card company's, the bank's, the credit card owner's or even the fraudster's (in practical terms). I wouldn't be surprised if by breaking or even nudging their rules comes with a high enough price to kill the whole thing. You would be open to being ripped off painfully and your merchant account would probably be shut down pretty fast.
  - jlgreco 14y ago
    Good point, I didn't take into account fraud on the part of the customers. The legitimate but non-US prepaid card is still something I think could work though. I tried googling about it and didn't really find anything at all though.

sedev 14y ago

This makes me think that an analog to steganography could be a fruitful direction for privacy efforts to take - not looking like nothing, but looking like something unremarkable. If I remember correctly, Tor is already working on something like this, but what if this concept permeated the whole stack?

systemizer 14y ago

I'm sure we could create an anonymous payment system, however, it would come with a lot of constraints. For example, everyone in the network would pay X dollars to be a part of the anonymous network. Each person cannot pay more than X dollars so that money is conserved. When a transaction is executed, use a service like PayPal to choose a random account and transfer the funds where they need to go. Yes, this is very insecure for various reasons, and your credit card statement will show up with something you didn't actually buy, but, anonymous payments could be achieved. Of course, you would have to access the service with Tor for it to be completely anonymous.

cabalamat 14y ago

In the UK you can get pay-as-you-go internet dongles. I'm not sure if you can buy them for cash in a shop, without ID.

gouranga 14y ago
You can. Currys allow you to buy in cash.
- gouranga 14y ago
  Replying to my own post here (the shame!) but it's relevant and hopefully slightly interesting: You can purchase SIM cards from most supermarkets in the UK for around the £1-5 mark and a basic Nokia handset for £10-15. You can top these up using cash at any supermarket checkout with "topup vouchers". If you top up £15 that gives you 100% unlimited O2->O2 calls and texts for a month. I reckon with a one time pad system such as the one described at [1], it is the most reliable, anonymous, secure point to point country-wide messaging system that you can create and it's not expensive or complicated. I might write the whole thing up as an experiment and hopefully I won't get chucked in jail for doing so! [1] http://users.telenet.be/d.rijmenants/en/onetimepad.htm http://users.telenet.be/d.rijmenants/en/onetimepad.htm
  - petitmiam 14y ago
    and if the SIM has international roaming, it can be used in countries like Australia (where prepaid SIMs must be registered).
rmc 14y ago
Yes, but then they can trace it to where you exactly are. Makes it easy for yourself to get raided.
- TazeTSchnitzel 14y ago
  Drive somewhere. Use dongle. Throw away dongle.

tatsuke95 14y ago

There are two ways to do this from the perspective of a journalist. The first, is to do as the author attempted: that is to find every way possible to hide your identity. It's a lot of work, and maybe impossible. The second is to put yourself out there. Be a public figure, unafraid of what you are publishing. Allow people to know who you are and what you stand for. Use your fame to your advantage. Call me an optimist, but the powers that be will have a tough time keeping you quiet if you represent a populist movement. In fact, it's eventually to their advantage to support the cause if it's meaningful and popular enough; the game of politics is won by catering to the masses. At the end of the day, if you want to be a muckraker you can't be scared to get in the muck. I realize there can be repercussions. But it's far easier to support a face than it is some anonymous text.

rmc 14y ago
That presumes you get famous before you start publishing stuff.
martinkallstrom 14y ago
In the countries where investigative journalism would do most service to the public, putting yourself out there will get you jailed, beaten up or shot. Entire governments keep their reign in part by controlling media. And some organisations too, like the drug gangs in Mexico. One blogger was literally beheaded by a local Mexican gang. From this perspective it is more than a little naive to stipulate that "if you want to be a muckraker you can't be scared to get in the muck". The need for true anonymity is not fiction, it is very real in the world we live in, right now.
- tatsuke95 14y ago
  I'm not naive. I realize there are repercussions to it. It isn't unique in history, and I'm grateful people have and continue to do so. When you're publishing things about the Mexican drug cartels, you have to expect that you're going to piss off the gangs. That's part and parcel with what you're doing. Unfortunately, it's sort of how progress is made; if you publish something and get jailed, beat up or even killed, that becomes part of your message. I'm not trying to sound flippant. It's reality. What passes for "anonymity" won't save you, and true anonymity makes it unlikely that what you publish can make a difference. Besides, did truly anonymous publishing ever really exist? When it comes to getting your message out to make a difference (which I assume is the underlying point), fame and anonymity are opposite sides of the same coin. If you can't achieve one, you're best bet is to focus on the other.

aurelianito 14y ago

Come on! Just get a fake account in wordpress, blogger or whatever and post using a public wifi. They will do the hosting for you for free and you will be virtually untrackeable. If you need to publish some video, post it on youtube or a clone using the same procedure as before. You can even use facebook for hosting (!) if you fake the email. I really don't get why this guy needs to purchase a VPS to publish.

kennywinker 14y ago
Most of these things are subject to being taken down at the whim of U.S. law. That's a great way to get out a single message, like a video or a photo or document. If you wanted to publish regularly and develop a following, you wouldn't be able to do that on these sites without constantly being taken down and having to re-find your audience. I think that might be the kind of anonymous publishing he is talking about.
- aurelianito 14y ago
  You are right. But you can use several different free hosts managed by different laws and it would be quite resilient.
- javajosh 14y ago
  Really, what the OP really wants is unclear to me. Anonymity is one thing, but accessibility in the face of governmental restrictions (especially targeted, rather than general) is quite another.
fl3tch 14y ago
That could deanonymize you. Lots of public places have cameras. On the other hand, have you ever tried creating a Google/YouTube or Facebook accout over Tor? They want SMS verification. So you have to buy a prepaid phone somewhere and that store will likely have cameras too. It's more difficult than you think.
- aurelianito 14y ago

macspoofing 14y ago

Anonymous publishing isn't dead, but rather anonymous payment.

lifeguard 14y ago

I sent this reply to cryptome: Avoiding Echelon & DMCA ( response to http://cryptome.org/2012/06/anon-pub-dead.htm http://cryptome.org/2012/06/anon-pub-dead.htm and I assume reader is in USA ) TL;DR: Emulate spammer ecom hosting techniques and/or look at the Privly project To resist echelon style wire tapping one must use strong non-AES/DES crypto. Stego is a good idea, too. To resist DMCA style censorship and legal liabilities, publish on servers hosted in one of the BRIC countries (Brazil, Russia, India, China) -- China being the most resistant unless material is related to China. This should be a linux based webserver with a non-AES encrypted file system. Set up a ‘workstation’ in a different BRIC country than where you publish. For less technical people, a MS windows VPS is easiest -- just connect with a remote desktop client. Then run your tools in the remote environment to manage the publishing server. Or just run a ssh server on linux, perhaps with port forwarding. ALWAYS delete the 'workstation' VPS instance when you are finished and create a new one for each use. ISP’s do not retain this type of log data for long and constantly restarting the VPS makes it hard to track because MAC and IP address info can change. To connect to your ‘workstaion’, start at an internet cafe outside of the district you live in. From there get an account at a Canadian ISP to be your VPN server. Avoid accessing this VPN server from the same cafe/place twice or within 20 miles of your home. Follow published VPN server setup howtos. On the publishing server, create a fake but plausible cover website for the casual browser. Create a sub-folder that is not linked to or indexed and publish your content here. Hide your content using public key non-AES/DES algorithms with non-standard key length. Publishing with stego inside of image files is one example. Publish links to your stego encrypted files on public classified ad sites like craig’s list. Publish info on how to find the craigslist.org ads on forums your audience reads. Research ‘fast flux DNS’ as a way of mapping urls to your published content and/or use a publishing server that is configured via DHCP if possible. Configure the firewall to block all IP addresses on the 'anti-P2P' and government lists that are published. Payment is tricky, but not impossible. Look into USPS international money orders as a form of payment. The longer a pre-paid cell phone number is active in the system, the more it is trusted by automated fraud services. Use your ‘workstation’ and pre-paid cell phones to create free email accounts as needed, avoiding major services like hotmail, yahoo, and google. One could also publish by uploading stego’d pictures to a free porn site via one’s ‘workstation’. The high volume of porn traffic is useful chaff. Ideally, boot your mobile PC from a Linux live CD and use that environment to work from. Any stored data should be on removable media that has a non-AES encrypted filesystem like Trucryp. Consider hiring forum spammers to publish links to your content. These folks will not be picky about your debit cards or friendly to law enforcement. Four layer encrypted connection diagram as proposed: [mobile PC at cafe, vpn & remote desktop clients] >>> [VPN server at outside USA ISP] >>> [‘workstation’ VPS at BRIC ISP] >>> [publishing server at Chinese ISP] Essentially each legal jurisdiction one crosses makes government action very difficult. Beware, government corruption can be exploited in these countries if your opponents have enough resources!

bamdad 14y ago

how about bitcoin based vps services ?

jsilence 14y ago

What happend to Freenet and I2P? They aren't dead, are they?

deleted 14y ago

[deleted]

malandrew 14y ago

I think the key to doing anything where you want plausible deniability is not cleaning up after yourself, but in creating so much noise that it becomes cost and time prohibitive to establish your identity. The more you clean up, the more little clues you forgot to wipe out stick out to a forensic investigator. The best shot you have is to produce so much noise that it requires hundreds of forensic investigators working full time to find evidence that you were there among the noise.

kaybe 14y ago

What would a "geographically ambiguous location" be? An airport or a train station, like in the Scotland Yard game maybe?[1] [1] A team of players tryies to track down a solo player on a map with taxi, bus and subway lines. The solo player is invisible and has to give his location every five moves. The best place to be for this is on a subway station, because it means one can get away in many directions quickly.

lifeguard 14y ago
I think author meant not from one's home, office, friend's home/office, or local star bucks.

stcredzero 14y ago

Could someone create a TOR-like network using mobile devices connected to various WiFi networks? Flunkies could be hired to place and retrieve these devices.

marshray 14y ago
You can use Tor on mobile devices. I don't see much point in ensuring that all the nodes are on Wifi networks.
- stcredzero 14y ago
  Well, for one thing, you could put the exit nodes on such devices. One of the advantages of such devices is being somewhat proof against search warrants. (To use one café's Wifi, you might be next door or around the block on the next street.)

javajosh 14y ago

What about writing a letter, with pictures and everything, and sending it to a bunch of people who then scan it with or without OCR and then post it online? There could even be a group of such people that, as a kind of public service, agree to do this. They could, for example, burn the original.

morsch 14y ago
Better make sure your printer isn't leaking any identifiable data: https://www.eff.org/issues/printers https://www.eff.org/issues/printers That's not a problem if your recipients are OCR'ing or transcribing the document and make sure the original is destroyed.
- javajosh 14y ago
  Yeah, that's why you burn the original.
  - morsch 14y ago
    You don't burn anything, you hope your recipients are diligent and follow up on their promises. Making this one of the less safe ways to get out data, because it's not self-reliant.
    - javajosh 14y ago
      Actually, I meant that the recipient burns the letter after transcription. That protects the sender in case someone comes snooping after the sender and tries to hit up the recipient for more details. Regarding self-reliance: theoretically, there is no self-reliant way to "get data out". Every method requires at least the involvement of the recipient. This sounds pedantic but it's a serious point. If you really don't want to rely on anyone, why are you bothering sending people messages anyway? If the message is persistent, then some lasting mark on the world has to be made - and there will always be a non-zero chance that that mark can be associated with you. Methods requiring computers require an unusually large amount of reliance on others, actually. You rely on the hardware and software one is using, up to and including all of the infrastructure between you and your recipients. Computers are fundamentally microscopic phenomena, and yet controlled by other humans: how do you know that your hardware and software is doing what you think it's doing? Without an electron microscope and a great deal of time, you cant. (And even then, the microscope is subject to manipulation, so you can't be fully certain). There's another problem with persistent distribution of anonymous data, which is the denial of service attack. An entity wishing to stop another from speaking can either stop the speech, or they have the option to parrot the speech, but altered enough to constitute noise, and weaken the opponents position, generally confuse the issue. No system is going to prevent a noise counter-measure, since presumably the system is available for anyone for anything.

fleitz 14y ago

Pastebin + Tor?

lsc 14y ago

I wonder... is there anything like geocities anymore? I mean, I'm thinking that the hosting costs would be close to zero. (now, the phishing prevention... that is probably effort directly in proportion to how anonymous you let the users be, and could be quite expensive.) But yeah; Yahoo shuttered geocities while I was there. Is there anything analogous now?

Lagged2Death 14y ago
Angelfire and Tripod still exist.

jgamman 14y ago

create a honeypot ID and use that as a disposable cost of anonymity. i'm assuming that a suitably motivated person can find a passport and then create a persona around that. then you can use all the 'normal' channels but there is a name to go with them, a credit card, an email etc. the fact that it's not you is the whole point. i think it's shneir that said it's not identity that's important, it's intent...

HedgeMage 14y ago

Silly boy. You started with a centralized model, and with trying to set up a contract for ongoing service in another country, and you wonder why you failed at anonymity? 1) Choose a suitable pseudonym. Heinlein, Orson Scott Card, or Orwell references in the pseudonym get you extra cool points. 2) Generate a gpg key pair and publish the public key. 3) Write stuff. Sign said stuff with your private key. 4) Using Tor, free wifi four towns away, a small computer stashed in a coffee shop set to log in when you aren't there, or whatever methods make you feel safe, post the signed material to several dozen file sharing, pastebin, or other suitably public sites in several different countries. 5) If anybody cares about what you've written, it won't die there. It'll get passed on from person to person long after anybody gets it taken down from anywhere you originally posted.

guest 14y ago

niggah please http://artcrimes.org/ http://artcrimes.org/

ideaoverload 14y ago

In Europe you can buy a prepaid phone card and use your mobile phone/modem to get online anonymously. Phones can be identified by IMEI id but you can physically hide the device or likely swap IMEI when needed using software. Not sure if other ways to remotely identify phone/modem exist.

sireat 14y ago

I may be thinking too old school, but isn't there some way of posting to newsgroups anonymously? I realize access to binaries groups these days is 99% pay, but at least the stuff would be out there.