6 ms·

Most of the author's problems seem to have to do with purchasing and running a VPS anonymously. But why bother? Do you really need to run your own Tor hidden se

by kijin 14y ago

Most of the author's problems seem to have to do with purchasing and running a VPS anonymously. But why bother? Do you really need to run your own Tor hidden service on your own VPS in order to publish anonymously? What happened to all the free blogging and pastebin services where you can sign up and/or post anonymously? All you need is Tor Browser Bundle and some extra caution. You can stay as anonymous as Tor's security allows, and no money ever changes hands. Sure, it will be easier for the powers that be to take down something you posted on Tumblr than to take down a Tor hidden service. But that's a completely different matter from publishing anonymously in the first place. The author also seems to think that publishing images and videos anonymously is harder than publishing ASCII text anonymously. This may be right, but not because of the reasons he cites. If you already have a medium where you can publish ASCII text anonymously, nothing stops you from publishing your media in a base64-encoded form. The real problem with publishing images and videos anonymously is that those media files often contain lots of entropy that could help identify the author, such as location information. No amount of Tor trickery will keep you anonymous unless you thoroughly scrub your media files.

sedev 14y ago
I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.
- jrockway 14y ago
  You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA. But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause. The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.
  - sedev 14y ago
    Thank you for the correction, I said TSA when I meant DHS. I agree that they don't have the power to seize your VPS at the border: what I said is that they have the power to seize hardware that you have on your person, which is a non-trivial factor. They've proven themselves willing to abuse this power.
glogla 14y ago
Another possibility would be to get one of the little computers that plug into USB or power socket and can do wifi, sneak one into a cafe or somewhere else with open wifi, and run TOR hidden service on that. It will get found and destroyed in time, but for some time, it might work. Or maybe solar powered Rpi that you put on someone's roof? I'm not sure how well TOR hidden service would work behind a NAT though. EDIT: another way would be to go to the dark side, and get your own botnet.
- ewillbefull 14y ago
  > I'm not sure how well TOR hidden service would work behind a NAT though. Just as well as tor works normally.
- rorrr 14y ago
  > sneak one into a cafe There are cameras everywhere. If they really want to find you, they will see your face.
  - javajosh 14y ago
    Wear a mask.
    - sedev 14y ago
      I've been tempted to get ahead of the game and start wearing facial-recognition-jamming face-paint just as a fashion statement. Unfortunately, for this particular use case, the makeup makes you memorable in its own way.
      - javajosh 14y ago
        Why not just walk around with a silly face all the time, and maybe a mustache?
        stcredzero 14y ago
        So we should all steal Sacha Baron Cohen's schtick?
rockyleal 14y ago
"media files often contain lots of entropy that could help identify the author, such as location information" Please, please, explain this.
- dkulchenko 14y ago
  As an example, take a photo with a relatively new digital camera and open the JPG up with an EXIF reader. In all likelihood, you'll see GPS coordinates, the exact time you took the picture, along with the unique identifier of your camera. See http://en.wikipedia.org/wiki/Exchangeable_image_file_format#Privacy_and_security http://en.wikipedia.org/wiki/Exchangeable_image_file_format#....
  - Sniffnoy 14y ago
    That's surely not what kijin was referring to; that can easily be stripped out. Rather there's the problem of being able to determine location purely from the picture itself -- a picture contains a lot more information than just the particular thing you intend to point out in it.
  - rwmj 14y ago
    Even if you scrub the EXIF data (which you absolutely should do of course) remember that it's likely possible to identify if you took a particular photograph with a particular device. That isn't a danger that you'll be identified from the photo, but it prevents plausible denial at a later date. https://www.schneier.com/blog/archives/2006/04/digital_cameras.html https://www.schneier.com/blog/archives/2006/04/digital_camer...
    - rorrr 14y ago
      This can be easily overcome by adding random noise.
      - Dylan16807 14y ago
        Random noise only means you need more samples; it can't block a consistent pattern.
ori_b 14y ago
I gathered that he wants to be able to host a site like wikileaks anonymously.

by kijin 14y ago

sedev 14y ago

I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.

jrockway 14y ago
You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA. But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause. The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.
- sedev 14y ago
  Thank you for the correction, I said TSA when I meant DHS. I agree that they don't have the power to seize your VPS at the border: what I said is that they have the power to seize hardware that you have on your person, which is a non-trivial factor. They've proven themselves willing to abuse this power.

glogla 14y ago

Another possibility would be to get one of the little computers that plug into USB or power socket and can do wifi, sneak one into a cafe or somewhere else with open wifi, and run TOR hidden service on that. It will get found and destroyed in time, but for some time, it might work. Or maybe solar powered Rpi that you put on someone's roof? I'm not sure how well TOR hidden service would work behind a NAT though. EDIT: another way would be to go to the dark side, and get your own botnet.

ewillbefull 14y ago
> I'm not sure how well TOR hidden service would work behind a NAT though. Just as well as tor works normally.
rorrr 14y ago
> sneak one into a cafe There are cameras everywhere. If they really want to find you, they will see your face.
- javajosh 14y ago
  Wear a mask.
  - sedev 14y ago
    I've been tempted to get ahead of the game and start wearing facial-recognition-jamming face-paint just as a fashion statement. Unfortunately, for this particular use case, the makeup makes you memorable in its own way.
    - javajosh 14y ago
      Why not just walk around with a silly face all the time, and maybe a mustache?
      - stcredzero 14y ago
        So we should all steal Sacha Baron Cohen's schtick?

rockyleal 14y ago

"media files often contain lots of entropy that could help identify the author, such as location information" Please, please, explain this.

dkulchenko 14y ago
As an example, take a photo with a relatively new digital camera and open the JPG up with an EXIF reader. In all likelihood, you'll see GPS coordinates, the exact time you took the picture, along with the unique identifier of your camera. See http://en.wikipedia.org/wiki/Exchangeable_image_file_format#Privacy_and_security http://en.wikipedia.org/wiki/Exchangeable_image_file_format#....
- Sniffnoy 14y ago
  That's surely not what kijin was referring to; that can easily be stripped out. Rather there's the problem of being able to determine location purely from the picture itself -- a picture contains a lot more information than just the particular thing you intend to point out in it.
- rwmj 14y ago
  Even if you scrub the EXIF data (which you absolutely should do of course) remember that it's likely possible to identify if you took a particular photograph with a particular device. That isn't a danger that you'll be identified from the photo, but it prevents plausible denial at a later date. https://www.schneier.com/blog/archives/2006/04/digital_cameras.html https://www.schneier.com/blog/archives/2006/04/digital_camer...
  - rorrr 14y ago
    This can be easily overcome by adding random noise.
    - Dylan16807 14y ago
      Random noise only means you need more samples; it can't block a consistent pattern.

ori_b 14y ago

I gathered that he wants to be able to host a site like wikileaks anonymously.