How to Run a Rogue Gov Twitter Account with Anon Email Address and Burner Phone | Hacker News Reader

How to Run a Rogue Gov Twitter Account with Anon Email Address and Burner Phone

theintercept.com

229 pointssecfirstmd135 comments

> "And finally, keep in mind that after all this, Twitter can always kick you off for their own reasons."

The problem with

anonymous e-mail address + burner phone + always use TOR to access the account

is that this doesn't play out well in the medium term. This triggers various automatic "anti-abuse" measures on Twitters side. Those measures include: random prompt for re-verification of the phone number, which fails with the burner phone number used to create the account.

It's hard (if not impossible) to maintain such an account in the long run while protecting ones identity.

It is indeed hard to maintain Twitter accounts via Tor. Establishing accounts via Tor, using burner phones for verification, isn't hard. And there's no problem reading feeds via Tor. But tweeting via Tor, in my experience, is indeed a crap shoot. So is tweeting via commercial VPN services.

What seems to work is tweeting via private VPNs, running on anonymously-leased VPS. To route that VPN through Tor, you just run the VPN server (in TCP mode) on the VPS as an onion service.

But there's still the risk of cellphone re-verification. So for long-term accounts, you need a persistent number. One solution is to have trusted friends in other jurisdictions, who can activate the number for you when needed.

> One solution is to have trusted friends in other jurisdictions, who can activate the number for you when needed.

If you have a trusted friend in an independent jurisdiction, the whole complicated dance with burner phones and so on becomes unnecessary. Just have the trusted friend create the account for you and hand you the password.

Sure, that's doable too. But then you have a major IP address change, which could raise flags.

Or you could keep creating new accounts with new phones, tweeting the next account as the last tweet of the previous one. You won't get an easy to digest single thread of tweets, but you can maintain a chain of trust, insofar as the accounts are trusted to begin with.

There are "Burner" apps out there that give you a different phone number.

I'm unsure if it'd be easier to maintain. But off the top of my head I'd think it'd be easier to spoof.

Almost all numbers from free "burner apps"[0] I came across are already burned for all major Social Networks (probably because someone else already used those numbers for registration).

I don't know if it works with paid services, but then you have the problem of paying for it anonymously.

[0] I guess you mean those services which offers some mobile numbers for receiving SMS to anyone without registering.

Virtual phone numbers are flagged as such and all of the major providers will refuse to use them for verification purposes. Social media companies already thought of this.

One of my Twitter accounts is a Friends Only twitter account that has only been used via twitter + bitlbee connected to the internet via a tor proxy, plus IRC client

https://wiki.bitlbee.org/HowtoTwitter

https://github.com/nillab/dotfiles/blob/master/bitlbee.conf#...

https://irssi.org/

It's always worked, I've never been prompted for verification. I'm not sure how twitter would prompt me for verification!

you don't need to burn the burner phone necessarily. Just take out the battery and store it somewhere safe.

> "which fails with the burner phone number used to create the account."

Maybe I expressed that a bit unclear: I didn't mean it fails because you have no longer access to the number (= you burned the burner). It fails because Twitter don't accept this same number which worked while sign-up anymore for re-verfification.

To be honest: I'm not sure if Twitter accepts any other number in that case or if the prompt for phone number re-verification is just an obscure way of saying "Your account is permanently locked for any reason."

It would be very irresponsible to recommend buying a burner phone to people trying to stay anonymous. At the very least, it would give away your location even if you somehow manage to remain unrecorded by street CCTVs in the vicinity of the shop at the time of purchase. Assuming it is even possible to buy one without providing full personal details, as is required by law in most of the EU.

Twitter now not only gives platform to powerful demagogues, it is also actively stifling dissent by effectively disallowing anonymity.

FWIW, in the UK you can buy a burner phone and SIM in cash without giving away any personal details at most supermarkets (at least Tesco and Sainsbury's). With the new EU regulations removing roaming charges, you can fly to London on holiday, and buy a UK burner phone anonymously with two years of data on it that's enough for heavy Twitter use in all of the EU for £240 + phone cost.

If you're under enough surveillance that your adversary will follow you on holiday and track all your supermarket purchases, you have bigger problems.

> If you're under enough surveillance that your adversary will follow you on holiday and track all your supermarket purchases, you have bigger problems.

Problem with modern surveillance is not that somebody is actively tracking you, it's the ability to retroactively track you back with perfect accuracy soon as you become become an inconvenience.

Sure, for digital surveillance I get this concern. But when we're talking about identifying that "on holiday, subject X spent some of that cash he withdrew on a burner phone at a random supermarket he visited, not just on ice cream and beer", then you really need significant HUMINT resources.

> for digital surveillance I get this concern

In the context of maintaining digital anonymity against a state-level adversary, I think that considering retroactive unmasking as part of the threat landscape is quite reasonable.

The situation one is trying to avoid is:

- Tyrant in power - You try to be anonymous - You fail, because you didn't take enough steps to protect your tracks (when buying the phone, leasing the VPS, accessing the VPS, etc) from retroactive investigation - You are now fired / jailed

Surveillance is ubiquitous enough that I suspect anonymity is nearly binary in nature.

That was addressed in article

>Security cameras will probably record your face at the store. Most stores delete old footage on a regular basis, overwriting it with new footage. If possible, wait a week or two before you start tweeting so that the footage is already deleted by the time anyone tries to figure out your real identity.

This addresses shop cameras, not street-level government surveillance that would be accessible for 10+ years and is trivially addressable by the time and location of the transaction.

Would a disguise at time of purchase not help reduce this risk?

Probably, but doing it correctly would require a whole different type of opsec expertise that should not realistically be expected from someone who is getting their security tips from The Intercept.

Fair enough. Opsec is not at all my domain of familiarity so I've no idea what challenges it might present to do it properly.

Just a hunch, but I would guess that a poor disguise would be more suspicious than no disguise. If I was a shopkeeper and government agents came to me asking if I remembered anyone suspicious in the past month, I'd probably recall the guy with the obviously fake mustache and prosthetics.

On the other hand, an effective disguise can be trivial: enter a store dressed a certain way, make purchase, exit dressed significantly different. Reversible jacket, headgear swap and glasses can go a long way, in a crowd under low-res cameras.

They would probably ask you to remove the disguise. You could pay a hobo to buy you the phone, though.

This is the solution, right? You get someone else to buy the phone for you. This necessarily will practically speaking be probably be someone who knows you, but it adds a layer of indirection.

The unregulated pharmaceuticals distribution market relies on burner phones and seems pretty solid despite effectively continuous attempts to conduct surveillance on them.

Perhaps not something insanely obvious like Grouch Marx moustache and glasses, but more subtle? I'm not really very well aware of how advanced face recognition, etc. is at this point in time though. But I'd guess anyone who cares enough about opsec to go through this process might also be decent at passable disguise techniques.

Check out cvdazzle

Doesn't exactly pass the "more subtle" requirement...

(Perhaps if you arrange to buy your burner from the convenience store next door to a goth club...)

That's just (weird) fashion design. The anti-surveillance thing is an afterthought. And it doesn't work in any case.

you can always hire someone down-and-out or someone that doesn't take part in the normal economy to buy the phone for you, though of course there are risks with that too

Can avoid having to buy a phone using https://dtmf.io/ (disclaimer: I made it)

A pricing page would be nice. You mention a starting price, but that's not often the whole story.

Thanks for the suggestion, we'll add a pricing page that doesn't require logging in. The "starting price" is just the price of our cheapest numbers (pricing varies by country). We maybe should think of a less scammy-sounding way to describe that.

Probably the way you just described it would work, "pricing varies by country, starting at ___". This is a service I have been looking for, but I don't like the idea that I need to buy into one or another of the internet-money fads. Do you foresee offering this service for regular money? If not, do you know anyone who might?

Anveo sells SMS capable numbers in a variety of countries. You have to pay for a month, but they are cheap. There are other VoIP providers as well. Two things to watch for though, not all sell SMS capable numbers, and some services check that the verification number is an actual mobile number...versus a VoIP number that can do SMS.

At the moment, we only plan to offer Bitcoin and Monero payment. There's a lot of other improvements I'd like to spend time on first before getting into fiat currency payment.

> 🇦🇺🇦🇹🇧🇪🇨🇱🇨🇿🇪🇪🇫🇮🇫🇷🇩🇪🇭🇰🇭🇺🇮🇪🇮🇱🇱🇹🇳🇱🇳🇴🇵🇱🇸🇪🇨🇭🇬🇧

What does all those letters I see mean? I see only flags of France, Germany and the UK. Maybe it has to do something with fonts installed on my computer.

The Unicode symbols for flags consist of a special set of combining country-code letters that when used in two-character combinations compose into flags. That solution ensures that the Unicode standard doesn't hard-code the existing list of countries and country codes. In addition to future-proofing, that also avoids dealing with disputed regions that not everyone recognizes as countries.

See https://en.wikipedia.org/wiki/Regional_Indicator_Symbol .

I parse those as ISO 3166-1 alpha-2 country codes:

AU AT BE CL CZ EE FI FR DE HK HU IE IL LT NL NO PL SE CH GB

Australia, Austria, Belgium, Chile, Czech Republic, Estonia, Finland, France, Germany, Hong Kong, Hungary, Ireland, Israel, Lithuania, Netherlands, Norway, Poland, Sweden, Switzerland, United Kingdom

Turns out they're in alpha order by country name, too.

When I imagine, in my head, "hmm, how can I present a string of 20 x 2 chars, what is the best way I can confuse the reader?" this is the exact solution I come up with, also.

Just a heads up that the landing page's dependency on emojis makes it look very confusing on Ubuntu 16.04

http://i.imgur.com/S9zOiDY.png

Thanks for the heads up! We'll find a more widely-compatible way to do the flags than using plain Unicode characters.

Is this the way it should look like? http://chronial.de/misc/screenshots/firefox_2017-02-21_19-11...

Ideally unicode was that way, honestly. I haven't found a way to install these emojis on Linux...

https://thomashunter.name/blog/enable-emoji-fonts-on-debian-...

Top Sites to Receive SMS Online Without a Phone

https://news.ycombinator.com/item?id=13631724 (7 days ago)

Why did you decide not to support us #s?

It's on the roadmap, but we need to integrate with another provider to support them. Most major communications services that verify your number don't mind which country it's from, but we realise there are good use cases for having a number from a specific country.

Is there anyway to test one of your numbers to see if where I plan to use them they are accepted, before buying?

No, we don't offer free trials, as they would be abused. However, you can just rent a number and cancel it immediately if it doesn't work for you -- we charge the rental by the minute so you would only spend a very small amount of money in the case that it didn't work for you.

Got it thanks.

Can you elaborate on your technology stack? How do I get the phone numbers you provide for your users?

Sure! At the moment we integrate with the Twilio API for our numbers, although we have a few more providers on the way. We don't offer all countries that Twilio does because we test the numbers out to make sure they work with most services before whitelisting a country to appear on our service. Our software is written in Rust and uses the Iron framework for the webapp. PostgreSQL keeps the records. nginx sits in front.

Probably using a service like Twilio.

What services do these generally work with?

Facebook? Google? Twitter?

And which not?

It depends on the country the number belongs to, and sometimes on the specific number, but we only list countries where we've tested a few numbers from that country and found they work with most services. We can't guarantee anything about which services will or won't accept our numbers, but we only bill by the minute so it's very cheap to try it out and cancel after a minute or two if it doesn't work out.

The Intercept makes less and less sense over time as they run out of sensational stories to publish. Thanks for the weird opsec tutorials, I guess.

I'm not understanding how this is a "rogue government Twitter account" versus just a "Twitter account".

Is it supposed to somehow look like an official government account?

The twitter accounts are presumably run by people who are employed by agencies funded by the US government. They could lose their jobs or have funding problems because of this.

I think a more fair comparison would be to when scientists were gagged in Canada, under the Prime Minister Harper era.

One of many sad examples: http://www.cbc.ca/news/politics/harperman-tony-turner-scient... https://www.youtube.com/watch?v=Ei50lM6ab1c

Of course, it's not muzzling, it's "ethics violations".

> presumably

And that's the problem with this whole article.

I don't see why. It's good advice no matter what, for current or future employees. Not to mention the author's background..

It's meant to instruct hypothetical government employees working for agencies that were silenced, and wish to continue their public outreach, educating the public on issues that the current administration might disagree with.

It has an audience bigger than that (who will not likely need to go to such lengths to publicly voice dissent), but it's fairly clear about its intent.

Ah, okay. Too bad there's not some simple way to also prove it is associated with a muzzled govt employee. These accounts could be somewhat muzzled themselves by creating lots of fake dissenters tweeting inaccurate info.

It's actually quite hard to write meaningful tweets that could fool someone with a bit of knowledge of the organisation, such as a journalist who has had it in his portfolio for a while.

Plus, a journalist would have the contacts to verify the information. Traditionally, the government doesn't lie to American journalists – they may decline to comment, or give you a convoluted answer that doesn't actually answer your question. But they wouldn't lie. Considering these organisations are supposedly full of people sharing the leaker's point of view, it shouldn't be difficult to get confirmation at least off-the-record.

Of course all that requires a certain amount of trust in the media.

This is good information to have, but it was just as necessary during the previous administration.

Nope, it wasn't.

Example: the was a State Department "dissent memo" against Obama's unwillingness to bomb/send ground troupes to Syria. Result: they got an answer (basically "this decision is hard, we share your concerns, but ultimately decided against a new war...") and that was it.

Same situation now: Spicer: "If you don't agree with us, you should quit. Diplomats should either get with the program or they can go.”

You need to turn off the phone and take out the battery every time you use the burner phone. They will be tracking the cell towers that you use, so going back and forth to the same cell towers means they can figure out pretty closely where you work and live.

Well it's another security/anonymity guide for beginners. ("An IP address is a set of numbers that identifies a computer...")

I'm always torn on these... like is a little info better than none, or worse than none? Example: "Tor is better than a VPN." Sure, except when the exit node is compromised, and the VPN service is a "no log" service. (Granted you would have to verify or trust any such claim.)

I may regret commenting in my real name, but I still have a vestige of belief in open opposition. For now, though, I cannot enter the US without giving my Facebook password. I have no doubts that as the new government settles in, it will up the ante on everything which could be construed as active opposition. This IS a fascist regime. It just hasn’t gotten hold of its true tools yet.

Is this actually legal? I mean, these are public institutions funded by the people of the US. They should be allowed to communicate, no?

Canada went through this a few years ago with a conservative government.

It wasn't that scientists were not allowed to communicate with the public, it was that they had to work through the PR department. The PR arm of the institutions would delay, filter, and even edit publications that touched on sensitive areas (eg. Anything remotely connected to climate change--like even fisheries related data).

Fortunately, Canada came through this period. But we did see the closure of research stations and destruction of scientific data.

So, to answer your question, many legal steps can be taken to stop, slow, of even eliminate scientific communication.

Yes it is legal for the head of the executive branch to set rules on how his underlings are allowed to communicate (except as otherwise prescribed by federal law).

This is cool, and stuff, but what does it accomplish to have just a Twitter account? The hard part, I think, is protecting key datasets. Which now means leaking them. That takes some real OpSec.

Wasn't it just said recently not to use Tor Browser? Why is it being recommended here?

Why don't just outsource all things?

> As soon as you power on your burner phone, it will connect to cell phone towers, and the phone company will know your location. So, don’t activate your phone, or keep it powered on at all, at your home or office — instead, go to a public place, like a coffee shop, before activating your new phone. Keep it powered off while you’re not using it.

Actually, don't go to a coffee-shop, either. They might have security cameras that can record you, that police can use to find out who you are.

Go into the park or forest, or any place without security cameras when using your burner phone.

And don't carry another phone while you're doing this. Or, if you do, turn the power off.

(If turning the power off isn't enough to protect you, then you're probably in that group of people for whom none of these measures will wholly suffice.)

Too bad sigaint is down right now, and the darknet is pissed!

Reply on news.ycombinator.com