Ask HN: How to create an anonymous site?
The reasons are plenty, free speech, regulation and even criminal (piratebay?)
How can one register a domain anonymously and host a site without anyone being able to trace the owner's identity ?
How can one register a domain anonymously and host a site without anyone being able to trace the owner's identity ?
People will probably give you links which describe adequate methods for securing you against adversaries without $1,000 or equivalent amounts of brainsweat. If that's your adversary, there. May you execute properly.
If your theorized adversary is a nation state, pick another adversary. You're guaranteed to lose that fight in the long run. If you bid the price of your identity up to $5 million, they will counter with "We routinely pay that to kill mosquitoes" and mean that entirely literally.
SilkRoad - Was extremelly hard to "catch" but also hard for users (only Tor)
BTC-E - Still identities hidden, easily accessible by users.
Does anyone know how BTCE set it all up ?
More specifically, if you truly care for anonymity, you won't be using a plain DNS+Web site. Instead, you should go for Freenet [1] or a Tor-hosted website [2].
[1] https://freenetproject.org/
[2] https://www.torproject.org/docs/tor-hidden-service.html.en
On the other hand, Freenet is a paranoia-driven network over the Internet which makes information available and resilient. There is no such thing as a webserver on Freenet. An encrypted version of the data is sent to some nodes and passed from one to another. You don't know where the information comes from, you just get it at some point.
Finally, Tor implemented hidden services. This is almost the opposite of the initial situation where an user wants to access a known website without being known. The hidden service is hosted on some node, and you access it through the "Tor tunnel", meaning that you don't know where the service is. The user is still hidden by the network too.
To answer your questions - you can buy domain for bitcoins and use some free hosting like Wordpress or Github Pages.
On a serious note, those look really interesting.
Find a homeless person, and ask him/her to register a bank account in exchange for some cash or a meal. Use that account to set up your website anonymously. You'll find that you need to dirten money if running such an operation - reverse laundering or taking "clean" money and putting it untracably into the business. Such a proxy account is a vital ingredient.
Don't rely on Tor alone. It might be completely subverted, you wouldn't know until it's too late. Buy access to a botnet and route your stuff over it.
Have multiple servers. If you have one single server, its easy to trace. Either by brute force: the ISPs disconnect/slow down 50% of customers for a split second, depending on wheter your site went down or not they know in which half you are, repeat until they find you. There are much more sophisticated techniques that don't require active interference. But if you have at least two or three identical servers at different locations, it makes it a lot harder to catch you. Don't forget tamper-proofing your servers.
Have trustworthy accomplices. Generally, the less people you tell what you are doing, the better. But if you have a close circle of people you can really trust, it becomes much easier to pull this off. You can work from multiple locations, give each other alibis, etc..
Build fake personas. Don't just take a pseudonym, but create fake identities. Keep records on their interests, their motivations, what you disclosed about them. The purpose is to throw investigators off. You should be aware of techniques used by them, such as behavioral analysis, stilistic analysis, etc.. Working with accomplices can help alot in creating these fake identities and concealing your own (e.g. writing style).
Go somewhere safe. If possible, move your servers, or even yourself, somewhere where what you are doing is not punishable, or the authorities can be bribed.
This list could go on for ever... I'm not sure how practical many of these ideas are, but one thing is clear, you'll need a certain amount of "criminal energy" to pull this off - no matter whether your intentions are criminal or not. (Disclaimer: I'm too pussy to actually have done any of the above, so it may or may not work :-))
2. Buy a domain with BTC via Tor
3. Buy hosting with BTC via Tor
4. Do not accidentally leak your identity in one of million possible ways
#1-3 are pretty easy, but #4 is next to impossible. If nobody cares about you there might be some small room for error. But generally it takes one smallest mistake and you are ultimately busted.
This actually is harder than it sounds.
Than there is your registration on localbitcoin. You would need a truely anonymous email address.
And the site behaves really poorly if you try to use it over tor.
If you do the cash transfer in person, the seller might be able to identify you.
If you don't do it in person you would have to send it via some money transfer service.
It is allways hard not to leave traces when you interact with something / someone.
Edit: As 'austerity' stated: 4. Do not accidentally leak your identity in one of million possible ways. [...] But #4 is next to impossible.
However, in the end, there is always text analysis though that can give your identity away, which the untraceable blog does not address.
That's why you possibly need a ghost writer that you provide with a script or a robot audio recording if you want to go 100% sure. You need to be able to trust your ghostwriter a 100% though then. :)
He runs his posts through google translate to another language, and then back to english.
The translation method is not really effective:
> We also show that automated attempts at circumventing stylometry using machine translation may not be as effective, often altering the meaning of text while providing only small drops in accuracy.
https://www.cs.drexel.edu/~sa499/papers/adversarial_stylomet...
Both are easy to setup and are accessible by anyone using "inproxies" such as onion.to or i2p.us.
Another advantage is that you can host the sites anywhere even behind a firewall or a NAT as long as the computer it's hosted on can run Tor or I2P.
I personally have a preference for I2P, since this is its main purpose while Tor's hidden services are not the primary purpose of Tor (which is to anonymize users on the clearnet).
I should add: Goes under US Law, so forget pirating or illegal content.
So, just buy webhosting with Bitcoin at somewhere that does not require contact details.
e.g.
Sign up at the local library to cloak that IP then use tor after that if you think you will have a dedicated adversary.
Choose your own adventure:
a) He got to learn from his mistake.
b) That incident was recounted years later in the criminal indictment.
He obviously didn't think it was a serious issue at the time, but jesus, could you imagine how it felt to read about that one mistake years later? Makes you wonder what you have left online that might bit you in the ass years from now. I know i certainly couldn't run for office now!
Of course, your point is still valid. Perhaps even more so.
(These sort of leaks are always much easier to find in hindsight: no one ever noted the Shroomery or Bitcointalk or Stackoverflow leaks before the indictment was released, yet once you knew what you were looking for, you could find the posts in minutes.)
Instead - register Twitter nick and link your tweets to pastebin or similar repository where you'd post something worthy of reading.
Use Tor for all above.