HOW TO BLOG ANONYMOUSLY:Practice with Tor and Wordpress By Ethan Zuckerman

 

HOW TO BLOG ANONYMOUSLY

Practice with Tor and Wordpress

By Ethan Zuckerman

REPORTERS WITHOUT BORDERS

There are number of ways you can hide your identity when using the Internet.

Any path towards anonymity needs to consider local conditions, your own technical

competence and your level of paranoia. If you’re worried that what you're

posting could put you at risk and you're capable of installing it, posting to a blog through Tor is a very good idea. If you don’t really need to be anonymous, don’t be. If your name is associated with your words, people are likely to take your words seriously. But some people are going to need to be anonymous. Don’t use these techniques unless you really need to.

And remember not to sign your blog posts with your real name !

Do you remember Sarah,who was learning the basics of anonymous blogging in 2005?

Here are some reminders...

STEP ONE – PSEUDONYMS

One easy way Sarah can hide her identity is to use a free webmail account and free blog

host outside her native country. (Using a paid account for either email or webhosting is a poor idea, as the payment will link the account to a credit card, a checking account or

Paypal account that could be easily linked to Sarah.) She can create a new identity –

a pseudonym – when she signs up for these accounts, and when the minister finds her

blog, he'll discover that it belongs to “A. N. Ymous”, with the email address

anonymous.whistleblower@hotmail.com.

Some providers of free webmail accounts:

Hotmail

Yahoo

Hushmail - free webmail with support for strong cryptography

Some providers of free weblog hosting:

Blogsome - free WordPress blogs

Blogger

Seo Blog

Here's the problem with this strategy. When Sarah signs up for an email service or a

weblog, the webserver she's accessing logs her IP address. If that IP address can be traced to her - if she's using her computer at home or her computer at work – and if the email or weblog company is forced to release that information, she could be found. It's not a simple matter to get most web service companies to reveal this information – to get Hotmail, for instance, to reveal the IP Sarah used to sign up for her account, the minister would likely need to issue a subpoena, probably in cooperation with a US law enforcement agency. But Sarah may not want to take the risk of being found if her government can persuade her email and weblog host to reveal her identity.

STEP TWO - PUBLIC COMPUTERS

One extra step Sarah could take to hide her identity is to begin using computers to make

her blogposts that are used by lots of other people. Rather than setting up her webmail

and weblog accounts from her home or work computer, Sarah could set them up from a

computer in a cybercafé, library or university computer lab. When the minister traces the IP used to post a comment or item, he'll find the post was made from a cybercafé, where any number of people might have been using the computers.

There are flaws in this strategy as well. If the cybercafé or computer lab keeps track of who is using what computer at what time, Sarah's identity could be compromised. She shouldn't try to post in the middle of the night when she's the only person in the computer lab – the geek on duty is likely to remember who she is. And she should change cybercafés often. If the minister discovers that all the whistleblower's posts are coming from “Joe's Beer and Bits”on Main Street, he might stake someone out to watch the cybercafé and see who's posting to blogs in the hope of catching Sarah.

STEP THREE - ANONYMOUS PROXIES

Sarah's getting sick of walking to Joe's cybercafé every time she wants to post to her blog.

With some help from the neighborhood geek, she sets up her computer to access the web through an anonymous proxy. Now, when she uses her webmail and weblog services, she'll leave behind the IP address of the proxy server, not the address of her home machine... which will make it very hard for the minister to find her.

First, she finds a list of proxy servers online, by searching for “proxy server” on Google.

She picks a proxy server from the publicproxyservers.com list, choosing a site marked

“high anonymity”. She writes down the IP address of the proxy and the port listed on the proxy list.

Some reliable lists of public proxies:

• publicproxyservers.com - anonymous and non-anonymous proxies.

• Samair (http://www.samair.ru/proxy/) - only anonymous proxies, and includes

information on proxies that support SSL.

• rosinstrument proxy database (http://tools.rosinstrument.com/proxy/) – searchable database of proxy servers.

Then she opens the “preferences” section of her web browser. Under “general”, “network” or “security” (usually), she finds an option to set up a proxy to access the Internet.

(On the Firefox browser, this option is found under Preferences – General – Connection

Settings.)

She turns on “manual proxy configuration”, enters the IP address of the proxy server and port into the fields for HTTP proxy and SSL proxy and saves her settings. She restarts her browser and starts surfing the web.

She notices that her connection to the web seems a bit slower. That's because every page she requests from a webserver takes a detour. Instead of connecting directly to

hotmail.com, she connects to the proxy, which then connects to Hotmail. When Hotmail

sends a page to her, it goes to the proxy first, then to her. She also notices she has some

trouble accessing websites, especially those that want her to log in. But at least her IP isn't being recorded by her weblog provider.

Sarah has another problem if she's one of very few people in the country using a proxy.

If the comments on her blog can be traced to a single proxy server, and if the minister can access logs from all the ISPs within a country, he might be able to discover that Sarah's computer was one of the very few that accessed a specific proxy server. He can't demonstrate that Sarah used the proxy to post to a weblog server, but he might conclude that the fact that the proxy was used to make a weblog post and that she was one of the few people in the nation to use that proxy constituted evidence that she made the post. Sarah would do well to use proxies that are popular locally and to switch proxies often.

Here is today how Sarah’s problems can be resolved through blogging with Tor and

Wordpress.

STEP ONE : DISGUISE YOU IP ADDRESS

Every computer on the internet has or shares an IP address. These addresses aren’t the

same hing as physical address, but they can lead a smart system administrator to your

physical address. Sarah feared that her identity would be discovered for the webserver

she was accessing logs her IP address.

Thus :

1. Install Firefox

Download it at the Mozilla site (htt://www.mozilla.org) and install it on the main machine you blog from.

Why Firefox rather than Internet Explorer? Explorer has some egregious security holas that can compromise your online security

(http://www.schneier.com/blog/archives/2005/12/internet_explor.html).

2. Install TOR

Download the programm from the Tor site : http://www.torproject.org/

(If access to Tor main website is blocked in your country, there are a few mirrors of it in

other places where it can also be downloaded from

(http://www.torproject.org/mirrors.html.en):

http://tor.cybermirror.org/

http://tor.zdg-gmbh.eu/

http://tor.anonymity.cn/

Pick the “latest stable release” for your platform and download it onto your desktop.

Follow the instructions that are linked to the right of the release you downloaded.

Tor is a very sophisticated network of proxy servers. Proxy servers request a web page on your behalf, which means that the web server doesn’t see the IP address of the computer requesting the webpage. When you access Tor, you’re using three different proxy servers to retrieve each webpage. The pages are encrypted in transit between servers, and even if one or two of the servers in the chain were compromised, it would be very difficult to see what webpage you were retrieving or posting to.

Tor installs another piece of software, Privoxy, which increases the security settings on

your browser, blocking cookies and other pieces of tracking software. Conveniently, it also blocks many ads you encounter on webpages.

3. Install Torbutton

Turning on Tor by hand means remembering to change your browser preferences to use

a proxy server. This is a multistep process, which people sometimes forget to do.

Torbutton makes the process a single mouse click and reminds you whether you’re using Tor or not, which can be very helpful. If you’re going to be writing primarily from shared computers (like cybercafe computers) or you’re unable to install software on a computer. Download XeroBank Browser (xB Browser) or alternatively Tor on a Stick (ToaSt).

XeroBank is a highly customized version of the Firefox browser with Tor and Privoxy

already installed. It’s designed to be placed on a USB key so that you can access Tor from shared computers that don’t permit you to install software.

Download the package from the xB Browser site onto a computer where you can save

files. Insert your USB key and copy the xB-Browser.exe onto the key. Using this USB key and any Windows computer where you can insert a USB key, you can access a Tor-protected browser. On this shared computer, quit the existing web browser. Insert the key, find the key’s filesystem on the Desktop, and double-click the xB-Browser_latest.exe. This will launch a new browser which accesses the web through Tor.

Test that XeroBank Browser is working by visiting the Tor test site with the Tor-enabled browser and making sure you get a “Your IP is identified to be a Tor-EXIT” message.

STEP 2 : GENERATE A NEW, HARD TO TRACE EMAIL ACCOUNT

Most web services - including blog hosting services - require an email address so that they communicate with their users. For our purposes, this email address can’t connect to any personally identifiable information, including the IP address we used to sign up for the service.

This means we need a new account which we sign up for using Tor, and we need to

ensure that none of the data we use - name, address, etc. - can be linked to us. You should NOT use an existing email account - it’s very likely that you signed up for the account from an undisguised IP, and most webmail providers store the IP address you signed up under.

1. Choose a webmail provider

Hushmail, Vaultletsoft and Gmail, but as long as you’re using Tor, you could use Yahoo or Hotmail as well. Also, you can easily register a free and quick webmail account with fastmail.fm.

Hotmail and Yahoo mail both have a “security feature” that makes privacy advocates very unhappy. Both include the IP address of the computer used to send any email. This isn’t relevant when you’re accessing those services through Tor, since the IP address will be a Tor IP address, rather than your IP address. Also, Hotmail and Yahoo don’t offer secure HTTP (https) interfaces to webmail - again, this doesn’t matter so long as you use Tor every time you use these mail services. But many users will want to check their mail in circumstances where they don’t have Tor installed - for your main webmail account, it’s worth choosing a provider that has an https interface to mail.

Hushmail provides webmail with a very high degree of security. Their interface to webmail uses https and they don’t include the sending IP in outgoing emails. But they’re a for-profit service and they offer only limited services to non-paying users. If you sign up for a free account, you have to log into it every couple of weeks to make sure the system doesn’t delete it. Because they’re aggressive about trying to convert free users to paid users, and because their system uses a lot of Java applets, some find that Hushmail isn’t the right choice for them.

Gmail, while it doesn’t advertise itself as a secure mail service, has some nice security featuresbuilt in. If you visit this special URL, your entire session with Gmail will be encrypted via https.

2. Register your new account

Don’t use any personally identifiable information - consider becoming a boringly named individual in a country with a lot of web users, like the US or the UK. Set a good, strong password (at least eight characters, include at least one number or special character) for the account and set a good, strong password, at least eight characters, include at least one number or special character.

Choose a username similar to what you’re going to name your blog.

3. Test if it works!

Make sure you’re able to log onto the mail service and send mail while Tor is enabled. It is most likely that Tor changes its circuit every 10 minutes and this could disrupt your webmail operations, so you should consider limiting the process of writing a new email to 10 minutes.

STEP 3 : REGISTER YOUR NEW ANONYMOUS BLOG

You’ll have to be very careful by creating that blog. It requires more attention and caution than creating a non anonymous blog.

TURN TOR ON IN YOUR BROWSER, OR START XEROBANK

Visit Wordpress.com and sign up for a new account by clicking the “Get a New WordPress Blog” link. Use the email address you just created and create a user name that will be part of your blog address : thenameyouchoose.wordpress.com

Wordpress will send an activation link to your webmail account. Use your Tor-enabled

browser to retrieve the mail and follow that activation link. This lets Wordpress know

you’ve used a live email account and that they can reach you with updates to their service

- as a result, they’ll make your blog publicly viewable and send you your password. You’ll need to check your webmail again to retrieve this password.

Still using Tor, log into your new blog using your username and password. Click on “My Dashboard”, then on “Update your profile or change your password.” Change your password to a strong password that you can remember. Feel free to add information to your profile as well… just make sure none of that information is linked to you!

STEP 4 : POST TO YOU BLOG

Write your blog post offline. Not only is this a good way to keep from losing a post if your browser crashes or your net connection goes down, it means you can compose your posts somewhere more private than a cybercafe. A simple editor, like Wordpad for

Windows, is usually the best to use. Save your posts as text files (After blogging, always remember to remove these files from your machine completely, using a tool like Eraser or Ccleaner which is is available in many languages and wipes te porary files automatically from all installed browsers and other applications).

Turn on Tor, or use XeroBank, and log onto Wordpress.com. Click the “write” button to

write a new post. Cut and paste the post from your text file to the post window. Give the

post a title and put it into whatever categories you want to use.

Before you hit “Publish”, there’s one key step. Click on the blue bar on the right of the

screen that says “Post Timestamp.” Click the checkbox that says “Edit Timestamp”. Choose a time a few minutes in the future - ideally, pick a random interval and use a different number each time. This will put a variable delay on the time your post will actually appear on the site Wordpress won’t put the post up until it reaches the time you’ve specified.

By changing the timestamp of the posts, we make an attack more difficult for the internet service provider. Now they’d need access to the logs of the Wordpress server as well, which are much harder to get than their own logs. It’s a very easy step to take that increases your security.

STEP 5 : COVER YOUR TRACKS

Securely erase the rough drafts of the post you made from your laptop or home machine.If you used a USB key to bring the post to the cybercafe, you’ll need to erase that, too. It’s not sufficient to move the file to the trash and empty the trash - you need to use a secure erasing tool like Eraser or Ccleaner which overwrites the old file with data that makes it impossible to retrieve. On a Macintosh, this functionality is built it - bring a file to the trash and choose “Secure Empty Trash” from the Finder Menu.

Clear your browser history, cookies and passwords from Firefox. Under the Tools menu, select “Clear Private Data”. Check all the checkboxes and hit “okay”. You might want to set up Firefox so that it automatically clears your data when you quit - you can do this under “Firefox -> Preferences -> Privacy -> Settings”. Choose the checkbox that says “Clear private data when closing Firefox”. In case you cannot install programs on the computer, use the IE Privacy Cleaner tool from the USB stick to wipe temp browser data.

ETHAN ZUCKERMAN

Ethan Zuckerman is a fellow at the Berkman Center for

Internet and Society at Harvard Law School where his

research focuses on the relationship between citizen journalism

and conventional media, especially in the developing

world. He's a founder and former director of

Geekcorps, a non-profit organization that focuses on technology

training in the developing world, and was one of

the founders of webhosting company Tripod.