Starting an Anonymous Blog in 2019?

Well, if you're willing to accept my paranoia - here's what I did for a reasonable test. Again, it's only a start - there's more fun and paranoia to be had. At the end of the day it's about having an identity, not a blog.

1. Buy a credit card in cash from somewhere without cameras.

2. Use that credit card to buy a phone number through many of the real voip providers.

3. Buy a used laptop on CL/Kijiji in cash, making sure the pickup is someone's house. Bonus points if you make a friend do it.

4. Go to a Starbucks with your new laptop, sign up for gmail or protonmail using your new phone number.

5. Nuke your laptop and reinstall. It's a burner. Make sure you change the MAC address, just for profit.

6. Sign up for free VPN (500MB start) with something like TunnelBear, using your new email address.

7. Connect to your VPN from the laptop. Now use TOR.

8. Remember that credit card? Time to buy another one - this time so that you can pre-fund Amazon credits (or DO). They'll both accept prepaid credit cards.

9. Blog, do your thing - but only ever publish from a dedicated VM on the laptop. Make sure you're using firefox (or something else) in your VM to test your blog - through the SOCKS proxy you establish (ssh -D) to the host.

10/11. Nuke and rebuild VM and machine at will.

12. Every ~3 months, do a Kijiji exchange for a new laptop.

The above is in no way foolproof. But it's a reasonable start. For the record I don't consider this anonymous or paranoid enough.

> 1. Easier case: how to prevent being de-anonymized by curious individuals and specific corporations (e.g., multiple ISP's colluding together may be able to de-anonymize you, but for example a specific company like Google can't).

GitHub is Tor-friendly, so you can piggyback off GitHub pages with Tor/proxies and get something out of that at no cost. Occasionally, they may automatically determine you to be a bot account, but support is responsive and reinstates it within at most days if you seem human enough. Censorship remains an issue, but shoving the pages manually into archive.org should help build some resilience at least.

Maybe mirroring on BitBucket and GitHub will also work.

> 2. Harder case: ensuring anonymity even from state-level actors.

This is a very, very hard problem. Your best bet would probably be compromising a few poorly-secured websites outside the sphere of influence you're trying to hide from, doing this from a public hotspot in a foreign country and then connecting to them only via Tor. Of course, if Tor is enough of a red flag in and of itself, you'll always have to travel to post, which is just as suspicious.

Lots of good technical advice has been given and I won't rehash that, but I think there are lots of other methods you'll need to consider, too.

1) Time of publish. You'll want to make sure the times you publish entries are random and can't be correlated with things you are doing. If you take a vacation, you'll need entries going up.

2) How you write. You'll want to ensure your writing isn't too similar to your own. Either have others write it, excessively use synonym dictionaries, or introduce writing styles and elements exclusively to the posts you write.

3) What you write about. It should be as diverse as possible. If you only write about one topic, or clearly have a bias for one topic, then it is easier to pin down your interests and focus searches against you to that. Write about cooking, about programming, about art, about politics, etc. Even if you hate or aren't good at it.

4) Fabricate entries. You'll want to write about topics you dislike, or topics you don't believe in or about places you have never been. Reference dates and times that would be impossible with your schedule, your income, your skills, or your connections. For areas you are most versed in, introduce simple errors to reduce your apparent expertise. In areas you are most ignorant, plagiarize from experts in a non-obvious way to fake expertise.

5) Write in only your native language so as to not giveaway where you learned some other language. If this isn't enough, then run your writing through an automatic translator each time into some other language you might know and only do a light touch up of the most egregious errors.

You kind of get the drift. Lots of people here can give technical advice, but that is always one slip-up from going wrong and you getting caught. Having lots of disinformation and mixed information in the blog itself can help provide cover and deniability.

You have to blend in with the crowd to avoid sticking out. This means not buying a domain name (since domain registrations, even with contact information hiding, require real addresses in many cases for the registrar to process).

Then you use Tor to create a couple of ProtonMail and Tutanota addresses. Use these email addresses to create accounts on sites like GitHub while using Tor (make sure you link multiple addresses so that you have ways to get back in if one of them doesn’t work or you get kicked out).

Mirror all the writings on archive.org and another free site so that you have a backup to point people to (list the address of the other site in each site). Never trust any provider not to kick you out for “violating their terms and conditions” without telling you what you did or how you can fix it. When you get locked out, it’s usually with vague statements and no way to get back in. You’re at the mercy of bots and other people who may make it their mission to shut you down (depending on what you write).

Create multiple throwaway accounts without a lot of history to share the posts elsewhere.

Use Tor for everything related to the blog.

Edit: Building on what zelly said on translating from one language to another and back to reduce the chances of being identified by your writing. Somewhat similar in nature to hashing iterations, use one service to translate from X to Y, another to translate from Y to Z, and then yet another service to translate from Z to X. Then post X after making any necessary corrections. This could be automated with simple scripts. Using simple and short sentences could also help against any language analysis. Write, then feed it into something like Hemingwayapp, simplify it, then process it further with translation rounds.

Upvoted because this is a super important topic. I don't feel comfortable shining a spotlight on my industry because I don't trust that I could keep my identity secure. I imagine many feel the same way.

This is a very simple question to a very complex problem/issue. Simple answer it isn't possible. The current way the internet, law, and society works it is impossible to start a anonymous blog. You can create hurdles and do simple things that would stop the easy to find things. But, if someone or corporation really put any effort into finding you they could.

The internet was not design for people to be anonymous. Our law's weren't made to keep you anonymous. Our society doesn't allow for people to be anonymous.

Realistically the only way I could see this being possible on the standard internet and not some service like Tor, etc. is to register multiple corporations and hire multiple lawyers.

For instance register an LLC in your country or somewhere like St. Nevis, that owns a LLC in New Mexico, that owns another LLC in New Mexico that pays for hosting, then using ideally another chain of LLC's pay a lawyer to actually post the content on the blog.

Basically following the same standards as money laundering but with content publishing. That way anyone who wants to find out who actually published the content would have to track down the owners of multiple corporations and the legal barriers with that, especially with cross jurisdiction challenges this can be effective.

It wouldn't be cheap, and nothing is 100% bullet proof. However this would largely protect you against private corporations and individuals from tracking your postings.

People have already given the advice of hosting your blog entirely on a platform like Github.

Spitball idea: Host your data in the script portion of bitcoin transactions. Now the part you host on Github or other platforms is just the JS script that fetches your transactions from online blockchain explorers.

Use localbitcoins.com to trade cash for bitcoin face to face. Just trade $10.

The idea being that it's easier to pass around a JS script than the corpus of a blog. And platforms like Github are probably less likely to remove your pages if the potentially-troublesome plaintext of your blog isn't actually in their database. And the purpose of storing the data on the blockchain is so you don't have to keep rehosting content as it gets taken down.

I'll admit this is more of a fun weekend project (storing stuff on the blockchain with a JS script that can fetch and present it) that I've repurposed as an answer.

#2 is not a good idea. Do not attempt to publish information that could get you in trouble with any governments.

Instead, get connected with a tech-savvy media outlet via SecureDrop or Signal. They can publish the information, have experts on hand to help you stay anonymous, and can likely connect you to legal resources should that become necessary.

https://www.theguardian.com/securedrop

https://www.washingtonpost.com/securedrop/

https://theintercept.com/source/

https://www.nytimes.com/tips

1. Login to a hosted blogging platform with Tor Browser.

2. Put Tails on a live USB drive. Only ever do your blogging on Tails. Purchase hosting for a hidden service with Monero. Watch out for people tackling you in libraries.

1) Don't run your own infrastructure

2) Don't buy a domain name

3) Deploy a static blog (gatsby, jackyll, etc...) to Github or Netlify

4) Done

Now you just need a VPN every time you log into these accounts and publish your content.

You might also want to randomize the times you access these services and publish content. That further obscures where you are in the world.

Off the top of my head:

1. Use all free technology since payments are a great way to figure out who you are. (So gitlab/github pages, blogger etc)

And then the usual info hygiene:

2. Always use a VPN to log in

3. Don't use the same username or password anywhere else

One final thing:

4. If you put out enough samples of your writing anywhere else tied to your identity (email archives, a non-anonymous blog, publications), people can probably use ML to figure out who you are. I don't know if there is a "style obfuscation" engine to help with this.

Previous discussion:

"OnionShare makes it easy for anyone to publish anonymous, uncensorable websites"

https://news.ycombinator.com/item?id=21253668

Some great answers here, but if you're doing anything that involves going out and about (e.g. buying phones / cards / starbucks etc) - Don't forget to leave your regular registered phone(s) at home or office, and never allow burner and registered phones to be active (powered on) near each other.

This is a sore spot with me, because here in Germany you just can't. At least not legally. And more than that you have to openly announce your name and address on your website. It's called "Impressumspflicht". Theoretically it doesn't apply to "private" websites but there is enough ambiguity there that not including an "Impressum" is considered too much of a risk.

Some try to render the "Impressum" as a picture so that it doesn't get indexed by search engines but it's not clear wether that is sufficient.

You also can't just rent a post box somewhere to get around announcing your address. The address has got to be a "ladungsfähige Anschrift" which means that it has to be the place where you live.

For the former, just having a private domain registration, not putting any personal information on the site and avoiding any type of presence in media posted there (like face/voice in videos) will often be enough. Most people and companies aren't that technically inclined, nor motivated to try and track down anonymous creators. Unless you're being specifically targeted by a dedicated group of obsessives, no one would even bother looking into things like writing styles and background trivia.

For the latter case (or when dealing with said obsessives deliberately targeting you), then things get trickier. The challenge with infosec is that messing up even once compromises everything, and most people/groups mess up multiple times.

Some advice there:

1. Don't try and be a 'ghost', throw people off with fake identities. Manufacture social media accounts/history to send people barking up the wrong tree.

2. Use burner equipment wherever possible, or at least computers/phones that aren't used for real life activities.

3. Get an anonymous email account, use it for a VPN, use Tor, etc.

4. Access the internet from a variety of places under said conditions, maybe with different online identities each time

5. Use services based in countries your current one have no treaties with

6. Deliberately vary your writing style so it can't be linked to previous work (may be difficult)

Plus a whole bunch more steps that would make anyone writing them seem super paranoid when posting.

Several things to think about, weak points could be:

Domain name, since the registrar will probably have your information. Namecheap allows bitcoin payment, but I think they still require contact information. Going with an onion url would limit that impact.

Hosting, again, they will almost certainly have your information. Swisslayer allows bitcoin payments, but contact info might still be required. Could be mitigated by going with Tor or some other service, but that limits discoverability.

Server software -- you would want to limit the ability to be compromised, so something like OpenBSD with the built in httpd and raw html files would be a reasonable bet for preventing intrusion. Keeping it simple would leave less attack surface, and less potential to leak information.

Using Tor to connect would mean less logs between.

Any information you gave in content could be used to trace, but that is difficult and would require being careful in the writing style, and what information is leaked in that channel.

EDIT: As beefhash points out, piggybacking on an already accessible public endpoint negates a lot of the leaking of your information through your own services.

If you're trying to beat top tier state actors, and you're posting content of high enough profile, you're going to lose. There are too many fingerprints and timing attacks that will give you away. The way you construct sentences, the types of words you hyphenate, the way you spell words, the words you select, etc.

Id look into crypto space. Buy a unique blogging computer and connect to free wifi. These may not be the solutions, but possibly.

https://www.cryptovibes.com/blog/2019/01/02/iota-introduced-...

https://zeronet.io/

One route you could go down is sharing with a newspaper. Several newspapers have projects where they want to be able to accept stories anonymously.

E.g.: https://www.theguardian.com/help/ng-interactive/2017/mar/17/...

Don't get your own domain. Use a service like Wordpress.com. Register with them using a outlook.com alias. Use one VPN to set the account up then cancel that VPN. Then use another VPN to post new content. When administering the blog don't use your own machine and everyday browser - instead, spin up a clean VM.

If you were able to find someone, somewhere, who you otherwise have no relationship with, perhaps you could get that person to setup the blog, and post the messages that you send to them via some other (offline) method.

While clearly difficult, I'm not sure this is really any harder than the other technical solutions listed here.

Case 2 probably involves some (and likely a _significant_) amount of identity theft, and even then I don't think you can do better than pseudonymous - if you want your intended audience to reliably know which sources of information comes from you, then any and all adversaries can know the same.

0. Visit a library or starbucks in a nearby town using a computer that has no association to you (wiped or loaner)

1. Use TOR or some kind of proxy service

2. Sign up for Proton Mail

3. Use Proton Mail to sign up for wordpress.com blog

4. PROFIT!!!

Great thought experiment that I’d like to expand to the question of how to send a single anonymous packet on the Internet?

Use ZeroNet.io with Tor And fork ZeroBlog or use ZeroMe