Ask HN: How to run anonymous services?

#1

Post by artas_bartas » Sun, May 05, 2013, 8:33 PM UTC

Recently we've built anonymous service for tracking and reporting petty bribery around the world [Web http://bribespot.com , Android http://bit.ly/11dCsIh ].

Our contributors mostly come from developing countries, and since law-enforcement agencies in some of those countries are corrupt, we designed our service to provide maximum anonymity for our contributors, e.g. no personal details are collected and no open IP logging taking place (IP addresses associated with submissions are stored in the DB in an encrypted format).

The problem is that anonymity opens the door to all sorts of nasty surprises - from spam and abuse to fake reports and blackmail campaigns.

How are you guys coping with problems that arise from running anonymous services? Anyone wants to share their experience?

Re: Ask HN: How to run anonymous services?

#2

Post by gwern » Sun, May 05, 2013, 10:24 PM UTC

> no open IP logging taking place (IP addresses associated with submissions are stored in the DB in an encrypted format).

Given how small the IP space is, does that actually add anything?

Re: Ask HN: How to run anonymous services?

#3

Post by rafstone » Sun, May 05, 2013, 10:25 PM UTC

Try instituting an expiration policy on your logs. Have addresses expire after some set amount of time. It might be a few hours, days, or weeks - whatever you determine to be the necessary time to prevent abuse.

Re: Ask HN: How to run anonymous services?

#4

Post by nilved » Sun, May 05, 2013, 10:42 PM UTC

While it doesn't directly answer your question, keep in mind the best thing you can do for maintaining your client's security is teaching them to use Tor. Nothing server-side will protect them because you may make mistakes, you may be compromised, or they may be MITMed.

Re: Ask HN: How to run anonymous services?

#5

Post by droithomme » Sun, May 05, 2013, 10:52 PM UTC

Why do you log ip addresses at all? What happens when you get a subpoena, you have to turn it all over, right? Wouldn't it be safer not to store that info at all?

Re: Ask HN: How to run anonymous services?

#6

Post by wyck » Sun, May 05, 2013, 11:17 PM UTC

Protect your sources by all means necessary if you want to built trust, the technology is in place to do this, the legal footing on the other hand can be tricky. You should host your servers in a country that has a solid legal framework in place to protect your data, Iceland for example. Honestly consult a lawyer who specializes in this, it is a legal issue and not a tech one.

The real problem is vetting your material, you will need to analyse and verify submissions before posting using real people, there is really no alternative when lives are at stake. This is the reason wikileaks collaborates with researchers and journalists, and there is an entire approval process. I must stress this point, you MUST have due diligence on your sources or else don't even bother.

Also keep in mind that several countries make anonymous services very difficult to use and even so they still might be monitored, you need to enable multiple avenues of submission and do a really good job at informing your user base on which is best.

You should have a very solid and dynamic server setup that can withstand attacks/DDos and domain name/ISP related takedowns.

tl;dr Learn from all the issues wikileaks had with tech and submissions and how they overcame these challenges.

Re: Ask HN: How to run anonymous services?

#7

Post by mschuster91 » Sun, May 05, 2013, 11:35 PM UTC

When you're dealing with bribery, you can't prevent blackmailing/fake reports at all.

What you can do, though, is to provide HTTP, HTTPS and TOR access to your webservice to allow everyone to submit stuff at his/her own security choice.

If possible, change your IP address(es) and domain names on random intervals; you can use free domains like .de.vu and friends to have reliable "entry points" (an example is canna.cu.to).

If you have an android app anyway, try building a "distributed" service like BitTorrent or Bitcoin for information exchange.

Re: Ask HN: How to run anonymous services?

#8

Post by MichaelGG » Sun, May 05, 2013, 11:43 PM UTC

gwern wrote: post #2

> no open IP logging taking place (IP addresses associated with submissions are stored in the DB in an encrypted format). Given how small the IP space is, does that actually add anything?

With a random IV and CBC, is it actually not secure? Assuming you have the encrypted entries, and can even create more on-demand, what can you do besides brute force the key? Plus, almost any 4-byte result is a valid result.

Re: Ask HN: How to run anonymous services?

#9

Post by earlz » Sun, May 05, 2013, 11:46 PM UTC

The real way to solve this problem is to make it distributed so that everyone can contribute and anyone can read all of the posts from a single node. Then there is no single way to get a list of IP addresses

Re: Ask HN: How to run anonymous services?

#10

Post by mschuster91 » Sun, May 05, 2013, 11:53 PM UTC

wyck wrote: post #6

Protect your sources by all means necessary if you want to built trust, the technology is in place to do this, the legal footing on the other hand can be tricky. You should host your servers in a country that has a solid legal framework in place to protect your data, Iceland for example. Honestly consult a lawyer who specializes in this, it is a legal issue and not a tech one. The real problem is vetting your materia…

The problem is that you can't really "vet" stuff like "Official Mr. XYZ demanded payment of US$ 20 so that I can get the permit faster".

Vetting a leak is easy. Vetting an accusation of bribery is next to impossible unless you're an undercover policeman and catch the bribed person red-handed (or, the building/exchange place is under CCTV surveillance).