Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'd like to create a website with a very radical political message. It won't be unethical (encouraging violence, etc) but I feel the points I plan to list in it will definitely make me a lot of enemies.

How hard would it be to protect my identity from anyone finding out who I am? I know domains always have a $10/year option for privatizing your registration information but is there any other protection I should think about having?

share|improve this question
7  
You need to spend some time determining and then explaining just how anonymous you intend to be. Simply hiding your name, eg. whois protection, isn't going to do it. It'll help some, but more may be required. –  Su' Oct 18 '11 at 7:46
add comment

migrated from programmers.stackexchange.com Oct 18 '11 at 7:06

This question came from our site for professional programmers interested in conceptual questions about software development.

7 Answers

Summary

Minimising the attack vectors by not registering a domain, not registering hosting, not using a credit card, not openly giving out your IP and email address, not using Google Analytics, and not blabbing about your new project will each reduce the chance of your identity being discovered.

How might your identity be discovered?

To understand how to set up a website anonymously, you must first appreciate that your identity might be obtained via:

  • The WHOIS record for any domains you register.
  • Your IP address (sent in the header of emails you send and found in server logs).
  • Your service providers' account records (i.e. hosting, domain registrar, ISP).
  • Your email address.
  • Your credit card details or other payment method.
  • Your Google Analytics account information (if tracking more than one site).

How can you eliminate most of these things?

The simplest and best way to eliminate many of these things being used to identify you is this:

Don't register a domain or pay for hosting at all.

Instead, register with a free blogging platform such as Tumblr or WordPress.com, who give you a subdomain when you sign up (i.e. yoursite.theirbrand.com). Many human rights bloggers and campaigners choose this option because the main thing they have to worry about then is protecting their email and IP address.

You can protect your IP address to a degree using a VPN such as HideMyAss whenever connecting to the Internet, or by using the Tor network. You should turn the VPN or Tor connection on before registering for any services and while using them.

A search for 'anonymous email' will provide you with an address you can use to sign up to services anonymously.

Be aware that some free blog providers will delete blogs that might be deemed offensive. Read their terms and conditions before signing up and take backups of your content if it's important to you.

If you feel compelled to register a domain and buy hosting

If, for some reason, you have to register a domain and buy hosting, consider the following ways of safeguarding your information:

  1. Register the domain using an anonymous registration service (not the same as domain privacy), as mentioned in this question.

  2. Use an anonymous hosting service that allows you to register under a pseudonym and without providing a postal address, such as Anonymous Speech.

  3. Consider using hosting and registration services that support pre-paid methods that don't link your identity to the payment method (i.e. cash). As ever, be careful about sending cash by post.

  4. Think about registering a domain in a country outside of your own nation's jurisdiction and hosting your site somewhere else too. This doesn't prevent requests for information being sent to hosting providers, but it can add an extra barrier.

Each of these items alone will not protect your identity from someone determined to discover it, but together they will make it harder to find out who you are.

Be careful about using Google Analytics and other third-party services

If you use Google Analytics -- even on a hosted platform like tumblr -- you should know that it's possible to do a 'reverse Google Analytics ID lookup' by putting your site's URL into services such as eWhois and Statsie to find out what other websites you're tracking with the same Google Analytics account. This could potentially unmask you if you're not protecting your identity on other websites you run.

For that reason, avoid using Google Analytics or any third-party service that might be used to identify you. Blog using a basic theme and no add-ons, widgets, or additional third-party scripts that require registration elsewhere.

Choose a unique nickname

If you're going to blog under an alias, make sure you've never used that alias for anything else. Aliases you've used in forums years ago ('runningWithScissors') have a habit of showing up in search engine results.

Don't go blabbing offline

Also consider not telling anyone else what you're doing. There's no point in taking steps to mask your identity online if you're willing to give it away freely offline.

share|improve this answer
    
+1 Great answer with a very simple way to remove a lot of the 'tracking' issues (i.e. don't pay for anything) –  Jonathon Oct 18 '11 at 10:53
9  
Also note that a lot of local stores provide anonymous pre-paid debit cards. These work wonders for paying for things anonymously online. –  Earlz Oct 18 '11 at 15:48
    
@Nick great advice +1. Here's some more resources... Secure Email: Hushmail | Secure VPN: IPredator | Paying Anonymously –  Anthony Hatzopoulos Jan 18 '13 at 21:40
    
It sounds great "paying anonymously". But once being anonymous/ out of your countries juristiction maybe... what keeps the hoster from cheating you?.. great tipps though –  humanityANDpeace Mar 23 '13 at 15:46
add comment

The Whois privacy is barely a protection - most registrars will surrender your personal details at the first request. Well, perhaps at the second. Anyway, the point is, they are generally unwilling to take risk and get under fire so they won't bother to investigate who is right and who is wrong for a client that perhaps only brings $5/month of revenues.

  1. Your one option includes registering under fake name with fake address details. That will have the risk of you losing your domain name one day if they decided to validate your personality and contact details by calling your phone or mailing to your address.

  2. A more reliable and a long-term option includes registering an offshore company and running your site in its name. There are ways of keeping the list of owners (or at least the list of beneficiaries) very private so that even investigations at the government level may turn empty. The "$10/year" however won't cut it, you'll need a few thousands per year to make this work. Good news, there are service companies which will do this for you so you won't even have to fly to another country.

share|improve this answer
    
There is one thing you can do. afraid.org offers free sub domains. I'm sure there are other similar services. But their sub domains you get full control over (point at your own nameserver) and they don't require address or anything –  Earlz Oct 19 '11 at 15:22
add comment

The first step to protecting your anonymity on the internet is to decide what level of security you need. Are you concerned with hiding from well funded governments / political parties, or just the average Joe?

The Average Joe

If it's the latter, entering invalid whois data (don't pay for any of the supposed "privacy guard" services, they're just changing the whois data as well and providing temporary email addresses or other contact info) and registering for a dedicated (not-shared) hosting provider is probably good enough. If you're really concerned, you could even register a Tumblr / Blogger through the Tor network (1) and use that instead of your own hosting / domain. Be forewarned though, Tor is not a magical fix-all for this sort of thing. You need to know what it does, and how to use it for it to be effective (but that's outside of the scope of this question).

Governments, Political Parties, etc.

If you're truly concerned about protecting your identity from even the most determined attackers, I would recommend buying dedicated hosting and serving your site only via the Tor Network using a Tor Hidden Service (2). Though this will require a bit more technical know-how than a Blogger/Tumblr, it will be much more difficult for anyone to obtain your identity. Again, make sure you do your research if you go with this option. The hidden service is only as secure as the server / service you run behind it (So make sure your server is well configured and not leaking any private data). It is worth noting that this does make your service a bit harder to access, though it can still be done (even by people who don't use the Tor network) using services like onion.to (3).

For more information on Tor Hidden Services, check out this video (mp4 (4), ogv (5), ogv HD (6)).

The security mindset

As someone else mentioned, your security is only as good as the weakest link in the chain. Making sure you don't go around telling people (even people you trust) about what you're doing can also go a long way towards protecting your anonymity online. I can't stress enough how important this is; most people take for granted that they can tell people they trust without realizing how easy it is for others to leak information without even realizing it.

Some people will laugh, and tell you to "put on your tinfoil hat" but as far as I'm concerned tinfoil hats are a crucial part of the security mindset. Don't be afraid to be a bit paranoid :)

  1. Tor Project
  2. Configuring Hidden Services for Tor
  3. Onion.TO
  4. Tor Hidden Services video in mp4
  5. Same video in ogv
  6. Same video in ogv HD
share|improve this answer
add comment

The whois protection is good enough as far as I know. Obviously this is true for normal people. If police or similar will require your data, they will take them easily.

share|improve this answer
1  
Not true. I filed a complaint against a competitor once before on a potential copy-infringement issue and he came back with all of my "private registration" details (no, I don't know why he felt he had to send me my own info). Well, it turns out the guy worked for a registrar and had access to this info somehow. –  David Murdoch Oct 18 '11 at 22:02
    
@DavidMurdoch This is a role abuse I suppose. It is like a man in a call-center who get all your private data without any authorization. –  Aurelio De Rosa Oct 19 '11 at 9:09
add comment

Use a Hidden Service on the Tor-network with a .onion-domain. Unless you give out personal details yourself, it's impossible to trace back to you.

share|improve this answer
    
+1 worth considering although this is probably only nessecary to defend yourself against (international) government opposition. wired.com/threatlevel/2011/06/silkroad –  Colin Pickard Oct 19 '11 at 8:46
    
+1 That's probably the safest way. Running a hidden service with a .onion-domain is impossible to trace if you don't give out any details yourself. –  Victor Bjelkholm Aug 30 '12 at 19:49
add comment

There is a blogger, writer and scientist in the UK who went by the nom de plume of Belle de Jour - because she wrote about being a practicing prostitute. She wrote a book (and some more later) and her book was made into two TV series. She remained completely anonymous for a very long time before she was outed.

The way she did it is detailed here.

The advice is a little different to the above because it talks about how to set things up in terms of business structures and accountants so you can't be found out. It also talks about how somebody who knew her worked out and created a page on his blog that was a Googlewhack. Only somebody else who worked it out and searched for specific terms would go to the page so he got early warning and could get a message to her.

share|improve this answer
add comment

You might want to consider getting a separate hosting plan altogether for this purpose. With shared hosting, for example, it's trivial to do a lookup and see what your server neighbors are. Lots of sites can live at a given IP address, so this obviously doesn't pinpoint you, but it starts narrowing the list.

There are companies around that purport to provide anonymous web hosting, but you'll have to do your own research on that.

share|improve this answer
add comment

protected by John Conde Feb 2 '13 at 0:55

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?