Hacker News Reader

I suspect that the author wants an anonymous VPS so that he has a computer that's not subject to physical seizure, e.g. TSA thugs grabbing it whilst entering or leaving the US. Plus the convenience of being able to access your VPS from anywhere you have a halfway trustworthy SSH connection.

You're thinking of Immigration and Customs Enforcement, which is in the Department of Homeland Security but is definitely not the TSA.

But anyway, they don't have the power to seize your US-based VPS as you cross the border. That would require an actual warrant which requires actual probable cause.

The author focuses on the US, UK, Australia, New Zealand, and Canada as the countries to avoid, but this seems crazy to me. The only common thread I can identify is that they all speak mainly English (sorry Quebec). There are lots of places I would avoid in addition to those; Iran, China, Syria, Libya, ... the list is nearly infinite.

Thank you for the correction, I said TSA when I meant DHS. I agree that they don't have the power to seize your VPS at the border: what I said is that they have the power to seize hardware that you have on your person, which is a non-trivial factor. They've proven themselves willing to abuse this power.

Another possibility would be to get one of the little computers that plug into USB or power socket and can do wifi, sneak one into a cafe or somewhere else with open wifi, and run TOR hidden service on that. It will get found and destroyed in time, but for some time, it might work. Or maybe solar powered Rpi that you put on someone's roof?

I'm not sure how well TOR hidden service would work behind a NAT though.

EDIT: another way would be to go to the dark side, and get your own botnet.

> I'm not sure how well TOR hidden service would work behind a NAT though.

Just as well as tor works normally.

> sneak one into a cafe

There are cameras everywhere. If they really want to find you, they will see your face.

Wear a mask.

I've been tempted to get ahead of the game and start wearing facial-recognition-jamming face-paint just as a fashion statement. Unfortunately, for this particular use case, the makeup makes you memorable in its own way.

Why not just walk around with a silly face all the time, and maybe a mustache?

So we should all steal Sacha Baron Cohen's schtick?

Illegal in some major US cities I believe. At least that is what my university used to claim to students every year around Halloween.

Install server. Wait a few months. Start publishing. No one is holding onto records that long and even if they do no one is going to go through that much video to find you. As long as you disguise your plugin server as something common no one will think to unplug it. Add a fake wire going behind something big for extra effect.

"media files often contain lots of entropy that could help identify the author, such as location information"

Please, please, explain this.

As an example, take a photo with a relatively new digital camera and open the JPG up with an EXIF reader. In all likelihood, you'll see GPS coordinates, the exact time you took the picture, along with the unique identifier of your camera.

See http://en.wikipedia.org/wiki/Exchangeable_image_file_format#....

That's surely not what kijin was referring to; that can easily be stripped out. Rather there's the problem of being able to determine location purely from the picture itself -- a picture contains a lot more information than just the particular thing you intend to point out in it.

Even if you scrub the EXIF data (which you absolutely should do of course) remember that it's likely possible to identify if you took a particular photograph with a particular device.

That isn't a danger that you'll be identified from the photo, but it prevents plausible denial at a later date.

https://www.schneier.com/blog/archives/2006/04/digital_camer...

This can be easily overcome by adding random noise.

Random noise only means you need more samples; it can't block a consistent pattern.

You can add a consistent random pattern.

You need a method that can't be distinguished from the native pattern. How much trust do you want to put in your algorithm being invulnerable to future analysis?

blur and threshold.

Hidden image data in photos that I know about:

(1) Exif meta-data (Exchangeable image file format) which are things like resolution and dates, but can include serial numbers as well. Here's a handy list of cameras (usually high-end ones) that betray your privacy by embedding a serial number:

http://www.stolencamerafinder.com/listmodels

(2) IPTC meta-data (International Press Telecommunications Council), though I have yet to see a photo "in the wild" that uses it.

(3) XMP meta-data (Adobe Extensible Metadata Platform). This is added by Photoshop for example. It's two long numbers (DocumentID and InstanceID) which are different for each image.

(4) DRM and anti-counterfeiting stuff that might be added by image editing tools. (Many color copiers do this in the case of paper prints, for example.)

I want to add some tips:

Exif is the one everyone knows, but don't discount #3 and #4 (i.e., identifiers added by image editing tools).

To keep a photo untraceable:

Delete the Exif data using a tool like IrfanView.

To edit the photo, download a fresh copy of an open source editing program or a commercial editing tool that does not need registration or activation. After you're done working on the photo, delete the editing program.

For a higher level of security (to guard against the possibility of a GUID or hostname from the OS being embedded in the image), do all of the above on a computer that is not traceable to you, or on a fresh install of the OS, which you wipe after you are finished.

Also, seed the network card with a fresh random MAC on eevery reboot, or more often.

"betray your privacy" is a pretty loaded way to say that.

Sensor noise can also be used to identify pictures taken with a specific camera:

http://wrap.warwick.ac.uk/3318/

If I were being truly paranoid, I'd use some steganography software to write random "data" across all the low-order bits of any images I _really_ didn't want traced back the the sensor in my camera/phone/videocamera...

Quick and dirty:

  cat imagefile | strings | less

To obfuscate meta-data in media files, use two different editors to covert file formats three times. eg Use Picasa to convert original to high quality jpeg, then use Gimp to convert jpeg to png

I gathered that he wants to be able to host a site like wikileaks anonymously.