gojo
10-12-2008, 10:34 AM
Hey C,
I've been thinking. We could do a bit to make this site more anonymous online. A few easy things:
1. Ask people to not upload off-site links to pics and files. But especially pics. Each time a pick is linked to photobucket (for example) C-W is exposed in terms of C-W's IP being logged and floating around, linked to a pic of an illegal act (in most cases). After you installed the albums Mod there is no need for offsite photo linking IMO. Maybe a sticky or some kind of welcome message when the user logs in?
2. Remove listing on google. Is C-W listed? Do you want to take it away from google? I think it's a good idea as we would be more 'word of mouth'. Maybe a good idea, maybe a bad idea...
3. Anonymize all offsite links from C-W so C-W IP doesn't show up in logs of a grow store or some other site like YouTube, Google, etc, etc, etc. As you know having C-W IP's linked to a site which could be under surveillance could then put C-W under surveillance, etc. But, anonymizing offsite links is pretty easy and I'm sure you got the skillz :ninja:
Anonym.to is a standard most sites use when they anonymize offsite links, and it's free. Also some hackers wrote a nice vBulletin Anonymizer Hack to easy install anonym.to script into C-W :) (see below) You can also white list links if you want to.
One thing to consider is using Anonym.to will create a 'single point of failure'. That is, if someone was watching traffic into/out of Anonym.to, or if Anonym.to had their logs taken it would be simple to correlate each link to C-W and visa versa. But, this seems to put C-W in no worse of a position then without the use of Anonym.to. IMO, it might be best to use Anonym.to as C-W's IP won't floating all over the place getting logged at each site.
The other issue is C-W member's IP addresses. Without anonym.to the users IP addresses would be in the logs of their ISP, C-W, the offsite website, any backbones or internet routers the packets had to travel. With anonym.to the users IP address would be in all the same places PLUS anonym.to...this to me smacks of a "honey pot" trying to harvet IPs and link them to the site they came from and are going to. Personally I think anonym.to is OK and it's been around a long time, but it is a risk of C-W's members IP addresses. Anonym.to could be innocent and some LEA could be sniffing packets which contain the users IP, source IP and destination IP, etc. I wouldn't put it past LEA and my threat model assume they are watching everything. The fact I use Tor (and correctly) makes me practically invulnerable to those types of attacks. But, most users don't use Tor :(, or any type of proxy...
http://anonym.to/en.html#info
The advantages of anonymizing your external links with anonym.to
Webmasters can use this tool to prevent their site from appearing in the server logs of referred pages as referrer. The operators of the referred pages cannot see where their visitors come from any more. Using the referrer removal service is quite easy: http://anonym.to/?http://www.gulli.com/ produces an anonymous link to gulli.com which prevents the original site from appearing as a referrer in the logfiles of the referred page.
Detailed instructions for the anonymizing script
Once the script is embedded in a website, it redirects all the links via anonym.to - except for the sites that were excluded when generating the script. In vBulletin, for example, you can include the script code in the footer of the global templates (Styles&Templates - Global templates - Footer). Alternatively, you can include the vBulletin Anonymizer Hack (http://www.vbulletin.org/forum/showthread.php?t=95753). In Wordpress, use the footer.php.
Since the script can only anonymize links that have already been loaded at runtime, it's a good idea to place the code as close to the end as possible. Otherwise, links that appear after the script code would not be redirected via anonym.to.
Anonym.to only disguises what page a visitor comes from. Surfers who don't want their IP address to appear in any logfile should have a look at the instructions for TOR (http://www.gulli.com/untergrund/tutorials/tor-anonym/).
Script to anonymize all the links on your homepage or board
If you want to anonymize all the external links on your board or homepage, we can generate a script for you to deal with this automatically for all your pages. Enter the Sites for which links shall not be redirected to anonym.to (e.g. your own) and click on "Generate script".
You only have to place the resulting code at the end of the body area (if possible, directly before the </body> tag) of your main template. (detailed instructions)
The script:
http://anonym.to/en.html#multiLink
<script src="http://js.anonym.to/anonym/anonymize.js" type="text/javascript"></script>
<script type="text/javascript"><!--
protected_links = "";
auto_anonymize();
//--></script>
I've been thinking. We could do a bit to make this site more anonymous online. A few easy things:
1. Ask people to not upload off-site links to pics and files. But especially pics. Each time a pick is linked to photobucket (for example) C-W is exposed in terms of C-W's IP being logged and floating around, linked to a pic of an illegal act (in most cases). After you installed the albums Mod there is no need for offsite photo linking IMO. Maybe a sticky or some kind of welcome message when the user logs in?
2. Remove listing on google. Is C-W listed? Do you want to take it away from google? I think it's a good idea as we would be more 'word of mouth'. Maybe a good idea, maybe a bad idea...
3. Anonymize all offsite links from C-W so C-W IP doesn't show up in logs of a grow store or some other site like YouTube, Google, etc, etc, etc. As you know having C-W IP's linked to a site which could be under surveillance could then put C-W under surveillance, etc. But, anonymizing offsite links is pretty easy and I'm sure you got the skillz :ninja:
Anonym.to is a standard most sites use when they anonymize offsite links, and it's free. Also some hackers wrote a nice vBulletin Anonymizer Hack to easy install anonym.to script into C-W :) (see below) You can also white list links if you want to.
One thing to consider is using Anonym.to will create a 'single point of failure'. That is, if someone was watching traffic into/out of Anonym.to, or if Anonym.to had their logs taken it would be simple to correlate each link to C-W and visa versa. But, this seems to put C-W in no worse of a position then without the use of Anonym.to. IMO, it might be best to use Anonym.to as C-W's IP won't floating all over the place getting logged at each site.
The other issue is C-W member's IP addresses. Without anonym.to the users IP addresses would be in the logs of their ISP, C-W, the offsite website, any backbones or internet routers the packets had to travel. With anonym.to the users IP address would be in all the same places PLUS anonym.to...this to me smacks of a "honey pot" trying to harvet IPs and link them to the site they came from and are going to. Personally I think anonym.to is OK and it's been around a long time, but it is a risk of C-W's members IP addresses. Anonym.to could be innocent and some LEA could be sniffing packets which contain the users IP, source IP and destination IP, etc. I wouldn't put it past LEA and my threat model assume they are watching everything. The fact I use Tor (and correctly) makes me practically invulnerable to those types of attacks. But, most users don't use Tor :(, or any type of proxy...
http://anonym.to/en.html#info
The advantages of anonymizing your external links with anonym.to
Webmasters can use this tool to prevent their site from appearing in the server logs of referred pages as referrer. The operators of the referred pages cannot see where their visitors come from any more. Using the referrer removal service is quite easy: http://anonym.to/?http://www.gulli.com/ produces an anonymous link to gulli.com which prevents the original site from appearing as a referrer in the logfiles of the referred page.
Detailed instructions for the anonymizing script
Once the script is embedded in a website, it redirects all the links via anonym.to - except for the sites that were excluded when generating the script. In vBulletin, for example, you can include the script code in the footer of the global templates (Styles&Templates - Global templates - Footer). Alternatively, you can include the vBulletin Anonymizer Hack (http://www.vbulletin.org/forum/showthread.php?t=95753). In Wordpress, use the footer.php.
Since the script can only anonymize links that have already been loaded at runtime, it's a good idea to place the code as close to the end as possible. Otherwise, links that appear after the script code would not be redirected via anonym.to.
Anonym.to only disguises what page a visitor comes from. Surfers who don't want their IP address to appear in any logfile should have a look at the instructions for TOR (http://www.gulli.com/untergrund/tutorials/tor-anonym/).
Script to anonymize all the links on your homepage or board
If you want to anonymize all the external links on your board or homepage, we can generate a script for you to deal with this automatically for all your pages. Enter the Sites for which links shall not be redirected to anonym.to (e.g. your own) and click on "Generate script".
You only have to place the resulting code at the end of the body area (if possible, directly before the </body> tag) of your main template. (detailed instructions)
The script:
http://anonym.to/en.html#multiLink
<script src="http://js.anonym.to/anonym/anonymize.js" type="text/javascript"></script>
<script type="text/javascript"><!--
protected_links = "";
auto_anonymize();
//--></script>