1

Suppose you are administering a mailing list where only members/subscribers can post; but you want those members to be able to occasionally post some content to the list anonymously. (*)

Now, in an any-one-can-post list, you don't really have to do much: A subscriber can set up a dummy email address and post from there, and that works (albeit is a bit incovenient). But for the members-only-post scenario, I would need some sort of an anonymizer, which on one end can receive emails/files from list members, and on the other end authenticate as the user of some email account and post to the list with a subscribed address (e.g. [email protected]).

My question: Are there commonly-used mechanism for achieving this? If not, or if they're commercial and expensive - how difficult would it be to set something like this up, and can you sketch how it would work (I mean, with more detail than what I described)?

Notes:

  • I suppose there will is also the issue of spoofing of the anonymizer account. An answer which address this as well would be great, but I'm fine with just ignoring this concern for the purposes of this question.
  • Do not assume control or root access to the server running the list management software. Suppose it's some large mailing list provider service.
  • Most discussions on the list are not to be anonymized.

(*) - By "anonymously" I don't mean in the sense of "no person or group can ever be able to trace back the email except with millions of years of computation etc.", I mean "inspection of the mail message and its headers will not indicate who the message originated with, without a significant, government-agency-level effort of traffic analysis".

3 Answers 3

0

mailman mailing list already have a setting for that, see anonymous_list. This setting can be set by a list administrator from the web interface, it doesn't need access to the server.

On the other hand, if what you want is that your members are able to write to the list from new, temporary mails (so that even the mailing list doesn't know the poster identity), you can set a moderator password and let that be known by all subscribers.

Anyone in the group can by providing that password in a header so the email passes, or by directly logging in the web interface themselves and approving the held message they just sent.

2
  • I don't need my members to be able to write from new temporary emails, no. The mailman feature you listed is useful, but not in my case, since most discussion on my list is not anonymized. Also - I don't run the list-management software. I'll edit this into the answer.
    – einpoklum
    Sep 5, 2020 at 16:30
  • You don't need access to the server. I have edited the answer to note it can be changed from the web interface. It applies to all mails, though. You have strange requisites.
    – Ángel
    Sep 6, 2020 at 0:00
0

Use a designated whistleblower account

Ideally, I would do that through a web form. You tell your users to go to https://my.list.org/send-anonymous-message-to-the-list/ where they fill a message which will be sent to the list, and telling them a known-by-everyone password needed to use this system (so that spam bots don't get hold of it). This form would be sent using an identity allowed to post into the list.

Strictly, this doesn't need access to the list server, the form sending the email could be placed, even in Google Forms

However, a more basic approach would be to create a shared email account known by everyone. Then when someone feels the need to post anonymously he would log into that email account and sent it from there, the message received would simply point to that shared account.

Note that not all free email providers would work:

  • It should not include the IP address from which the email was sent in the headers
  • It must let several people to easily share an account (for instance, gmail would detect someone new logging in and block the access unless e.g. they provided a message sent to the creator of the email address)
  • Since the account itself is shared, it must not allow you to view the origin of your last connection, as that would reveal from which IP was the anonymous email sent.

Do note that this might allow someone to change the password of that shared account, thus blocking the rest of the people from using it. Also, the mere fact of encouraging anonymous messages, depending on its nature (e.g. badmouthing other members) and the community itself, could alter how this community functions.

3
  • About the shared email account - is there a way I could prevent it from being hijacked by someone changing its password?
    – einpoklum
    Sep 6, 2020 at 7:00
  • 1
    @einpoklum some provider may require 2FA before changing the password, or let you recover the account with access to sms. Or have it set up as a children account whose parent could change its password. You could always recover by unsubscribing the account from the list and creating a new one, but it's not desirable. OTOH, maybe no member of your list would actually do that.
    – Ángel
    Sep 6, 2020 at 16:35
  • Hmmm, a child's account. Interesting. Thanks.
    – einpoklum
    Sep 6, 2020 at 16:57
0

There are trivial solutions to this (e.g. webform on a .onion service) but there are conceptual considerations:

If you go for true anonymity, there will be a shared secret, and once it gets out, anyone can spam you until you change the secret.

Individual secrets (fancily cryptographic or not) are useless if you can’t tell which secret is responsible for the spamming.

There is already mailing list software that allows „anonymous“ posting, but it works by knowing and then forgetting. So everyone has to trust you that you won’t peek or tamper, and are able to defend your complete stack against peeking and tampering.

1
  • Not sure what you mean by "true anonymity". If you mean the anonymizing server/relay not being able to know the identity of the anonymized, then - I don't mean that. I mean list subscribers not being able to tell, by examining the message meta-data, who sent them.
    – einpoklum
    Jan 29, 2022 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .