Anonymized posting mechanism for members-only-post mailing lists

Question

Suppose you are administering a mailing list where only members/subscribers can post; but you want those members to be able to occasionally post some content to the list anonymously. (*)

Now, in an any-one-can-post list, you don't really have to do much: A subscriber can set up a dummy email address and post from there, and that works (albeit is a bit incovenient). But for the members-only-post scenario, I would need some sort of an anonymizer, which on one end can receive emails/files from list members, and on the other end authenticate as the user of some email account and post to the list with a subscribed address (e.g. [email protected]).

My question: Are there commonly-used mechanism for achieving this? If not, or if they're commercial and expensive - how difficult would it be to set something like this up, and can you sketch how it would work (I mean, with more detail than what I described)?

Notes:

• I suppose there will is also the issue of spoofing of the anonymizer account. An answer which address this as well would be great, but I'm fine with just ignoring this concern for the purposes of this question.
• Do not assume control or root access to the server running the list management software. Suppose it's some large mailing list provider service.
• Most discussions on the list are not to be anonymized.

---

_{(*) - By "anonymously" I don't mean in the sense of "no person or group can ever be able to trace back the email except with millions of years of computation etc.", I mean "inspection of the mail message and its headers will not indicate who the message originated with, without a significant, government-agency-level effort of traffic analysis".}

Answer 1

mailman mailing list already have a setting for that, see anonymous_list. This setting can be set by a list administrator from the web interface, it doesn't need access to the server.

On the other hand, if what you want is that your members are able to write to the list from new, temporary mails (so that even the mailing list doesn't know the poster identity), you can set a moderator password and let that be known by all subscribers.

Anyone in the group can by providing that password in a header so the email passes, or by directly logging in the web interface themselves and approving the held message they just sent.

Answer 2

Use a designated whistleblower account

Ideally, I would do that through a web form. You tell your users to go to https://my.list.org/send-anonymous-message-to-the-list/ where they fill a message which will be sent to the list, and telling them a known-by-everyone password needed to use this system (so that spam bots don't get hold of it). This form would be sent using an identity allowed to post into the list.

Strictly, this doesn't need access to the list server, the form sending the email could be placed, even in Google Forms

However, a more basic approach would be to create a shared email account known by everyone. Then when someone feels the need to post anonymously he would log into that email account and sent it from there, the message received would simply point to that shared account.

Note that not all free email providers would work:

• It should not include the IP address from which the email was sent in the headers
• It must let several people to easily share an account (for instance, gmail would detect someone new logging in and block the access unless e.g. they provided a message sent to the creator of the email address)
• Since the account itself is shared, it must not allow you to view the origin of your last connection, as that would reveal from which IP was the anonymous email sent.

Do note that this might allow someone to change the password of that shared account, thus blocking the rest of the people from using it. Also, the mere fact of encouraging anonymous messages, depending on its nature (e.g. badmouthing other members) and the community itself, could alter how this community functions.

Answer 3

There are trivial solutions to this (e.g. webform on a .onion service) but there are conceptual considerations:

If you go for true anonymity, there will be a shared secret, and once it gets out, anyone can spam you until you change the secret.

Individual secrets (fancily cryptographic or not) are useless if you can’t tell which secret is responsible for the spamming.

There is already mailing list software that allows „anonymous“ posting, but it works by knowing and then forgetting. So everyone has to trust you that you won’t peek or tamper, and are able to defend your complete stack against peeking and tampering.