2

I'm running an Apache server on an Ubuntu EC2 instance for some online friends, but they don't want me to be able to identify them in real-life. The hosted webapps require login, so it'd be easy for me to associate their username with their IP address.

IP-based geolocation is the biggest (and maybe only) concern my friends have, as far as I can tell. Which is why my approach is focused on preventing users from exposing their IPs to the server.

A tool like the following is promising: https://github.com/letorbi/mod_anonip, where it masks all traffic internally, so that the webapps will not have access to the whole IP. However, Apache and EC2 logs will still know the full IP, at which point I could easily check login timestamps from the webapps against the EC2/Apache traffic logs to unmask their IPs. So I'd need a solution for that, probably beyond just changing the logging settings, since that requires them to trust me completely.

Forcing users to use Tor is my best idea so far, but I know many of my friends are not tech savvy, and having to use an .onion link and Tor Browser is probably too much to ask. What's perfect about Tor, though, is that it makes it impossible for users to expose their IP.

Without Tor, my mind jumps to using a third-party to act as a proxy, somehow, and then only allowing traffic from that proxy to access my server. My friends don't care about third-parties knowing their IP. They just want to make sure I can't identify them.

Asking everyone to use a VPN opens the door for people to accidentally unmask themselves.

I've also considered creating a second, public server, to act as a proxy that has public, read-only access to the internal server and host (i.e. AWS), so that they can see for themselves there isn't any shady business going on. But of course they'll be concerned that I could always turn the logs back on briefly, save them, and turn them off again!

Ideally, online friends would be able to browse to the website on the surface web (not Tor network), and feel comfortable with the experience.

Up until this point, we've only interacted through third-party tools like Discord or online games, which automatically keep personal information hidden.

Note: I'm aware that professionals could use the other pieces of data, besides IP address, to identify users. My friends trust that I'm not nefarious or skilled in sleuthing peoples online identities.

9
  • 1
    This is not something you control at the server end.
    – schroeder
    Dec 16, 2022 at 16:40
  • 4
    Then this is a problem they need to solve for themselves. They have the power; you do not.
    – schroeder
    Dec 16, 2022 at 17:07
  • 1
    You dont need an onion address. Just allow access only from known Tor exit nodes. Or VPN IP addresses. And block everything else. So no one can connect with his real IP.
    – secfren
    Dec 16, 2022 at 21:39
  • 1
    @secfren But then the server's ISP may still record the user's IP, and firewall logs might contain it as well.
    – forest
    Dec 17, 2022 at 1:16
  • 1
    It will record IP addresses. Lots of them if this is a normal server which gets port scanned regularly. It should just be a single packet and nothing else. imo nothing what could be called usage or connection in contrast to using VPN/Tor. You are hidden in the noise. Logs could be disabled and in case of EC2 instances you could maybe use the AWS firewall to keep certain traffic completely away from the server. If you want to completely hide from the server provider then you need to enforce VPN or Tor on the users end.
    – secfren
    Dec 17, 2022 at 9:57

2 Answers 2

8

TLDR: Use Tor and .onion URLs.

You have already named solutions: proxy server, VPN, or Tor. Browser extensions for anonymizing use effectively also a kind of proxy.

Since your friends are not tech savvy, configuring proxy or VPN may be too error prone, especially if anonymization is needed only to access your server and not other web sites. That's why they may occasionally access your server without anonymization, without even noticing it.

Using Tor alone with normal URLs is also not reliable because it can be confused with a normal browser, e.g. is user uses normally FireFox and has not made much customization. If user has many browser windows open, Tor and FireFox browsers can be confused and your friends can enter URL of your server in the normal FireFox browser and thus expose their IP address to your server.

Limiting access to the Tor exit nodes does not help at all. If you make your server accessible via normal URLs and just limit access to the Tor exit nodes only, then some of your friends will enter your URL into the normal browser. It will access your server directly. Despite your server will refuse to serve the request, it will know the real IP of your friend. Then you can analyze your logs and with high probability associate such real IPs with logins done via Tor within a short time afterwards. The less friends you have the higher is the probability. After a few such mistakes you can be pretty sure whom belong the real IPs.

.onion URLs are better than proxy and VPN, because they cannot be opened in a normal browser. Thus your friends cannot access your server without anonymization and will not expose their IPs.

Independent on what approach you choose, especially if you prefer proxy or VPN, I'd suggest to display user IP address and their geolocation on the login page, before asking for user name. Then your friends will notice in case they are not anonymized, and will have more trust in case they see they are anonymized.

7
  • Thanks for thinking this through mentallurg. It's so helpful. Thank you! What do you think of @secfren 's comment about using a normal domain name, but restricting access to Tor exit nodes only? And maybe that looks like: show the geolocation info on the login page (genius idea!), but show "must use Tor to log in" if they are accessing through non-tor?
    – Drin
    Dec 18, 2022 at 0:49
  • 1
    @Drin You can use a regular domain and use alt-svc or that special HTTP header that specifies the onion site, allowing Tor users to automatically redirect to the Tor version while still having a memorable name. You can then restrict what resources can be accessed through the non-Tor domain.
    – forest
    Dec 18, 2022 at 1:57
  • 2
    @Drin: To using normal URLs: If you make your server accessible via normal URLs, your friends can mistakenly enter the URL in a normal browser and your server will know the real IPs. Then you can analyze your logs and with high probability associate such real IPs with logins done via Tor within a short time afterwards. The less friends you have the higher is the probability. After a few such mistakes you can be pretty sure whom belong the real IPs.
    – mentallurg
    Dec 18, 2022 at 12:57
  • 2
    @Drin: Take all the ideas including mine with a grain of salt. I'd suggest you to check time to time if the efforts you want to invest are commensurate with the expected results. There are many free JavaScript libraries that allow browser fingerprinting. Even a person without much expertise can integrate them into any web page. It is just a few lines of code. That's why it is pretty easy to associate every request to a particular user, even if the real IPs are not exposed to the server. It your friends want to avoid identification, it takes really much efforts.
    – mentallurg
    Dec 18, 2022 at 13:21
  • 2
    @Drin: I'd suggest you explain your friends that even without real IPs they are easily identifiable in the Internet. Then your friends will have to decide if they trust that you don't collect identifying data like fingerprints. If they trust, then may be they will also not insist on non-exposing their IPs. Thus just talking to your friends can save you a lot of efforts needed to implement complex technical solutions that hide actually only a small bit of identifying data.
    – mentallurg
    Dec 18, 2022 at 13:24
2

Unsure whether this is truly an answer, and it is probably not the expected one, but it is way too long for a comment.


I really cannot understand how you could not identify your friends if you ask them to login. Maybe you cannot directly link a user name to a real world name, but you will be able to link the various connections of your friends. That being said, the IP address you get for the same user may change over time if:

  • they use different hardware over the time (a smartphone, a tablet, a home computer and a corporate computer)
  • they use IP V4 and their provider do not give them a static IP but let it change over time (this is common for many ISP)

Furthermore, IP is not the only way to identify a computer. A browser generally leaks tons of informations inside the HTTPS protocol: the type and version of the browser, the size of the screen, possibly an email address, and a server can even ask for much more through Javascript. Not speaking of persistent cookies...

If I were you, I would not care too much for an IP address, and instead define and publish (in the sense present to all your users) a privacy policy saying precisely how you use the collected data. And if you want it to become opposable, you could ask one of your friends or a third party to audit your system to prove that your app does respect the published policy.

What I mean here, is that the best way for a site to respect client privacy is not by trying to never access any personal data (and implicitely saying that it can use anything it gets) but instead to acknowledge that it receives personal data but never willingly uses it and does its best to prevent leakage.

1
  • Thanks very much for the lengthy remarks and thoughts! IP address has the nasty attribute of often being able to geolocate people. And that, I think, is the primary concern for people. Anyone (I think) can type "where am I" into Google and see that it is shockingly close to their real location. It's unsettling to people trying to remain anonymous. I think I need to update the question to highlight the geolocation as the primary concern. I am aware of the many pieces of data besides ip addresses professionals can use to identify people. Thanks again
    – Drin
    Dec 16, 2022 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .