Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users?
In this context, 'securely post anonymously' means that an attacker with full physical server access after the fact (eg. government seizure) cannot determine which user authored a given anonymous post. I've been unable to find an algorithm that meets these requirements.
My first thoughts:
- When any user logs in (regardless of anonymous activity),
)is used for user authentication as normal and
)is stored in memory on the server as an 'anonymous key' while the user is logged in (never written to storage).
- When a user creates an anonymous post,
hash(post ID + anonymous key
)is stored as the 'ownership token' for the anonymous post.
- When a user wants to edit an anonymous post, the system authenticates ownership by repeating the ownership token generation process and checking if the result matches the existing token.
- An attacker cannot search for the author of an anonymous post without capturing the author's anonymous key from server memory while that user is logged in.
- Since post IDs are unique, each anonymous post will have a different ownership token even if they are created by the same user, so an attacker cannot determine which anonymous posts share an author.
Detriments to this algorithm:
- A user wishing to post anonymously must have a normal account on the system.
- A user's profile cannot link to their anonymous posts, as the system does not store this linkage. The user must remember and find the post via some other means and ask to edit, at which time the ownership check will be performed. This distinguishes this question from a similar question where profile linkability with anonymity was the goal.
- When changing a password, a user would need to either tell the server about all anonymous posts so that the ownership tokens can be updated, or loose edit access to those posts permanently.
- An attacker with admin access to the system while it is running would be able to log the anonymous keys of users as they log in and later use these to break anonymity of the ownership tokens.
Am I missing any big things that would make this insecure under the definition of 'securely post anonymously' above? Is there a better (simpler, more secure, or fewer detriments) system for this? Does any algorithm for something like this already exist?