0

I am using the Tor Browser not to hide from a government but instead to be safe from doxing by highly motivated ideological zealots. The content of my upcoming pseudonymous blog will be controversial, and I cannot afford to get doxed by those who may want to punish me for publishing the content. My fear is that these enemies will somehow get Wordpress.com to give up a list of all IPs associated with my blog (by using social engineering, fake administrative subpoena, hacking, etc.). Do I have any reason to fear that my real IP will be among those IPs?

I have always connected to Wordpress.com using the most current available version of the Tor Browser for Mac. However, I did have to enable JavaScript in order to use the Wordpress.com backend for my blog. Is the stuff I do as I administrate the blog somehow riskier than just visiting a website? Should I worry about JavaScript if my activities are limited to Wordpress.com?

Improve this question

2 Answers 2

Reset to default
1

When you say Wordpress, you should clarify: do you mean Wordpress the CMS, or Wordpress.com, the host?

Wordpress the CMS

Wordpress as a CMS is a freely available tool that can be used to quickly and easily make websites and blogs. If you're going to host a Wordpress site on the clearnet, you will have to sign up for a hosting account. This gives you the flexibility to choose a hosting provider with a good track record in security, but still makes you vulnerable to government intervention.

Another route to heavily consider is hosting your own Wordpress blog on the deep web. This limits your readership, but heightens your security greatly. You can use practically any computer made within the last decade to perform this task, and with a good tutorial you should be up and running within a day at the most, if not hours.

Wordpress.com the Host

If you were referring to Wordpress.com, then you were talking about a company that offers hosting of Wordpress blogs. From what I've heard from people using Tor Browser with Wordpress.com, the results are far from optimal. Speeds are slow, and the only security you gain is that Wordpress.com doesn't know where you are.

If you're worried about your Wordpress.com account being compromised over Tor, then yes, it's a possibility. There's something called exit node listening that lets someone at the end of your connection capture your username and password, as well as any other data transferred. Theoretically, if the runner of said exit node a) knew who you were, b) knew what to capture, and c) was a member of whatever evil organization opposes you, your account could be compromised. You also run many of the same risks you would on the clearnet; your account could be taken down by petition to Wordpress, or your account could just be hacked.

The IP release scenario you described is unlikely to be of much use unless you post information on your blog that could tie you to any specific area. Tor generates a new path each time you use it, so any IP logs that may be released will show addresses from everywhere. The JavaScript on the other hand can get nasty. Tor Browser is pretty good about keeping your privacy, but because JavaScript runs locally it can give actual computer information.

In Summary

If you want security, go with Wordpress as a CMS. You can download it from Wordpress.org. The risk of doxing is minimal, unless you post information that could lead someone to any real-life accounts or information.

If you want readership without using a Tor proxy (which is totally an option) AND you're dead set on Wordpress.com, the best I can say is to watch your back. It's far from the best option, but if you're careful you can probably be relatively safe.

Improve this answer
5
  • "hosting your own Wordpress blog on the deep web. This limits your readership," Limits it (probably) to people who already agree with you and people who seriously want to oppose you. In other words, anyone you are trying to persuade won't find you.
    – WGroleau
    Oct 9, 2015 at 16:50
  • "exit node listening that lets someone at the end of your connection capture your username and password" Wordpress, like any decent PHP application, allows you to enforce https-only access. Wouldn't that encrypt the authentication in a way difficult for most attackers to crack?
    – WGroleau
    Oct 9, 2015 at 16:53
  • HTTPS access requires obtaining a certificate, which can be difficult to set up over Tor while remaining anonymous. It can be done, but not through trusted vendors that are traditionally used.
    – ndm13
    Oct 10, 2015 at 5:37
  • If the server is not "deep" then the certificate doesn't need to be set up through Tor. Tor will just pass it through, no?
    – WGroleau
    Oct 10, 2015 at 22:53
  • You'd have to obtain it for your Tor address, which is still a little finicky among providers. That and you'd have to provide information to verify your legitimacy, which counts out anonymity. I'm not well-versed in HTTPS and Tor, but I'm fairly sure you can set it up, but not through standard channels.
    – ndm13
    Oct 11, 2015 at 2:48
0

There're a lot of aspects everyone should consider when using Wordpress as a CMS to host on Tor network. I would never recommend anyone to run a website like Avada with Revolution Plugins, WPML, Jetpack, etc.

The CMS as the core is secure and safe, stable and a lot of programmers keep an close eye to it (updates to Wordpress core are like a Christmas gift for a sysadmin), i'm pretty sure that you and i couldn't develop such a CMS secure. Now the plugins and themes are a total separate consideration. Setup and run it without nothing, that's a lot secure.

  • Now, how will we use the CMS? You have too many plugins consuming external APIs, even if you don't allow they policy to send statics, debugging information for error logs, etc.
  • To speed up the websites, themes uses CDNs to host the fonts, CSS, Javascript. This could be your vulnerability, remember what was told about SilkRoad and the recaptcha from Google?
  • The massive use of Javascript is by itself something bad in Tor community. Readers like me don't have Javascript enabled, does your site works properly?
  • Do you really need dependencies? Tor users are really used to ugly sites :)

Now you have a nice way to have a CMS like Wordpress secure: install only the core and do it all by your self or a trusted programmer. Don't let the code use external dependencies and follow all the guidelines you can found about keeping the HiddenService really hidden.

There's also the point of sniffing the exit nodes but that's another story. Also you're never 100% secure, that's an illusion. T0o many people on planet could exploit your server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .