49

I would like to contribute anonymously to projects on github. Not to cause mischief, more in the spirit of anonymous donations.

The tool of choice for being anonymous online seems to be TOR, which works well for almost anything you can do in a browser. However, to contribute on github, it appears necessary to use the command line interface, or the Mac app.

How can I channel my git operations in this setup through Tor? And how can I verify that this is actually what is happening?

Edit: please note the difference between pseudonymous (with a fake e-mail address) and anonymous (with an IP address that cannot be associated with an identity). Pseudonymous access to github is trivial; however, I am looking for anonymous access.

Greg Manitoba
  • 507
  • 1
  • 4
  • 4
  • 2
    get an anonymous email address to contribute. Only the GitHub guys can track people'IP, so time spent to needlessly hide doesn't seem to be worth it. Anyway no reason why git protocol wouldn't work over Tor, but I'm not an expert on this – CharlesB Apr 23 '12 at 06:54
  • 11
    You need an account on github to contribute, thus TOR on itself doesn't help you much. As CharlesB mentioned you need an anonymous email adress. Worth to mention, that it will not look very serious, if you not will stand for your commits. – KingCrunch Apr 23 '12 at 06:55
  • 23
    Also, I don't think that posting a message like this with your real name will help you a lot in your quest for anonymity :) – François Apr 23 '12 at 08:40
  • +1 for the real "unsung hero" :) – mihai Apr 23 '12 at 09:05
  • @François well, obviously. That's why this is not my real name. Sounds flashy, though, does it not? I quite like the ring of it. :-) – Greg Manitoba Apr 23 '12 at 11:36
  • 4
    @King the possible reasons one might have for doing this are beyond the scope of question or comment, but I understand the concern. But commits will always have to stand on their own based on quality, not reputation of the committer. Also note that one can combine anonymous and pseudonymous access to link a string of anonymous contributions to the same identity. Just not a real-life identity. – Greg Manitoba Apr 23 '12 at 11:43
  • 1
    @GregManitoba I don't think, that a commit "always have to stand on its own", but in my opinion its always bound to a committer/author. Even if the committer uses a pseudonym he should be available now, or even weeks later for question, or whatever. However, my main concern is, that a committer, that is completely anonymous doesn't look very trustworthy. This point of view is independent from any reputation. But you are right: Thats not part of the question. Just said ^^ – KingCrunch Apr 23 '12 at 12:28
  • I came along from the google looking for the same thing. Is there a way to proxy git pushes through tor? What port does git use? – RobKohr May 11 '12 at 20:00
  • As an Update: http://stackoverflow.com/questions/27279359/how-to-make-git-work-to-push-commits-to-github-via-tor – Emer Dec 12 '14 at 18:36
  • 3
    Possible duplicate of [Using a socks proxy with git for the http transport](http://stackoverflow.com/questions/15227130/using-a-socks-proxy-with-git-for-the-http-transport) – user Mar 30 '17 at 12:20

10 Answers10

24

None of these answers give a full useable workflow, I want to git push, not send an email! Here's how to do it properly but there's a bit of setup required. Instructions are for OSX

Publishing anonymously to github with tor+ssh

  1. Download tor browser bundle AND the tor command line proxy

     brew install tor
 brew cask install torbrowser

    1.1 In tor browser, Create a new email address ( I used hmamail).

    1.2 In tor browser, Create a new github account

  2. Create a new ssh key, only for tor with your new email address

    ssh-keygen -t rsa -b 4096 -C "satoshi_2@hmamail.com"

    2.1. Give it a name like: ~/.ssh/private_tor_rsa

    2.2. In github, go to SSH and PGP keys and add a new SSH key, make title memorable.

    2.3. In github, set Key to the public key you've just createdclip < ~/.ssh/private_tor_rsa.pub

  3. In github, create an empty repository, let's call it ByteCoin, don't initialise it with a readme.

  4. Edit the ssh config file ~/.ssh/config (create if it doesn't exist)

    Host github-tor-alias
User git
HostName github.com
IdentitiesOnly yes
IdentityFile ~/.ssh/tor_only_rsa
ProxyCommand nc -X 5 -x 127.0.0.1:9050 %h %p

    You've created a hostname called github-tor-alias and tells ssh to use a proxy on localhost:9050 and use the tor_only_rsa key to authenticate.

  5. Setup the config for your new project to use the tor proxy and credentials.

    mkdir secret-project
cd secret-project
git init

git config --add user.name satoshi_2
git config --add user.email staoshi_2@hmamail.com

This next line is bloody important

5.1. note the ssh://git and github-tor-alias 

    git remote add origin ssh://git@github-tor-alias/staoshi_2/ByteCoin.git

  1. Remember how you installed the tor command line proxy? start it as a service. It listens on localhost:9050 

    brew services start tor

  2. Are you ready? Try pushing to github:

    git push origin master

Did it work? Go and double check everything, have I missed something? please edit this answer!

Congratulations

breath that free air and get creating!

So what have we just done? we've created a new identity who is associated only with the tor network, as far as github.com is concerned, you are staoshi_2 and could be anywhere in the world.

tor runs a proxy on 127.0.0.1:9050, because we setup a ProxyCommand in the ~/.ssh/config file, all of your traffic goes through the tor proxy, git uses your new ssh key because you added IdentityFile and IdentitiesOnly to your ~/.ssh/config file.

Powerful stuff.

Let's double check that you're really anonymous

  1. stop tor and try to git push again, it had better fail!

    ssh_exchange_identification: Connection closed by remote host
fatal: Could not read from remote repository.

    8.1. If that git push succeeded well guess what, you weren't using tor, github.com knows your IP, figure out how to get it working and then start again with a new email address.

9. Happy freedom!

anon.

anonotree
  • 341
  • 2
  • 3
  • `ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050` is what worked for me. – rraallvv May 15 '18 at 20:02
  • I like to keep the SSH config, keys, etc. isolated from my main configuration. One easy way do this is to set `export GIT_SSH_COMMAND="ssh -v -F /anongit/ssh_config` for my shell. I also include `UserKnownHostsFile /anongit/known_hosts` in my `ssh_config` file. – ngreen Mar 21 '22 at 16:00
23

Have you considered going the old-fashioned 'mail them a patch' route? You could simply check out the repository (using Tor and Git-over-HTTPS if you want), make your improvements, then do a git diff and send the project owners the patch using any anonymous messaging service. Freenet and postal mail come to mind.

Note that if I were the owner of a large(ish) project, I would never ever accept a patch from an anonymous entity, for a few reasons. Even if the person in question isn't necessarily nefarious, having code in the system that nobody is responsible for is a scary thought at best. Also, think about code ownership and copyright troubles.

Wander Nauta
  • 18,832
  • 1
  • 45
  • 62
  • 2
    Consider using [`git format-patch`](https://www.kernel.org/pub/software/scm/git/docs/git-format-patch.html) instead of `git diff` so that the maintainer of the repository can use [`git am`](https://www.kernel.org/pub/software/scm/git/docs/git-am.html) to pull in your changes. – Justin T Conroy Jul 13 '13 at 19:08
  • Of course, `git format-patch` will add a `From:` line to the output with your configured full name and email address. That might not be what you want. – Wander Nauta Dec 05 '14 at 09:35
14

Before Tor there were cyber-cafes and wi-fi hotspots. Just because there's an IP associated with your commits doesn't mean it has to be yours.

SpliFF
  • 38,186
  • 16
  • 91
  • 120
  • 3
    also, if you use your own laptop, get a USB wifi adapter - although you CAN spoof the mac address they are also disposable – CQM May 17 '12 at 18:16
  • @nyuszika7h Not "perhaps", of course they can; anybody you connect to using TCP-based protocols can (and many more, that's for sure). Whether you send your patches via email or push them via ssh+git, you need to take measures if anonymity is truly important. – tne May 19 '15 at 21:13
  • @tne No need to be picky about the wording. I only said that the IP is never made public. – alexia May 20 '15 at 11:38
  • @nyuszika7h Apologies, my response was definitely too spontaneous (yours seemed spontaneous too, TBF ;)). Still, I don't think you can claim "the IP is never made public" so strongly, it simply depends on how you collaborate, who you collaborate with and which services you might potentially use from middlemen (MTAs might attach the source IP in the message, repository servers might track IPs, etc). Depending on the scheme you'll probably have to trust some parties, and proxies simply allow you to arbitrarily choose who or what (e.g. tor's security model) you trust. – tne May 20 '15 at 15:24
13

Configure git proxy server Getting git to work with a proxy server

or if this doesn't work with the TOR network, then simply run your git command in a virtual machine where the host machine is using the TOR network to connect to the outside world

I assume this will obfuscate the origin of your commit, but the anonymous email part may still be difficult.

Anonymous email providers come and go, but as of 2015 Lelantos is currently a TOR hidden service that offers clearnet email addresses. Payable in Bitcoin but you can anonymize all bitcoin transactions using http://www.xmr.to which lets you pay bitcoin receipts using the more private Monero network.

Why not simply do a pseudonymous email that you also create while in TOR, never access it from outside of TOR, and use that for github compliance

Community
  • 1
  • 1
CQM
  • 42,592
  • 75
  • 224
  • 366
  • 1
    [Here](https://www.torproject.org/docs/tor-doc-web.html.en) are the settings you should use to configure git proxy settings manually (localhost:9050). You should be able to use netstat to confirm that it is working - connections via Tor (80, 443, 9001, and/or 9030) and not via the git TCP port (9418) – Alex L May 18 '12 at 13:15
  • 2
    if all else fails, `torify git ...` just works. It's a nuisance not to forget, but it's simple. You can also set up iptables to make sure no ssh and git traffic ever goes out without tor, so you'd be sure to catch forgetfulness or configuration changes. –  Feb 23 '15 at 23:43
7

Most of the answers in this thread do not go about replying question asked.

You asked: Is it possible to use all applications of my operating system through tor, so as to make anonymous contributions. It might be necessary to do so in occasions where contributing to software projects puts you in legal risks (e.g. contributing to cryptography libraries where cryptography is illegal.)

You have been suggested to use postal mail (currently the most popular answer?), to go to the cyber-cafe next to your home, which very probably has a camera, and to use very brittle configurations which put you at risk. Some answers are outright stupid, and some others are valid enough, though they require everything to be setup perfectly to work.

It may happen that you (or some software you install) accidentally misindents or breaks a configuration file, causing your connections to go to github in the clear. Furthermore, it is possible that an ISP level attacker see which packages you are installing for development, and he is able to identify what sort of project you are working on.

This is in most cases, unacceptable. For me, and my current setup, it is necessary that:

  • All connections to Github are guaranteed to go through TOR.
  • All non-tor connections are dropped, and all DNS goes through TOR.
  • All TCP traffic from your machine is routed through tor. This includes apt-get, all the connections your IDE makes, everything.

This is very complex and is far out of my league. Luckily, there are distros which allow for this kind of thing, such as Tails or Whonix. There is another distro, Attack Vector, which might come with development tools, but is not as proven.

After installing one of these, you will be able to access github's interface through tor browser, and you will be able to commit either through SSH or HTTPS, whatever your preference, without special configuration.

I would suggest Whonix, since it's easier to persist data you need to work, and guarantees a root level compromise on the main machine does not compromise your identity.

John destiny
  • 87
  • 1
  • 1
5

You could try using the Cloud 9 IDE

Access it via Tor, create new Github and Bitbucket accounts.

Fork whichever project you want to contribute to, make your changes, send the pull request or patch

win

Community
  • 1
  • 1
A T
  • 13,008
  • 21
  • 97
  • 158
4

In Linux:

Install tor and head over to http://tormail.org/ to get yourself an anonymous email account.

Make yourself a new linux user on your local machine and generate a new ssh key for that user so that your anon account does not have the same public key as your other github accounts :-) You'll do all your anon work through this user account

Next sign up to github w/ your tormail email and install the public ssh key you just generated

Now install socat http://freecode.com/projects/socat. But you'll probably find it in your distro's package manager.

Now edit /etc/ssh/ssh_config and add 

HOST *
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050

Make sure that your tor is configured to use port 9050. You should see this in your torrc file: 

SocksListenAddress 127.0.0.1
SocksPort 9050

Now ALL your SSH is going to go through TOR, including any github access through the ssh protocol. so use the ssh protocol to do the clone: git clone git@github.com:bitcoin/bitcoin.git

use wireshark to verify that nothing goes direct to github.

iase
  • 41
  • 1
2

You could commit locally on a clone of the project, and then use git format-patch to send the commits via e-mail.

user1338062
  • 11,939
  • 3
  • 73
  • 67
2

Another simple solution:

$ git remote add tor https://github.com/yourUser/yourProject
$ torsocks git pull tor
$ torsocks git push tor

You obviously need to remember to put tor postfix in your git commands, or maybe you can configure aliases:

$ alias gpushtor="torsocks git push tor"
$ alias gpulltor="torsocks git pull tor"

(Note: it will only work with https:// remotes)

LotoLo
  • 327
  • 4
  • 17
1

You can use tsocks or torify to make any application work through Tor.

Aleksejs Popovs
  • 850
  • 2
  • 12
  • 18