Anonymousspeech.com security

[Dinitro]

I've been a long-time advocate for anonymousspeech.com, and have maintained an @anonymousspeech.com email for a few years now.

I need to ask for help from someone who's savvy with internet stuff to check them out, though.

Recently, during an unexpected outage, their URL redirected to their server host's default start page. This "outed" their host as "Server Intellect," a USA-based company! It's located in Florida, for crissakes.

I tried to ask their techs to explain why they're doing business through a USA-based host company, while claiming to be offshore and outside USA jurisdiction. They returned a reply that omitted any address to this concern.

In fact, their outage was long enough in duration that the boilerplate "Server Intellect" metadata replaced their website info in search engine results! (see attached screenshot).

Can someone help me out? I'm not skilled in online tactics, so can someone more advanced than me do all the usual cool stuff to check them out? You know, probe their ports, ping them, check their server location, etc?

I just want to double-check that they really are fairly safe,

 

[misterbean]

I've been a long-time advocate for anonymousspeech.com, and have maintained an @anonymousspeech.com email for a few years now.

I need to ask for help from someone who's savvy with internet stuff to check them out, though.

Recently, during an unexpected outage, their URL redirected to their server host's default start page. This "outed" their host as "Server Intellect," a USA-based company! It's located in Florida, for crissakes.

I tried to ask their techs to explain why they're doing business through a USA-based host company, while claiming to be offshore and outside USA jurisdiction. They returned a reply that omitted any address to this concern.

In fact, their outage was long enough in duration that the boilerplate "Server Intellect" metadata replaced their website info in search engine results! (see attached screenshot).

Can someone help me out? I'm not skilled in online tactics, so can someone more advanced than me do all the usual cool stuff to check them out? You know, probe their ports, ping them, check their server location, etc?

I just want to double-check that they really are fairly safe,

I am no expert, but know my way around nameservers, registrars, and servers in general.

You are correct that Server Intellect is hosted in the United States. Also of minor concern is that the domain name was registered to AnonymousSpeech LLC in Japan, but that their nameservers belong to a company in the United States from Arizona. That means the website anonymousspeech.com points to a server hosted in the United States.

This does not automatically damn them, it is common practice in large web applications to separate the database from the web server itself. A reasonable explanation is that most of their traffic is from the United States, having a server in the United States significantly reduces latency (the time it takes to load the web page) while the database is located offshore. Hence, if the server host was subpoenaed they would have to turn over the "face" of the website, but not any actual data from the database other than local metadata. It is troubling they simply did not explain this to you though.

This is still not 100% foolproof because data is still exchanged through the web application and may be captured. If their host has set up a data siphon similar to what AT&T was found doing, diverting traffic to the NSA, it could be stored and then later decrypted if technology advances to a point that allows it. Monitoring of the local network also poses a risk. This is a vulnerability present for dealing with any major internet service provider though.

In short: It is inconclusive whether this categorically makes them unsafe to deal with. It is impossible to tell. There will always be an element of risk transmitting from the US to outside the US because data can be captured at the transmission point, even if they cannot read its contents, if the end point is compromised, they can correlate the messages without ever needing your key. To err on the side of caution, find a totally offshore VPN/VPS/Email provider if this source spooked you, but if they have treated you well in the past I see no immediate reason to switch.

Alternatively, using Tor offers additional privacy over SSL based email.


Sorry if this is verbose, I hope it helps.

 

[jw2031]

If the servers are located in the US the records can be suppenaed.
Neomailbox has moved all there US based servers back to Switzerland for this reason.
Their is no reciprocity between the Swiss and any country in the world. Your right to privacy is upheld in this country.
I still recommend using PGP Encryption when sending sensitive emails

 

[ThinkTank]

If the servers are located in the US the records can be suppenaed.
Neomailbox has moved all there US based servers back to Switzerland for this reason.
Their is no reciprocity between the Swiss and any country in the world. Your right to privacy is upheld in this country.
I still recommend using PGP Encryption when sending sensitive emails

Not so quick. The Swiss can be coerced into cooperating when US interests are involved.

Example SWISS BANKING:
“Your account information may be subject to a treaty request from the United States to the Swiss Federal Tax Administration, which may result in your account information being turned over to the DOJ or IRS,” warned one by Cornèr Bank, sent to an American client and obtained by POLITICO. “A disclosure … can be used by US authorities for law enforcement actions, including … criminal proceedings.”

 

[EzekielAnon]

All this raises some serious questions for me. I am going to have to look into all this and report my findings back on this thread.