I intend to host a static website with OnionShare and, although I am almost sure that for my use case my intended setup is pretty safe, I would like somebody to confirm it to make sure. It should no be possible to associate the website with me (on a technical level. Of course, a strong security culture must be kept to avoid informational leaks on a social level). Any feedback would be greatly appreciated.
hosted on a device that only serves this purpose
on a public network (the network is sometimes used by other users to browse with the Tor browser, so additional tor traffic should not be something unusual)
only authorized users would have access to the website (private key transmitted over secure channels - e.g. in person)
using Tails 7.8.1.
expected lifetime of the website: a few months
expected traffic: low (less than 30 people would have access to the key)
the device is stored in a semi-public location (e.g. a social center), but hidden
I would be careful with calling this safe against a government-level actor. OnionShare/Tails can hide the network location reasonably well, but your weak point is the endpoint: a hidden device in a semi-public place can be found, imaged, swapped, or watched physically. If you still do it, I would at least use a fresh Tails persistent setup only for this site, keep the onion private key off the device when not serving, avoid any admin access from personal networks/devices, and assume that compromise of the box reveals the site and access list. For that threat model, a short-lived setup is much easier to defend than “a few months”.
Thank you for your answer! I agree, I have underestimated the endpoint weakness. I think I will do it with the improvements you mentioned and a few additional things.
fresh Tails persistent setup (only for this site)
no access from personal networks/devices
semi-public space should be low profile and thus in lower interest to the government to be watched / intervened
reduce the lifetime to the absolute minimum
device cleaned properly to minimize biometric evidence
I would not count “low profile” as a strong control here. If a government-level actor is in scope, physical access to the box should be treated as full compromise, even if the room looks uninteresting. I would add a simple failure plan: keep no identity material or access list on the machine, rotate the onion/private access key if the device is missing or touched, and have a short shutdown date from the start. Also be careful with the content itself: writing style, document metadata, and update times can identify the operator more easily than the Tor connection.