Privacy Mysteries at anoni.net/mystery

Dark blue Privacy Mysteries banner reading “Mistport Privacy Aid · Case board” above the title “Privacy Mysteries”, with a standing night heron on the right

Protecting your own privacy starts with knowing how information leaks. Privacy Mysteries, from the anoni.net community, puts readers in an investigator's seat: you look for what gives people away in photos, emails, files and websites, then use the evidence to rule suspects out one by one. Once you have traced the clues someone else left behind, it becomes easier to spot the ones you leave yourself.

You play an investigator at the fictional Mistport Privacy Aid, and every case starts with a request from someone who brings you a photo, an email or a list. There are two cases so far, Night Heron and Blue Magpie, each in English, Mandarin and Simplified Chinese, with an interactive edition, a static edition that needs no JavaScript, and a printable PDF.

Why we made a mystery game

On our docs site, Metadata, and why it matters sets out the time, device and location a photo can carry. Readers nod along, but when the moment comes to send a photo, few think about the file name, the time zone or what ended up in the corner of the frame. An explanation you have read does not always stay with you; working out for yourself what a photo gave away tends to.

Privacy advice is usually a list of things not to do: turn off location before taking the picture, strip metadata before uploading, do not click links in emails. Lists are easy to read and poor at explaining why. A mystery turns the perspective around and puts you in the seat of the person looking for the leak. Once you have watched scattered details get joined up, and a crowd of possible people shrink to one, you understand what each item on the list protects against, and you are better placed to judge the cases the list does not cover.

In privacy research, a group of possible people who cannot be told apart is called an anonymity set. Whether someone stays anonymous depends on how many people they cannot be told apart from, and every detail that leaks makes the group smaller. Both cases are solved this way. You name one person at the end, and what backs it up is the evidence that ruled everyone else out.

The situations come from things readers may actually face. Night Heron is an employee leaking from inside a company; the protections that apply are covered on the docs page Journalists and source protection. Blue Magpie is a billing notice with no link in it: people who searched for support as the email told them lost their accounts. It touches on email aliases, search ads and the linked devices of messaging apps.

Mistport Privacy Aid

Mistport Privacy Aid is a group of volunteers who help people with privacy problems: someone who leaked a document and fears being identified, someone who was scammed, someone whose account was taken over. The name comes from a harbour in fog, a place to tie up when you cannot see clearly. Fog, the volunteer on duty, gives hints on the internal channel and teaches you the terminal.

The stories are set in Taiwan in 2026, in real cities and districts, while every company, person and event is fictional. The game's internet has its own search engine (MistSearch), anonymous forum (Nameless Square) and photo network (PicNote) in place of real services, so no real brand is impersonated.

Night Heron

"I turned off location." A whistleblower leaks a photo of an internal memo on an anonymous forum. The company says it will find the leaker within 72 hours. Get there first and work out what that photo gave away.

Night Heron went live on 9 October. It practises EXIF metadata, time zones, file names, photo backgrounds, writing style and anonymity sets, and takes about 45–75 minutes.

Blue Magpie

"No link, so I thought it was real." A "3,480 a month" billing notice has no link, only a line telling you to search for support. People who searched lost their accounts, and the leaked list even had their hours of sleep. Find out who sold the member data.

Blue Magpie went live on 11 October. It practises email headers, lookalike domains, search ads, QR codes, linked devices and canary records, and takes about 60–90 minutes.

How a case runs

A case opens with an encrypted chat with the client. You choose a few replies and receive the material the client has gathered. As you investigate, clues are logged on the evidence board automatically, and you can pin pages, tables and logs there too. Every case hides a trap: a step that looks like the natural next move but would hurt the client. Fall into it and Fog explains why.

The case report asks a few multiple-choice questions and then asks you to name one person. Your rank, from Trainee Investigator through Senior Privacy Volunteer to Chief Onion Investigator, depends on how many hints you used, how many wrong accusations you made and whether you fell into the trap. The cases stand alone, so you can start with either.

Interactive, static and PDF editions

By 20 October both cases were available in all three languages and all three editions. The interactive edition simulates an investigator's computer with encrypted chat, a browser, files, an image viewer, a terminal and an evidence board. You type real commands such as exiftool and grep into the terminal. If you have never used one, switch on the beginner's helper; it does not affect your rank. On a phone the layout becomes one screen at a time, and the terminal defaults to command blocks you assemble by tapping commands and files. The interactive edition installs as an app, stores about 1 MB per language on the device, and works offline.

The static edition uses only HTML and CSS, for people running Tor Browser at the "Safest" level. The content is the same: each choice in the chat is its own page, terminal commands show their output when opened, and files can be downloaded in their original form.

The PDF is an A4 case file to play offline or on paper. The solution is on the last pages behind a black "stop" page, printed upside down, small and in light grey so nobody reads it by accident while flipping through.

The leaked photo in Night Heron is a real JPEG with deliberately written EXIF data, so you can download it and inspect it with your own tools. All three languages share one save; switch language halfway through and the chat and evidence board follow. The English edition still takes place in Taiwan, and its writing-style clue uses English habits instead.

Design choices

The site follows the same privacy principles the game is about: pages load no web fonts and make no requests to other sites. Tor Browser blocks remote fonts at its higher security levels, and the pages still render in full. Opening anoni.net/mystery in Tor Browser shows the onion address in the address bar.

On anoni.net, the interactive edition counts how many people start and close a case using our self-hosted Umami. It sets no cookies and sends nothing when Do Not Track or Global Privacy Control is on. All it sends is that a case was started, that it was closed, and the rank; who you accused, what you answered and which hints you opened are never sent. The onion version, the static editions and the PDFs collect nothing.

IP addresses in the cases come only from the ranges reserved for documentation, domains belong to the game's own brands or end in .mist, and QR codes contain commands for a fictional app, so scanning one opens no website. Where a case borrows from a real scam, it takes the technique and leaves out the original text, real names, real addresses and phone numbers. The cases stick to recognition and protection, never steps that could be used to track down a real person.

The source is on GitHub at anoni-net/privacy-mystery. The code is under MIT; the story, characters, dialogue, hints and images are under CC BY 4.0. The repository holds no plaintext solutions. Each case's solution is encrypted with the full name of the person you have to identify as the key, and the game can only decrypt it when you name the right person. Anyone who has solved a case has the key and can help edit the story; anyone browsing the source before solving it will not see the answer. With only a handful of suspects, trying every name would open it, so the encryption only guards against accidental spoilers.

How we hope it gets used

Above all, we hope readers of the docs site will treat the game as a place to practise. Play Night Heron after reading Metadata, and why it matters, or Blue Magpie after the guide to email aliases, and a concept becomes something you have done. It works the other way round too: where you get stuck in the game is often what one of the docs pages explains.

Both cases are designed for one player or two to four working together, and take 45–90 minutes, which fits a class or a workshop. The PDF can be printed for group discussion, so not everyone needs a laptop, and a venue without internet is no obstacle. A facilitator can have groups compare who ruled out which suspect first and on what evidence, then move on to the practical protections in the docs. For handing out materials on the day, see the docs page Handing things out at a workshop.

Reading groups and internal training at civil society organisations or newsrooms can use the length of one case to have new members check a photo's metadata and an email's headers with their own hands. They may not have time to read a full digital security guide, but having done it once, they are more likely to pause and look twice when it happens for real.

The content is under CC BY 4.0, so you can adapt a case for teaching, move it into a local setting or translate it into another language, as long as you credit the source with a link. We are also writing down the setting, so that future cases, including ones written by community members, keep their characters, websites and timeline consistent.

Ideas and feedback for the next case

There is a "coming soon" card on the case board, and we would love to hear your ideas for it. A privacy topic you would like to see, or a situation where someone gave themselves away, can go on the feedback page; a rough direction is plenty. Impressions, places where you got stuck and bugs go through the same page. Feedback is read inside the community only; what you write and how to reach you are not published. If you use GitHub, you can also open an issue on the project below, where it will be public. If you have used a case in a classroom or workshop, we would especially like to hear how you split into groups, how long it took and where most people got stuck.

Source code and bug reports: GitHub at anoni-net/privacy-mystery. Please keep answers out of issues, pull requests and commit messages
Real-time discussion: Matrix public room (home server im.anoni.net, link on the services page)
Anonymous tips: [email protected] (GPG key)