In invitation-based systems, a user is allowed to join upon receipt of a certain number of
invitations from the existing members. The system administrator approves the new
membership if he authenticates the inviters and the invitations, knowing who is invited by
whom. However, the inviter-invitee relationship is privacy-sensitive information and can be
exploited for inference attacks: The invitee's profile (eg, political view or location) might leak
through the inviters' profiles. To cope with this problem, we propose Inonymous, an …