Staying Anon in the Modern World?

How do you do it? What resources are there? I've been searching and I've been lurking everywhere, but there's no compendium of knowledge, only fragments of good advice. Security is only as strong as its weakest link, and without having a fully-hardened system in-place, one-off tips will only slow down having your identity discovered. Online is a large and important area to cover, but IRL techniques (social engineering and the like) is welcome as well.

>>1863 To hinge onto this post, what are ways to stay anonymous with cellphone usage?

>>1863 You should also make sure to obfuscate your information as much as possible. Give fake infos and create different identities to go by online. Keep them consistent and don't "cross-contaminate".

>>1864 Burner phones bought with cash, from at least 200 miles away from where you live. (If they want you to register on their site to activate it, use a fake name and address. They won't check. Technically, that's pseudonymous instead of anonymous, but it's just as good.)

Well, I went looking and I found what I was looking for. There are basically two parts to remaining anonymous. The first is obscuring your digital fingerprint. This includes spoofing all identifiable values such as IP, MAC, useragent, timezone, disabling JS and other non-vital services (such as hardware like webcams and microphones), hardening your system's fail points (preferably in a distro that comes with a base for this like Tails), running all of your traffic on a delay through public wifi, etc etc etc. The main point here is that you need to study up on netsec forensics and cover your bases. The second is not letting your humanity expose you. Compartmentalize your life into meatspace and hackerspace. Cultivate a fake persona, just like you would a disk image, to throw off any peeping toms. Don't cross-contaminate your personas. Don't type like you would regularly; obscure your writing with linguistics. One in four hackers is a narc (appleman1234). Don't be flashy, keep it under wraps. Most people are found due to their imperfect human natures and not technical missteps. I have an entire list of info I got through researching and coming up with ideas on how to make it foolproof. However I won't share them, as it would ruin the OPSEC and make them less useful (albeit not to the spooks that monitor this board). A good place to start is searching the snoo for anonymity tips, then branching out from there. The online portion is simple, but difficult to follow forever and is like kicking dead whales down the beach when setting up.

And Tor is compromised. It's a good obfuscator when combined with other tools, but should not be relied upon by itself for vital anonymity.

>>1882 What exactly is compromised? care to elaborate and stop spreading FUD.

>>1906 The overhyped anonymity it provides. The number of nodes is not high enough for total anonymity, and an attacker with sufficient resources (state-sponsored) could easily crawl and dig into every node running through the Tor protocol. Statistical traffic analysis can then be used to determine with a greater than 50% accuracy which user is which, whose packets are whose, and where they exit. Tor traffic is distinguishable from regular traffic, and with the death of net neutrality should not be used as entry nodes. Tor has also become too widely used to not be bugged. The nations (specifically US) allow it to exist because the harm it does outweighs the benefits. Such benefits as convincing criminals that they're safe, enabling them to go relatively wild with their online interactions. This allows any party that's interested, to track and execute any user who no longer can be useful (as a bug, etc.). The maintainers of Tor have acknowledged this past complaint, but have said they will do nothing about it. Spoofing the network fingerprint was deemed too expensive. It's no longer safe to simply run tor by itself. A secured VPN, Tor, scramblesuit, and other tools are now necessary to have pretty good privacy.

>>1907 lmao, there are over 7K nodes. There isn't anything better than Tor at the moment, VPNs can degrade your anonymity since it is never built for anonymity. Tor existence is mostly because there are lots of people running nodes, it is easier for a state sponsor to bulk collect the biggest AS than running many nodes them self, Tor is made with that in mind. Most busts ( markets, forums ) have been due opsec failures or incorrect configurations, keep in mind that a state doesn't even need to run the nodes if these targets are usually running insecure software, in a case there have been a NIT deployed to catch people.

>>1908 >There isn't anything better than Tor at the moment I disagree. There are other tunnels you can run through (like freenet) which are less hot and can be bundled easier. >Most busts ( markets, forums ) have been due opsec failures or incorrect configurations, keep in mind that a state doesn't even need to run the nodes if these targets are usually running insecure software, in a case there have been a NIT deployed to catch people. I have read these too, but am unsure of their legitimacy. I would not put it past the state to lie about their operations. If there was a discovered vulnerability in tor, there is no reason to let the public know when it can be still used for more operations. I would also not put it past tornet criminals to create scapegoats then have them murdered to seal their tracks.

Pretty easy, i don't have a social life. Every profile i have is an online persona, people who know me, know that that persona is attached to me. There aren't many people who have to know who the real me is, so it's very manageable. If i had more friends, maybe that would become a problem, but i don't think it would be a necessity to have a standard profile with actual information, considering that people close to know will probably have means to contact you. The only problem is work, is hard for other people to trust you when you have no online presence to speak of. But if you're a freelancer or your persona already has an established presence, that can be circumvented.

>>1907 >overhyped anonymity Pointing out that Tor does not protect against your own made up design goals does not make it "compromised". >A global passive adversary is the most commonly assumed threat >when analyzing theoretical anonymity designs. But like all >practical low-latency systems, Tor does not protect against such >a strong adversary. https://gitweb.torproject.org/tor-design-2012.git/tree/tor-design-2012.tex >>1907 >Statistical traffic analysis can then be used to determine with a greater than 50% accuracy which user is which, whose packets are whose, and where they exit. >Spoofing the network fingerprint was deemed too expensive. I don't think that's true. Do you have sources for of this?

>>1909 >I disagree. There are other tunnels you can run through (like freenet) which are less hot and can be bundled easier. Freenet publicly displays your IP to random peers, and the US government does keep track of them. Using Freenet alone is enough to put you in a watchlist, and many people have gotten in trouble for it. I2P hasn't been properly audited. Tor hidden services are still probably your best bet.

>>1915 https://blog.torproject.org/blog/traffic-correlation-using-netflows >>1916 I didn't know this, I'll have to look into it more.

>>1909 freenet deanonymization attack http://ceur-ws.org/Vol-1873/IWPE17_paper_12.pdf

>>1917 Yeah ok you Googled "tor traffic correlation" and shared the first link. I was wondering where this 50% figure came from. That's an oddly specific detail in what is otherwise a woolly and confused post. >Spoofing the network fingerprint was deemed too expensive. I don't understand where this comes from either.

>>1916 >Using Freenet alone is enough to put you in a watchlist, and many people have gotten in trouble for it. And Tor doesn't get you on a watch list?

>>1919 You are being too assertive for just natural inquisitiveness. Have you something else on your mind but the truth? In the comment, arma makes a quick explanation for why it is not chosen to obscure fingerprint more due to high latency (relative to already high latency) which follows. In quoted papers " In experiments involving data gathered from real Tor circuits, we were able to correctly identify the victim in about 81.6% of the cases (with about 5.5% false positives)" from sample, yet 50% is a good tolerance to set, because more than 30% difference is too rare. Do not make mistake that tor is anything but a tool in a large Sear's toolbox, it is useless on its own. >>1920 Local authorities, likely. Adoption and large media prescence has muddied the water so now even computer iliterate can use tor. Freenet is different. Freenet is entirely child porn and unaccessible to dims.

>>1921 sure it's just a tool, but using tools together can degrade your anonymity specially if you use tools that are not made for anonymity.

>>1922 Not too mention that a VPN for example will increase your attack surface.

Me and my mate was discussing the other day on how to be a true anon. - Tor - I think this deserves its own thread, its a great discussion point but fear is the NSA controls to any nodes. While having an exit node isn't enough to comprise your traffic combine it with an intermediate node (I think that's the correct term) and yer fuarrrked. That's my understanding of it, but I'm quite ill informed of Tor just in general, so treat that as hearsay and nothing more. - VPN's - a simple recommendation to a lot people, issue as stated before there not built to keep you anonymous. The people running them have no reason to keep it that way with the right amount of money. - Restrict your movement and communication to only trusted sources - A cool theory but if you have a job and even a small social life it gets to annoying. INTERESTING THEORY! (Number 1) So considering these 3 above and some other small talking points me and my friend came up with two theories on how to do this. - Hide in plain sight - Consider everything you post, consider the risk. If its near no risk or very little post as yourself, does the risk have potential to drag you into something you don't want other people to know about, political opinion, sexual orientation, confidential information and the like. Post as an alias, hide your address through your personal preference. Highly risky material, I don't have anything that falls into this Territory but the risk is that if someone finds out the risk can effect yourself and other people very badly. Take every means to hide your online persona through any means and anything you think is secure. Going over secure for everything that I do effects a lot of the soykaf that I do and not everyone I talk to wants to communicate through OTR on XMPP INTERESTING THEORY (Number 2) - Physical disconnect - So this is what my friend came up with, I didn't catch the whole jist of it but a brief summary is to have all your traffic to be tunneled through multiple VPS boxes to a singular box where the two that are connecting have no way trace back that you where the original sender of the packets from that box. Its an expensive and I don't think there any solution out there on the market that can do what he describes but in reality it sounds fuarrrking awesome. I probably butchered the above comment, but I'll be talking to him again soon on some more technical information on how it would work. Plus as well its 2am and I have been up for A LONG TIME. Peace.

>>1922 >>1923 If using long-term VPN with no proper hardening, yes you will fail. Burner VPN tunnel will serve better. Gold standard in rat tunnels for browser is trilight and tor. For communication trilight, tor, and cspace (or zrtp).

>>1925 >hardening It isn't about the daemon but how VPNs are designed it opens a greater attack surface. You are doing it wrong and your threat model doesn't make sense. More hops doesn't mean it is better, more tools doesn't mean it is better and define burner VPN? How do you get those VPNs without anything linked torwards you in personal? Opsec is more important at some point because if you can't get that right the tools won't help you. If you want to communicate use Ricochet it is built specifically for secure communications without any metadata leaks.

>>1926 Foreigners cannot distinguish clean from dirty.

>>1921 >In the comment, arma makes a quick explanation for why it is not chosen to obscure fingerprint more due to high latency (relative to already high latency) which follows. I don't think refusing to increase Tor's latency is the same as "Spoofing the network fingerprint", but if that's what you meant then fine whatever. >Have you something else on your mind but the truth? I was calling bullsoykaf on a post that I thought was mixing fact and fiction to discredit Tor. Now I think I understand what was meant and it was just badly written.

>>1924 >While having an exit node isn't enough to comprise your traffic combine it with an intermediate node (I think that's the correct term) and yer fuarrrked. The middle node is unimportant but if the entry and exit nodes collaborate, that's what you have problems. Tor tries to mitigate this risk by restricting who can become entry nodes and having clients stick to using only a handful instead of rotating them frequently like with middle and exit nodes. >have all your traffic to be tunneled through multiple VPS boxes to a singular box where the two that are connecting have no way trace back that you where the original sender of the packets from that box And how does that work? The untraceable part. The ISP will always have a log of the connection between 2 machines. As will the data center where the machines physically reside. And don't forget that the company you are renting the VPS from have full visibility of everything that happens on the machine since they have physical access.

>>1924 Having a realistic threat model would be a good point for starters if you don't have one already. I see this often and there are usually many points where opsec fails like someone pointed out earlier with VPNs since you will have to buy/rent a VPN/vps you already broke your anonymity if you can't do this anonymous and then again VPNs are not made for anonymity, they may even increase the attack surface. But having a realistic threat model will be better than using more hops and more tools. https://ssd.eff.org/en/module/introduction-threat-modeling

VPNs were mentioned in conjunction with Tor. I believe this is correct. You should not let your ISP know you run tor, there is a lot that can go wrong. There is no reason not to setup an anonymous VPN in this day and age.

>>1934 Except that it doesn't work and increases your attack surface since most VPN providers have worse security than ISPs. "Anonymous VPN" doesn't exist because you are paying and connecting from your IP. If you don't want your ISP to know you are using Tor you can use pluggable transports [1] 1. https://www.torproject.org/docs/pluggable-transports.html.en

>>1937 Do not pay in your name or anything connected to you and do not keep logs.

>>1938 you are already making opsec mistakes here, pluggable transports are easier and don't require you to pay for anything plus it works.

>>1934 >You should not let your ISP know you run tor, there is a lot that can go wrong Assuming that using Tor is not illegal in your country, what are these things that can "go wrong" and are fixed by using a VPN? >>1938 >do not keep logs That is not your choice and as a VPN customer you have no way to enforce it.

>>1952 >That is not your choice and as a VPN customer you have no way to enforce it. Also a lot of VPNs have exit nodes, they could correlate the traffic.

>>1867 > Burner phones These can be identified in a day if you are really looking for a person, your phone may change but the people you contact don't

I use tor for most low-bandwidth things, and I have a VPS in another country that I use as a proxy server and seedbox. My browser is configured to act like the tor browser, and I block ads and scripts very aggressively. It's surprising how far you can get without any social media whatsoever. I have gainful employment and a somewhat active social life, and the only concessions I make are text messaging and sometimes steam or discord. Correlating me to my pseudonyms, where they exist, would be pretty difficult, especially for the ones I use for "important" stuff. There are no pictures online of me anywhere, except ones that my mom takes. What's more important than straight anonymity is presenting a false image of yourself, and I like to think I've done that quite well to the Powers that Be.

>>1959 >your phone may change but the people you contact don't If they're also using burner phones, it will look a good deal like they do.

>>2049 >My browser is configured to act like the tor browser, and I block ads and scripts very aggressively wow, another /re/tard who didn't bother to read the manual. keep up, mr anonymous >>2644 i doubt your contacts change their inhabited places and traveling paths as usually as their phones(Always argue in good faith and avoid using personal attacks.)

>>2650 >wow, another /re/tard who didn't bother to read the manual. keep up, mr anonymous lol I bet you think i2p is secure

What does it mean to be anonymous IRL?

>>2653 I knew a guy in college who never told anyone his name. He never had any friends.

>>2652 There are not enough academic research publications on topic of i2p, and I am not a qualified cryptographer to perform one. It seems to be secure through obscurity by now, since spooks are not interested in catching it's users yet. However, i do read manuals, and advise you on reading them too. Especially for tools you use on daily basis. Tor is an anonymity network and it is not supposed to be used with any other browser than TBB which is a heavily modified version of Mozilla Firefox. Other browsers do not behave the same way Tor Browser behaves, and therefore expose your anonymity, and since exit node list is public, you can be easily fingerprinted a-mong other tor users.

>>2654 sounds like trust issues m8 prolly was diddled by an uncle or something

>>2655 >However, i do read manuals, and advise you on reading them too. same here! >Tor is an anonymity network and it is not supposed to be used with any other browser than TBB which is a heavily modified version of Mozilla Firefox. This I know. I use tor browser inside a tor-restricted VM when anonymity is absolutely important, such as when doing something illegal. But for day-to-day browsing, it's significantly more convenient to use tor with a proxy switcher. About half the tabs in my bookmarks are configured to be connected to via tor. >Other browsers do not behave the same way Tor Browser behaves, and therefore expose your anonymity very slightly, yes. I know cloudflare is able to spot my spoofing, probably because I don't use NoScript which can be spotted from a mile away(seriously, why don't they just disable javascript at the browser level instead?). The tor browser website can't though. Anyway, I use tor pretty much exclusively to mask my IP, to mask the IP of the sites I connect to, and to help the network by adding innocuous traffic. I don't mind having a bit of a fingerprint, and I know to avoid leaving one when it's necessary.

>>2657 >>such as when doing something illegal edgy(Avoid using personal attacks and avoid spilling soykaf.)

>>1867 I get my burner phones from the trash

>>2658 yes, I download copyrighted media without paying for it. Truly the edgiest of the edgy.

>>2659 i bought one with cash, and apparently they gave me a psudonym when I signed up, they have a database with fake registration info that populates unless you specifically give them yours, at least boost/verizon did

Even 3-letter state agencies lack sufficient resources to make cross-correlation of activity at Tor entry nodes and exit nodes an effective strategy for unmasking Tor users. That was made clear in documents leaked by Snowden, in which NSA discussed the matter internally. - Relatively few Tor entry and exit nodes are operated by bad actors - You can mask your use of Tor from your ISP, etc., by simultaneously using a VPN - You can use an unlisted bridge instead of a standard entry node - Your Tor circuit changes frequently - If you use TLS, the exit node operator can't read your traffic anyway Tor, if used rationally, significantly enhances both privacy and security. That's why Agent Fud keeps trying to convince you not to use it.

>Relatively few Tor entry and exit nodes are operated by bad actors That is uncertain. how can you be sure that "le good anarchist cypherpunks collective" listed as node operators are not 3-letter agency's puppets? Government agencies don't even need to have direct access to computers running tor, only routers between them. And it is easy to guess who you are if attacker watches both ends, i.e your isp and website you access. Global rule here would be: do not connect to sites hosted in your country through tor >You can mask your use of Tor from your ISP, etc., by simultaneously using a VPN meek, fte and obfs bridges are enough to obfuscate traffic patterns if you are worried about plain tor traffic >You can use an unlisted bridge instead of a standard entry node How many bridges there are? 1000, 2000? Takes around 50 trained monkeys to bruteforce their getbridges captcha or mailing address to get almost all bridge addresses >Your Tor circuit changes frequently Not your entry point, even if you are not on home network, which in this case can be used to profile your movement (not an issue for whonix or tails, but they have unique fingerprint if used frequently on same network for exact same reason) >If you use TLS, the exit node operator can't read your traffic anyway Who do you trust here? Spooks can infiltrate a certificate authority and reissue their own certificate or exploit another heartbleed. Report signed by field agent Fud Jenkins, 9-12-2017

>>2688 >And it is easy to guess who you are if attacker watches both ends, i.e your isp and website you access. "easy enough" means it takes huge amounts of resources with the size of the current tor network. Gov would not do this passively. >meek, fte and obfs bridges are enough to obfuscate traffic patterns if you are worried about plain tor traffic >How many bridges there are? 1000, 2000? Takes around 50 trained monkeys to bruteforce their getbridges captcha or mailing address to get almost all bridge addresses this is actually inconsequential because they can just do an active probe of "suspicious" connections to see if they're tor bridges. https://media.ccc.de/v/32c3-7196-how_the_great_firewall_discovers_hidden_circumvention_servers#webm >Spooks can infiltrate a certificate authority and reissue their own certificate or exploit another heartbleed. Honestly, this is the biggest point of weakness. They should graduate to using libsodium or something.

>>1937 >>1939 Pluggable transports are a sham. Host your own bridge.

>>2690 >Honestly, this is the biggest point of weakness. They should graduate to using libsodium or something. This is a problem with the internet's public key infrastructure as a whole and has nothing to do with Tor. Switching to a different crypto library won't change anything either.

>>2692 >Switching to a different crypto library won't change anything either. libsodium isn't a drop-in replacement for SSL, nor does it do the same thing. Switching away from SSL would, necessarily, mean switching away from the aforementioned problem with the internet's public key infrastructure. >has nothing to do with tor dubious.

>>2702 >Switching away from SSL would, necessarily, mean switching away from the aforementioned problem with the internet's public key infrastructure. The post you are responding to is about questioning the effectiveness of SSL in preventing Tor exit nodes from sniffing your traffic. SSL is a property of the world wide web and has nothing to do with Tor. Who are you saying should "graduate" to libsodium and to solve what problem?

>>2711 Oh, I thought they were talking about Tor's inter-node encryption, which also uses SSL.

>>2713 But not the public key infrastructure.

>>1865 this is what i do. i have three aliases and two phone numbers; one of the identities i use only to make afk trades on sites like craigslist.

warning to newbies: this thread is like 40% FUD

>>1863 You must read enough to understand how to stay at Cyber-world. I don't care about RL, I'm another programmer who just sells some knowledge while at night (metaphor) I continue being better. No better like others. Better myself.

>>1864 you can't, not on smartphone services anyways. It used to be possible to proxy 2G signals.

today you have to ACTIVELY fight off surveilance by throwing fake info into the mix to confuse anyone who is looking at you, while also trying to hide all the soykaf you are trying to hide Can't do it any other way

>>4587 Let's say you are muddling true information about yourself with completely false ones. Would an adversary that is capable of mounting stylometry attacks on a wide scale (let's assume the entire internet) correlate all information linked to a particular linguistic profile into a ghost persona, and then link coherent pieces of information to each other and therefore limit its scope of investigation? They could just investigate the "alternatives personas" linked to the main ghost persona independently and eventually reach to a conclusion on which one is authentic. You would have to create thousands of fake personas to even remotely resist to an attack like this.

>>4587 The best way to hide soykaf is to not have it or hold it in the first place. Always place distance between yourself and the soykaf you are trying to hide, this is how managers at companies get awaay with everything. You never touch the soykaf, then there is nothing to find :P

>>4589 fuzz your data and add noise to every signal i'd assume. if you and your decoys all talk the same so to speak you'd be more difficult to differentiate i'm not 1337 though so take whatever i say with a grain of salt i guess

how do you strike a balance between being anon and being inconspicuous? i know spoofing is great but in a lot of things, especially meatspace, being anon will make you stand out even more. for example with the infancy of ubiquitous surveillance, wearing a mask to combat being spied on will only attract more attention and make it more likely for your adversaries to look deeper. but without a mask you're counting on security through obscurity which is practically giving up and handing your info over.

>>4716 use segmentation; You dont have to be in person, the same person you are online, or on all the places you are on online. And different online contexts can have different identities, still.

If you really want to stay anon you don't have any options beside one. Unplug. For resources I suggest going to library or antique book store, although using public wifi and burner hardened android for piracy and communication could pass because botnet is not really configured 100% atm. You will change, the books and other resources will mean more to you. Communicating slowly in form of letters is imo better for online friendship. You could do it through encrypted email. When it comes to everyday distractions you will have 0. When it comes to news and media you like, you don't need them they are all part of the thing we hate. I came to realisation that I am addicted to the brainwashing internet the same or if not even more than a normal person consumer eventhough I don't use any social media and have 0 friends. The snake has very good speaking skills. Internet should be used in doses and to really hack the system we need to think outside the box and stop being the members. Noone wants to accept the fact that life without the net is possible. ( snake in me now thinks and speaks : ) if you really really must have a number, official email, job search platform... you can get a phone for that with dedicated internet card. but learn from my mistake. never connect that device to your pc! never use it for any downloading. never feel depressed and watch youtube on it in your bed for days. try to beat yourself because if you restart the amount of time you will need before starting again is measured in months.

>>4743 >random lainon here That post really helped me open my eyes. <3 P.S. The picture is not to ridicule you. I just added it cause it's funny. :D

How would you go around anonymizing yourself yet still participating in present day? Especially when so many websites and sysadmins block TOR and the like?

>>5840 do you really want to participate in circles that deliberately block tor, or are you just going to suck it

>>5840 proxychains

>>5843 >neurosuggesting any given lainon is going to quit their job solely becuase "U GUISE DONT SUPPORT TOOOOOR" Come on, man. Don't make him out to be some corporate slave blowing the admins. There are legitimate reasons to block inbound and outbound TOR traffic. At your place of work...

>>1863 > don't try to be anonymous all the time Striving for perfect opsec at all times means you can't have any friends, hardly any social interaction and you're going to damage your mental health in the long run. Create a low opsec identity to keep you sane that isn't involved in anything that requires protection. Use multiple computers and only use your anonymous setup if needed. > don't try to create an anonymous identity This is where most people mess up. If you create an identity, even if it isn't linked to your real identity, is by definition not anonymous. If people are able to link actions to an identity they can also link your mistakes to an identity. > learn risk managment `risk = impact * probability`. Threat modeling is pointless if you aren't aware of your actual risks. If you are a random dude, you didn't commit any significant crime and nobody is trying to track you down there isn't much to worry about. If law enforcement is actively trying to get you you should obviously pay attention because impact=v& is no fun. > get in, do one thing, leave forever You can't "be anonymous", you can only "do something anonymously". If you do something, do not link it to anything, not even the other things you did anonymously. If you can't avoid accounts all together, create fresh accounts every time and discard/abondon everything and everyone afterwards. The thing you do should only take a few minutes, it if takes more than a few hours you're doing something wrong. If somebody can link 2 things together, you did something wrong. > know your tools If a team is actively trying to get you they're going to have multiple experts in their team: programmers, network engineers, security engineers and traditional investigators. Most people are caught be traditional investigators. Make sure you are familiar with OSINT tooling, but if you didn't violate the "no identity" rule there isn't much the investigator can do. Make sure you know all protocols and file formats you're sending over the wire by heart to avoid technical mistakes. If you don't expect to be investigated you don't have to worry about leet 0dayz either, those ain't cheap. > avoid custom tooling Do not stick out. If you run a fancy privacy setup it's likely you leave a unique fingerprint that can be used as evidence. You don't need to be safe against every active attack, you just need to hide in a big enough crowd. Keep in mind that the crowd that is running a default tor config and stock tor browser is huge.

Here's a funky pdf by HP analyzing the cybercriminals and their practices they've dealt with.

I'm interested in how to be as "normal" and inconspicuous as possible while still maintaining the amount of anonymity that I'd prefer. I know that for the most part I'm already fuarrrked as I have accounts for the big major tech giants and I own an Android phone, but I just wonder if I can make any significant steps towards at least trying to anonymize myself without taking the obvious steps of deleting everything and throwing away my phone. Usually, as my history shows, I have done my best to mask myself by using, as you guys are putting it, different linguistic profiles, just to keep other users from immediately recognizing me. I know this has little to no effect on anyone who might be trying to track me, but it's a step. VPN and Tor might be good first steps that I could invest in. It's something at least. I guess I just feel like I may as well not even try since I can even see the damn links myself as to how easily people could find me. I'm trying to cultivate a public persona as part of my creative pursuits and in service to that I've gotten sloppy over the last few months and done soykaf I never would have before. I irritate myself with how much I claim to value privacy and anonymity but in my actions I'm basically just as bad as everyone else. I really need to spend some time cleaning up my online presence, and separating things out I think. Too much soykaf tied to one identifier

>>1863 >resources Check out Michael Bazzell's books. They're exactly what you're looking for, specifically The Complete Privacy and Security Desk Reference Volume II: Physical.

>>6037 >execute a fail-proof firewall to protect your entire home network and devices Yeah that sounds like a real fuarrrking winner. Michael Bazzell also promotes privacy.com and similar services, complete with referral links. I can't believe that Lain would take him seriously.

>>6018 it's harder than you might think to link two unrelated identities. Cops and spooks need months of active surveillance to get that kind of thing.

>>6039 If you want to dismiss everything because of a couple disagreements, suit yourself. That said, this Lain is interested if you have any better suggestions.

>>6039 He was convincing on security weekly https://www.youtube.com/watch?v=iYhgwvCrDDc I don't know what you've got against referral links, osint and privacy training is his entire career. I haven't read any of his stuff but he is taken seriously by people I respect so I wouldn't blow him off just because some of his marketing is a bit cringy.

>>6044 This to be honest A lot of people I know who are also in the field praise him. I agree with this lainon and will withhold some skepticism when reading his soykaf.

>>1863 By trying to leave as little consistent spore as possible. Constantly change information about yourself, and your personality. Otherwise they can use correlative attacks to make a fairly accurate educated guess about you.

If I had some sort of techniques or secrets to maintaining my anonymity, why would I share it with strangers on the internet?

>>6229 if telling people your techniques for maintaining anonymity compromises your anonymity then they probably aren't great techniques... unless you have some other reason for hording information?

Don't touch the net Don't use a name Don't be a person

>>6229 Security through obscurity aint that great of security

>>1867 Just use a prepaid plan, bought with cash at the store, then never give out your real number, just use voip and give out multiple numbers.

One way to go about it is to learn everything about using each thing you are going to use, prior to using it, to the point that you can easily deduce, prior to using it, all the consequences of any action you take, and if some action has consequences that are not easy to deduce, don't take that action. This, of course, has the problem you can never deduce any such thing about this world, because this world is ruled by probabilities, where nothing is certain. Thus, learn probability theory, and how to apply it to this world, and then use probabilistic reasoning to find the best possible action, which is the action that causes the probabilistic expectation to be greatest. Until you get to the point of mastering probability theory and it's applications, use the princible of the conservative judgement, where you find the worst case scenario of each action, and find the (as close as possible to) best action based on which worst case scenario is least bad; or the principle of tenacity, where you continue doing things as you were doing prior, because it has sorta worked in the past, while improving the way you do things as you learn. People usually reccomend the latter, because it's not doing anything drastic, while reserving the former for extreme cases. In the end, there is not much general advice which is useful by itself, which is why good boards and chans tend to prefer threads that have a fairly specific focus, though some go a bit too far, alienating many new users by not providing a good selection of general introductions (my preferred method is to provide, in a sticky general-thread (what sort of general-thread it is probably depends on the board/chan, some chans have general-boards, some chans are general-chans), pointers to various sorts of external resources, each appealing to particular audiences). TL;DR Life can be easy, but a good life is harder. In any case, it's doable, if you know how; the question becomes how to know how. With that said: >one-off tips will only slow down having your identity discovered All current security/privacy is about slowing down the breaking of the system and minimizing the damage of the system when it does break. In terms of privacy, this means slowing down the discovery of the 'true' identity of one of your pseudonyms (whether the pseudonym is explicit (you give a (fake) name to each action) or implicit (people can infer that those actions were done by the same person)). Currently, we have reasonably fast techniques for slowing this process to where it will take longer than your life expencancy many times over of people actively trying to deduce this. Of course, using many techniques in harmony with each other tends to do significantly more than using one by itself. >pseudonymous vs anonymous Anonymity can be thought of as pseudonymity where the pseudonym is used for exactly one atom of social interaction. Sometimes it's easy to achieve this sort of "infinitesimal pseudonymity", but where it's not, nonanonymous ("noninfinitesimal") pseudonymity can suffice.

>>1867 God, my country makes you register your ID to get a SIM card, so my only recourse is to pay a soykaftonne extra to get them pre-activated at a local market Real pain in the ass

>>1863 Move to an impoverished country, abandon your identity, become the batman, return home and be anonymous.

https://www.invidio.us/watch?v=lLessJ4R6w8 This is a good start.

I've noticed a lot of people interested in anonymity hyperfocus on mitigating any perceived threat without looking at the bigger picture. You might consider NSA your adversary, but chances are they don't consider you an adversary. If you truly are, you're either already fuarrrked or you already know what you're doing. For the rest of us, there is value in simplicity and blending in. Yes, you can chain multiple VPNs/Tor, run your own bridge, etc. But then you have to worry about whether you can trust the VPN/VPS/colo, that you didn't fuarrrk some configuration up, and that you're likely to attract more attention because you don't look like other Tor users. This is why you should just use Tor Browser with default settings unless you have a really good reason not to. The more people who use Tor for benign purposes without trying to hide it, the more legitimate and secure the network becomes.

>>1863 use parrot VPN Anonsurf VM the information is out there fam.

>>7539 What merits does Parrot have over other options, like Tails, Qubes, or Subgraph?

>>7540 > >What merits does Parrot have over other options, like Tails, Qubes, or Subgraph? Bump for interest.

>>7540 I have not dived too far into it. it has every tool you would ever need or want. Some that Kali doesn't even have.

>>7540 >What merits does Parrot have over other options, like Tails, Qubes, or Subgraph? Tails is for anonymous communications via Tor + anti forensics Qubes is for "securely" isolating groups of software via virtual machines Subgraph is vaporware Parrot is for larpers

>>7548 >>7575 Like, I get it, I poo-poo kali and parrot all the time BUT. For an image I can download and slap on just about anything, it comes basically ready out of the box. Really the only reason I haven't completely abandoned "security" distros is bc of my personal laziness in not just making my own image. Kali and Parrot have bloat. Neither are stable. Just use Debian and roll your own. Don't be lazy like me :)