1

what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options?

I know about proxies, Tor, and VPNs. Should I do all three? I like computers but I don't know how often I want to configure Tor settings. How long does it take to learn? How good are VPNs as an option by comparison?

Also, what is an open VPN?

user3695903
  • 35
  • 5
  • Many of your questions are duplicates of existing questions - can you please make an effort to search before asking a new question? Thanks. – Rory Alsop May 01 '15 at 11:32

2 Answers2

5

There are two general levels of anonymity:

  1. Good enough for hiding from other routine users of the internet.
  2. Good enough for hiding from government law enforcement and surveillance agencies.

As you can imagine, the second level is much much harder to achieve; and usually unnecessary for law-abiding citizens in a democratic country without a security hobby.

Tor is a logical network and protocol that takes advantage of proxy indirection and encryption to produce some degree of anonymity; sufficient for level 1.

Normal VPNs are only as good as their resistance to external pressure to give up their connections logs or customer details. So again, only really sufficient for level 1.

Tor and VPNs serve a different though overlapping audience. Typically Tor is limited to browsing the web; whilst VPNs can be used to redirect any protocol. Either way you must ensure that all traffic passes through the indirection. For if some does and some doesn't, your anonymised identity is linkable to your real (ISP-mediated) identity.

Anonymity needs to be built from the ground up if you really care about it1.

Here are some steps you may need to consider, but frankly this starts getting outside the scope of Information Security stack exchange:

  1. Create a billing instrument detached from your normal banking details and identity. This might be a pre-paid debit card; a bitcoin wallet or some shady e-Gold site.
  2. Purchase VPN hosting from a vendor that doesn't mind the billing instrument you created in step 1. Preferably in a country that either hates your country or flouts international criticism as a tax haven, gambling den or the like.
  3. Perform steps 1 & 2 again through the VPN you have just established to purchase VPN hosting in yet another jurisdiction. Repeat steps 1, 2 and 3 until you have chained as many VPNs as you can stomach for brittleness and latency.
  4. Only create (and only use) various anonymous online accounts (email, social networking, voip, etc) through the VPNs
  5. Follow all usual advice for working through a VPN. Unless you want to fly too close to the sun like Ross Ulbricht of Silk Road.

Where possible try to have the last VPN as a vendor or at least an IP that is not currently known to be VPN; as many major sites will reject connections from VPNs2.

1. You probably don't. Once you realise the effort involved.
2. Tech-savvy trolls also like being anonymous.

LateralFractal
  • 5,173
  • 18
  • 41
  • There are a lot of other questions in your question, but most are product-specific; which isn't as important for anonymity and security as the basic principles. – LateralFractal Oct 22 '14 at 07:02
2

Browse using a Virtual Machine with a default installation on it. If you use Windows 7, install Office, but not LibreOffice. The fonts installed with these packages can identify you. Windows + Office is more generic and less specific than Windows + LibreOffice. Javascript and CSS can be used to detect what fonts you have installed. When you have some peculiar set of fonts, you can be identified easily by a website. Don't install anything else on it that installs new fonts! You can use Ubuntu as well, with a complete default installation. When you use a strange linux distro, make sure that you know what your browser sends out as user agent to the website - it may identify the distro you use.

Reset the machine after every use. Install updates when they arrive, then make a new snapshot and work from there. Always revert to that snapshot until the next update. When updates arrive, revert to the snapshot, don't browse, apply all updates, make a snapshot, then start browsing. Keep several older snapshots, so you can revert to them if needed. Going back you can update from there.

Use Firefox for browsing. You probably want to use browser addons like Adblock and Ghostscript or Noscript, httpseverywhere and privacy badger. Some addons may leave a trace - I don't know, but when using adblock, the other side can see that you block ads. That may be insignificant, but it's one small trace you leave. I would use all these addons, just be aware of this.

You may want to look into faking the browser agent. Remember what you did here - using various different fake agents linked to an IP or font profile or user account may generate suspicion.

SPRBRN
  • 7,449
  • 6
  • 35
  • 37
  • Browser fingerprints are notoriously hard to scrub. Way I see it is that anonymity beyond a certain level requires buying a separate laptop in cash that you only ever use for your anonymous or pseudonymous identity. And basically assume that the online behaviour and content of that laptop is known; only the association of the behaviour to a real person is unknown. – LateralFractal Oct 22 '14 at 09:11
  • How about a default Ubuntu LTS Virtual Machine which you always restore to its previous snapshot + Firefox with a browser agent spoofer, no history and cookies kept... How generic is that? Maybe XP or W7 is better because of its many more users? Or maybe not? I can't tell. – SPRBRN Oct 22 '14 at 10:35