6 ms·

Ask HN: Critique My Paranoia

10 points by thrwyparanoid 11y ago

Hello HN. I have a procedure I'd like to use for accessing the internet in a completely anonymous way. Please critique my method ruthlessly. Step 1: Travel at least two hours from my address, preferably in another state, and purchase a burner laptop with cash and not in sight of any cameras. Also purchase a large capacity SSD and USB. Step 2: Travel at least two hours in another direction and purchase Amazon, Best Buy or Starbucks gift cards from a small third party shop. Step 3. Take the burner laptop to a remote coffee shop and use the Wi-Fi, again in sight of no cameras. Download Whonix and use the gift cards to redeem bitcoin and a VPN, making significant attempts to ensure the chosen VPN does not log. Step 4: Wipe the burner laptop and install the copy of Whonix. Immediately set up the VPN and set internet access to immediately fail and shut off if the VPN or Tor fails. Launder the bitcoin several times. Step 5: Put a piece of paper over the laptop with a checklist to review every time I go to open it, to remind myself of the various compartmentalization checks. Step 6: Create many different burner email accounts. Use a new burner email address for every website. User a novel username and password for every one. Step 7: Only access the internet using cafe Wi-Fi and other networks not tied to myself. Is this sufficient operational security to remain totally anonymous against every reasonable threat save for an extremely motivated nation state?

AnimalMuppet 11y ago
> purchase a burner laptop with cash Easy. > and not in sight of any cameras. Almost impossible, unless you're buying from a fence. Laptops are high-value items; almost every place that sells them has cameras on the area where they are sold. > Is this sufficient operational security to remain totally anonymous against every reasonable threat save for an extremely motivated nation state? You go to those extremes, and you're likely to motivate a nation state...
- thrwyparanoid 11y ago
  Two considerations: 1. I personally know of a large electronics chain that does not have a functional camera pointed at a register you can purchase a computer at. While the rest of the store does, I could try to think of ways around that and bring bags in my jacket that are opaque. 2. I could try to innocently go to the store on Halloween with a reasonable pretext for keeping a mask on in the store.
  - bhouston 11y ago
    Use an intermediary to buy the laptop for you in cash.
scholia 11y ago
You might still be tracked by device fingerprinting https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint Also, I guess you'd have to make sure you used a VPN that didn't keep logs...
- thrwyparanoid 11y ago
  Great point. I'd probably have to use ad-blocking software, Ghostery and even then do manual oversight on all outbound requests. I could use a sophisticated proxy to do this on the fly when necessary.
Mz 11y ago
Step 7: Only access the internet using cafe Wi-Fi and other networks not tied to myself. I spend a lot of time in libraries on public computers or on public Wi-Fi. Their policies often state up front that there is no expectation of privacy, that staff can check up on your activities if they have reason to do so. I have not paid much attention to policies at, say, Starbucks, but I wouldn't be surprised if they have similar policies. Furthermore, my understanding is that Wi-Fi has pretty big security holes compared to a landline. Plus, if you are a regular, people will recognize you. I gave up driving years ago and I walk everywhere. This is bizarre and noteworthy behavior in the U.S. People stop me and talk to me and say "I see you walking All The Time..." The degree to which people in cars notice me, recognize me and feel not only free but compelled to speak to me is downright creepy. So I will suggest that if you spend time very regularly in cafe's using their Wi-Fi, etc. people will not only recognize you, they will feel friendly and curious and like they have some goddamn right to grill you about your life and why you are there all the time and so on and so forth. I also agree with AnimalMuppet that the lengths to which you are willing to go in order to be "completely anonymous" raise enough red flags that someone, at some point, will take an interest in tracking your ass down and that "someone" may very well be a government agency. So while I get annoyed at how humans are wired and how they conclude they have some goddamn right to grill me merely because they fucking recognize me when I have no clue whatsoever who they are, beyond being annoyed as hell at the whole thing, I don't really need to worry too much because walking everywhere isn't actually a crime, no matter how bizarre and eyebrow-raising it is. But I cannot imagine any reason to go to the lengths you want to go that don't involve serious crimes and most other people will be far more critical of your motives than I am. I am pretty live-and-let-live. On average, other people are much more judgey, butt-in-sky and controlling than I am. So you can bet dollars to donuts that most people will assume you are up to something incredibly evil and that suspicion will fuel their interest in grilling you, tracking you down, etc.
- thrwyparanoid 11y ago
  Thanks for the reply, but I wasn't intending on visiting the same coffee shop twice. I'm sure people might assume I'm "up to no good," but that's not something I'm particularly concerned about. No one would really be worried about my appearance in person, nor would I become a regular anywhere. However, this whole point is probably effectively mitigated with a prepaid data card and mobile hotspot.
auganov 11y ago
Why not get a prepaid data card? Using tor on a public wifi is suspicious enough. If you're okay with disabling http (and all plaintext protocols really) then you're better off just using tor instead of a VPN. Keeps the trail of ip connections more distributed. If not you want to make sure you disable them during the process of buying that trusted VPN/S.
- thrwyparanoid 11y ago
  I have no experience with prepaid data cards. Can I purchase these in cash (easily)? That's a good strategy if so.
  - auganov 11y ago
    http://prepaid-data-sim-card.wikia.com/wiki/United_States http://prepaid-data-sim-card.wikia.com/wiki/United_States They will all take cash at retail locations, the only thing is you want to double check that they won't ask from an ID.It's not a requirement but it seems like some will ask. I was asked for my passport when I was in states couple of years ago. Maybe somebody can chime in.
bediger4000 11y ago
Instead of traveling hours out-of-state to buy a laptop, how about buying one used, maybe from a pawnshop or a garage sale or one of those one-man-show used computer stores? Its possible that pawnshops have cameras on all the time, but anything in it is likely to be, maybe not "hot", but disowned with extreme prejudice. You'd be putting a cut-out between yourself and the purchase of the laptop. The Step 5 checklist should include setting a random hardware address for the wireless card or ethernet port. Maybe you can obtain MAC addresses using nmap in one coffee shop, then use them in another shop. Step 7, get a USB wireless that lets you put a directional antenna with high gain on it, so you can actually be some distance away from the coffee shop, library, etc while you use it.
- thrwyparanoid 11y ago
  Excellent points...spoofing a MAC address and using an antenna would make things safer and easier. Thanks.
wingerlang 11y ago
Is this something you do on a regular basis? Do you do something "high profile" when you do this? Or do you do it everytime you access internet?
- thrwyparanoid 11y ago
  No, I don't do this all the time. I didn't even make this throwaway account in an obfuscated way. This procedure will only be used for things that I really don't want traced back to me. I'm not a blackhat or drug dealer, but I'd still prefer these activities not be associated with me. The only tedious bits are preparing the burner laptop's OS for compartmentalization and encrypted/anonymous internet connection (both, not one or the other). Once the machine is set up and I have a suitable amount of bitcoin and the VPN set up I don't need to repeat those processes for months or a year. However, I really like the idea of getting prepaid data with cash and exclusively using a mobile hotspot. I also like the idea of simply building a computer for this purpose and buying all the components separately.
deleted 11y ago
[deleted]
brudgers 11y ago
There are a lot of things more wrong than black hatting and the drug trade, and this smells at least like something illegal given all the concern about cameras. My critique, put your energy toward something that you are comfortable being associated with instead. Good luck.
mszyndel 11y ago
What about using Tails instead of Whonix? I think all this travel makes it easy to spot you on cameras (traffic, random street cams, etc) which may help to identify. I would go of less travel (maybe buy everything in close distance but far away/unconnected to your main residence)
- mszyndel 11y ago
  Also, unless you took all of those security precautions when publishing here, your cover is already blown. Have a nice day!
giaour 11y ago
Instead of buying burner laptops, buy commodity parts and build your own. They'll be much harder to trace. Also, keep in mind that the police are much more likely to find you by talking to people than by tracking your online footprint. So you should also fake your own death and never talk to another human again.
RexRollman 11y ago
You should visit the Friday Squid posts on Bruce Schneier's blog. There are often good conversations about this kind of thing.
rmah 11y ago
All that travelling is pointless, they will simply track your car.

10 points by thrwyparanoid 11y ago

AnimalMuppet 11y ago

> purchase a burner laptop with cash Easy. > and not in sight of any cameras. Almost impossible, unless you're buying from a fence. Laptops are high-value items; almost every place that sells them has cameras on the area where they are sold. > Is this sufficient operational security to remain totally anonymous against every reasonable threat save for an extremely motivated nation state? You go to those extremes, and you're likely to motivate a nation state...

thrwyparanoid 11y ago
Two considerations: 1. I personally know of a large electronics chain that does not have a functional camera pointed at a register you can purchase a computer at. While the rest of the store does, I could try to think of ways around that and bring bags in my jacket that are opaque. 2. I could try to innocently go to the store on Halloween with a reasonable pretext for keeping a mask on in the store.
- bhouston 11y ago
  Use an intermediary to buy the laptop for you in cash.

scholia 11y ago

You might still be tracked by device fingerprinting https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint Also, I guess you'd have to make sure you used a VPN that didn't keep logs...

thrwyparanoid 11y ago
Great point. I'd probably have to use ad-blocking software, Ghostery and even then do manual oversight on all outbound requests. I could use a sophisticated proxy to do this on the fly when necessary.

Mz 11y ago

Step 7: Only access the internet using cafe Wi-Fi and other networks not tied to myself. I spend a lot of time in libraries on public computers or on public Wi-Fi. Their policies often state up front that there is no expectation of privacy, that staff can check up on your activities if they have reason to do so. I have not paid much attention to policies at, say, Starbucks, but I wouldn't be surprised if they have similar policies. Furthermore, my understanding is that Wi-Fi has pretty big security holes compared to a landline. Plus, if you are a regular, people will recognize you. I gave up driving years ago and I walk everywhere. This is bizarre and noteworthy behavior in the U.S. People stop me and talk to me and say "I see you walking All The Time..." The degree to which people in cars notice me, recognize me and feel not only free but compelled to speak to me is downright creepy. So I will suggest that if you spend time very regularly in cafe's using their Wi-Fi, etc. people will not only recognize you, they will feel friendly and curious and like they have some goddamn right to grill you about your life and why you are there all the time and so on and so forth. I also agree with AnimalMuppet that the lengths to which you are willing to go in order to be "completely anonymous" raise enough red flags that someone, at some point, will take an interest in tracking your ass down and that "someone" may very well be a government agency. So while I get annoyed at how humans are wired and how they conclude they have some goddamn right to grill me merely because they fucking recognize me when I have no clue whatsoever who they are, beyond being annoyed as hell at the whole thing, I don't really need to worry too much because walking everywhere isn't actually a crime, no matter how bizarre and eyebrow-raising it is. But I cannot imagine any reason to go to the lengths you want to go that don't involve serious crimes and most other people will be far more critical of your motives than I am. I am pretty live-and-let-live. On average, other people are much more judgey, butt-in-sky and controlling than I am. So you can bet dollars to donuts that most people will assume you are up to something incredibly evil and that suspicion will fuel their interest in grilling you, tracking you down, etc.

thrwyparanoid 11y ago
Thanks for the reply, but I wasn't intending on visiting the same coffee shop twice. I'm sure people might assume I'm "up to no good," but that's not something I'm particularly concerned about. No one would really be worried about my appearance in person, nor would I become a regular anywhere. However, this whole point is probably effectively mitigated with a prepaid data card and mobile hotspot.

auganov 11y ago

Why not get a prepaid data card? Using tor on a public wifi is suspicious enough. If you're okay with disabling http (and all plaintext protocols really) then you're better off just using tor instead of a VPN. Keeps the trail of ip connections more distributed. If not you want to make sure you disable them during the process of buying that trusted VPN/S.

thrwyparanoid 11y ago
I have no experience with prepaid data cards. Can I purchase these in cash (easily)? That's a good strategy if so.
- auganov 11y ago
  http://prepaid-data-sim-card.wikia.com/wiki/United_States http://prepaid-data-sim-card.wikia.com/wiki/United_States They will all take cash at retail locations, the only thing is you want to double check that they won't ask from an ID.It's not a requirement but it seems like some will ask. I was asked for my passport when I was in states couple of years ago. Maybe somebody can chime in.

bediger4000 11y ago

Instead of traveling hours out-of-state to buy a laptop, how about buying one used, maybe from a pawnshop or a garage sale or one of those one-man-show used computer stores? Its possible that pawnshops have cameras on all the time, but anything in it is likely to be, maybe not "hot", but disowned with extreme prejudice. You'd be putting a cut-out between yourself and the purchase of the laptop. The Step 5 checklist should include setting a random hardware address for the wireless card or ethernet port. Maybe you can obtain MAC addresses using nmap in one coffee shop, then use them in another shop. Step 7, get a USB wireless that lets you put a directional antenna with high gain on it, so you can actually be some distance away from the coffee shop, library, etc while you use it.

thrwyparanoid 11y ago
Excellent points...spoofing a MAC address and using an antenna would make things safer and easier. Thanks.

wingerlang 11y ago

Is this something you do on a regular basis? Do you do something "high profile" when you do this? Or do you do it everytime you access internet?

thrwyparanoid 11y ago
No, I don't do this all the time. I didn't even make this throwaway account in an obfuscated way. This procedure will only be used for things that I really don't want traced back to me. I'm not a blackhat or drug dealer, but I'd still prefer these activities not be associated with me. The only tedious bits are preparing the burner laptop's OS for compartmentalization and encrypted/anonymous internet connection (both, not one or the other). Once the machine is set up and I have a suitable amount of bitcoin and the VPN set up I don't need to repeat those processes for months or a year. However, I really like the idea of getting prepaid data with cash and exclusively using a mobile hotspot. I also like the idea of simply building a computer for this purpose and buying all the components separately.

deleted 11y ago

[deleted]

brudgers 11y ago

There are a lot of things more wrong than black hatting and the drug trade, and this smells at least like something illegal given all the concern about cameras. My critique, put your energy toward something that you are comfortable being associated with instead. Good luck.

mszyndel 11y ago

What about using Tails instead of Whonix? I think all this travel makes it easy to spot you on cameras (traffic, random street cams, etc) which may help to identify. I would go of less travel (maybe buy everything in close distance but far away/unconnected to your main residence)

mszyndel 11y ago
Also, unless you took all of those security precautions when publishing here, your cover is already blown. Have a nice day!

giaour 11y ago

Instead of buying burner laptops, buy commodity parts and build your own. They'll be much harder to trace. Also, keep in mind that the police are much more likely to find you by talking to people than by tracking your online footprint. So you should also fake your own death and never talk to another human again.

RexRollman 11y ago

You should visit the Friday Squid posts on Bruce Schneier's blog. There are often good conversations about this kind of thing.

rmah 11y ago

All that travelling is pointless, they will simply track your car.