4 ms·

So what's the best way to browse anonymously these days? Is it running a hypervised OS (some hardened GNU Linux/BSD Unix variant?) with a randomly changed LAN M

by bitL 10y ago

So what's the best way to browse anonymously these days? Is it running a hypervised OS (some hardened GNU Linux/BSD Unix variant?) with a randomly changed LAN MAC upon every boot, connected to a VPN operating outside US with OpenVPN & 4k PK (e.g. in Romania), browsing using TorBrowser with NoScript and WebGL turned off? Or even two VPNs at the same time, one in the base OS, the other in the hypervised one?

sigjuice 10y ago
What would be the benefit of changing your MAC address?
- api 10y ago
  MACs are a unique hardware ID and there are various ways they can leak over L3, such as software that uses your MAC to compute its own ID that can be reversed.
  - sigjuice 10y ago
    Can you point me at a concrete example of an application or protocol that does this? Thanks!
    - walrus01 10y ago
      I have heard of HTML5/WebRTC API browser fingerprinting that can expose a user's RFC1918 private IP address (10.x.x.x whatever...) on their client device, but not MAC address. https://network23.org/inputisevil/2015/09/06/how-html5-apis-can-fingerprint-users/ https://network23.org/inputisevil/2015/09/06/how-html5-apis-...
    - robocat 10y ago
      Many applications where a GUID is exposed. "In the OSF-specified algorithm for generating new (V1) GUIDs, the user's network card MAC address is used as a base for the last group of GUID digits, which means, for example, that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa virus." from https://en.m.wikipedia.org/wiki/Globally_unique_identifier https://en.m.wikipedia.org/wiki/Globally_unique_identifier
    - gcr 10y ago
      iOS randomizes MAC addresses when not connected to wireless networks. The stated goal is to lower the probability of being tracked by third parties in, e.g., convenience stores. http://www.imore.com/closer-look-ios-8s-mac-randomization http://www.imore.com/closer-look-ios-8s-mac-randomization Apple device uDIDs are generated by concatenating the serial number, the MAC address, and some other things, then running the result through a hash function. (I don't have a source at the moment, sorry).
    - zrm 10y ago
      IPv6 auto-configuration can encode the ethernet hardware address into the IPv6 address. Then anything that advertises that IPv6 address is advertising your hardware address. Even if you don't use IPv6 -- or especially then since that's when auto-config most commonly happens.
exstudent2 10y ago
You can browse with Tor but most sites (including this one and Twitter) won't let you sign up/post with Tor. Very dubious practice by the site operators IMO.
- xufi 10y ago
  Thats actaully what I've noticed too, I believe even Facebook at one point didnt let me log in becasue it kept asking me to verify who i was (granted I was using a VPN at a local Starbucks).
  - exstudent2 10y ago
    It's interesting that Twitter made a name for itself as a platform that could "cause a revolution" (arab spring), but there is no way they can claim that now that they block Tor. Who's going to start a revolution when you're not anoymous? I don't know what the justification for Hacker News not allowing Tor is since there's no economic incentive to track users. Hopefully more people will be made aware of this and start asking the question: Why do you need to know who I am?
- qwertex 10y ago
  I'm currently using tor and also signed up with it
- walrus01 10y ago
  Not dubious, tor is used by all sorts of abusive spam bots and people who just want to shitpost for the lulz.
  - exstudent2 10y ago
    User based voting solves both those problems without having to nuke the ability to post anonymously.
    - danneu 10y ago
      If almost all of your Tor traffic is abuse, exposing it to your users to vote on doesn't solve the problem, it just gives them a worse experience. Obviously every service has different trade-offs to consider, which is why "Tor traffic is always worth it" is HN comment idealism.
jrcii 10y ago
Drive to a state you don't live in, boot Tails from CD-ROM, connect to a hacked VPN account through someone else's wifi, then run everything through Tor. Then make sure you're using default browser configuration and resolution as not to be foiled a la panopticlick. Even then I wouldn't be so sure you're anonymous.
- walrus01 10y ago
  And all of the above while avoiding security cameras that will capture your license plate, and using a $200 thinkpad you bought for cash. Oh, and you drove to another state, you DID leave your tracking device (LTE smartphone) at home, right?
  - ashmud 10y ago
    And anti-facial recognition (e.g., face paint). Burner phone if you have to.
    - walrus01 10y ago
      And you paid for gas and everything else in cash only, right? It's trivially easy to track a person's movements if they use credit/debit for most payments.
      - martin1975 10y ago
        Suppose you did all that. And maybe you even pulled it off, and left no tracks. Something else happens, and this is what many fail to realize - human nature kicks in and you get high on your own success. Therein lies your downfall. Name one relatively successful person who's done something wrong or criminal who hasn't been caught by the most insanely stupid mistake, even after not being caught for days, months, years even. This is why privacy, while it is a legitimate need to shield things like personal info, bank accounts, bills, your own home or communication with coworkers, friends, family, etc, when it is used to shield illegal activities, almost always, if not always, it is to the detriment of the person. Now, some will cry foul to what I said... "If you're careful enough, you will never get caught".. or the best one, "If you've a group of people to support you (i.e. mafia style :), organized efforts are harder to break"... or "if smart people who are wicked join you..." etc. Go ahead, try it, I double dog dare you. Come post on HN how it went. Or maybe we'll read about you on Ars or HN, but not from your direct reporting.
andywood 10y ago
https://www.whonix.org/wiki/Warning https://www.whonix.org/wiki/Warning https://tails.boum.org/doc/about/warning/index.en.html https://tails.boum.org/doc/about/warning/index.en.html
kobayashi 10y ago
If you're running a hypervised OS and don't want to run another OpenVPN program within it, make sure that the settings of the program (e.g. VirtualBox) don't treat the hypervised VM as a separate machine. Some people might not realize that the VM can actually establish a connection directly to the router, thus escaping the OpenVPN tunnel. Hope that was clear.

by bitL 10y ago

sigjuice 10y ago

What would be the benefit of changing your MAC address?

api 10y ago
MACs are a unique hardware ID and there are various ways they can leak over L3, such as software that uses your MAC to compute its own ID that can be reversed.
- sigjuice 10y ago
  Can you point me at a concrete example of an application or protocol that does this? Thanks!
  - walrus01 10y ago
    I have heard of HTML5/WebRTC API browser fingerprinting that can expose a user's RFC1918 private IP address (10.x.x.x whatever...) on their client device, but not MAC address. https://network23.org/inputisevil/2015/09/06/how-html5-apis-can-fingerprint-users/ https://network23.org/inputisevil/2015/09/06/how-html5-apis-...
  - robocat 10y ago
    Many applications where a GUID is exposed. "In the OSF-specified algorithm for generating new (V1) GUIDs, the user's network card MAC address is used as a base for the last group of GUID digits, which means, for example, that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa virus." from https://en.m.wikipedia.org/wiki/Globally_unique_identifier https://en.m.wikipedia.org/wiki/Globally_unique_identifier
  - gcr 10y ago
    iOS randomizes MAC addresses when not connected to wireless networks. The stated goal is to lower the probability of being tracked by third parties in, e.g., convenience stores. http://www.imore.com/closer-look-ios-8s-mac-randomization http://www.imore.com/closer-look-ios-8s-mac-randomization Apple device uDIDs are generated by concatenating the serial number, the MAC address, and some other things, then running the result through a hash function. (I don't have a source at the moment, sorry).
  - zrm 10y ago
    IPv6 auto-configuration can encode the ethernet hardware address into the IPv6 address. Then anything that advertises that IPv6 address is advertising your hardware address. Even if you don't use IPv6 -- or especially then since that's when auto-config most commonly happens.

exstudent2 10y ago

You can browse with Tor but most sites (including this one and Twitter) won't let you sign up/post with Tor. Very dubious practice by the site operators IMO.

xufi 10y ago
Thats actaully what I've noticed too, I believe even Facebook at one point didnt let me log in becasue it kept asking me to verify who i was (granted I was using a VPN at a local Starbucks).
- exstudent2 10y ago
  It's interesting that Twitter made a name for itself as a platform that could "cause a revolution" (arab spring), but there is no way they can claim that now that they block Tor. Who's going to start a revolution when you're not anoymous? I don't know what the justification for Hacker News not allowing Tor is since there's no economic incentive to track users. Hopefully more people will be made aware of this and start asking the question: Why do you need to know who I am?
qwertex 10y ago
I'm currently using tor and also signed up with it
walrus01 10y ago
Not dubious, tor is used by all sorts of abusive spam bots and people who just want to shitpost for the lulz.
- exstudent2 10y ago
  User based voting solves both those problems without having to nuke the ability to post anonymously.
  - danneu 10y ago
    If almost all of your Tor traffic is abuse, exposing it to your users to vote on doesn't solve the problem, it just gives them a worse experience. Obviously every service has different trade-offs to consider, which is why "Tor traffic is always worth it" is HN comment idealism.

jrcii 10y ago

Drive to a state you don't live in, boot Tails from CD-ROM, connect to a hacked VPN account through someone else's wifi, then run everything through Tor. Then make sure you're using default browser configuration and resolution as not to be foiled a la panopticlick. Even then I wouldn't be so sure you're anonymous.

walrus01 10y ago
And all of the above while avoiding security cameras that will capture your license plate, and using a $200 thinkpad you bought for cash. Oh, and you drove to another state, you DID leave your tracking device (LTE smartphone) at home, right?
- ashmud 10y ago
  And anti-facial recognition (e.g., face paint). Burner phone if you have to.
  - walrus01 10y ago
    And you paid for gas and everything else in cash only, right? It's trivially easy to track a person's movements if they use credit/debit for most payments.
    - martin1975 10y ago
      Suppose you did all that. And maybe you even pulled it off, and left no tracks. Something else happens, and this is what many fail to realize - human nature kicks in and you get high on your own success. Therein lies your downfall. Name one relatively successful person who's done something wrong or criminal who hasn't been caught by the most insanely stupid mistake, even after not being caught for days, months, years even. This is why privacy, while it is a legitimate need to shield things like personal info, bank accounts, bills, your own home or communication with coworkers, friends, family, etc, when it is used to shield illegal activities, almost always, if not always, it is to the detriment of the person. Now, some will cry foul to what I said... "If you're careful enough, you will never get caught".. or the best one, "If you've a group of people to support you (i.e. mafia style :), organized efforts are harder to break"... or "if smart people who are wicked join you..." etc. Go ahead, try it, I double dog dare you. Come post on HN how it went. Or maybe we'll read about you on Ars or HN, but not from your direct reporting.

andywood 10y ago

https://www.whonix.org/wiki/Warning https://www.whonix.org/wiki/Warning https://tails.boum.org/doc/about/warning/index.en.html https://tails.boum.org/doc/about/warning/index.en.html

kobayashi 10y ago

If you're running a hypervised OS and don't want to run another OpenVPN program within it, make sure that the settings of the program (e.g. VirtualBox) don't treat the hypervised VM as a separate machine. Some people might not realize that the VM can actually establish a connection directly to the router, thus escaping the OpenVPN tunnel. Hope that was clear.