4 ms·
Because it is always possible you will fail your Tor discipline, I would add some defense-in-depth aspects, in case your browser is compromised and your network
by angry_octet 10y ago
Because it is always possible you will fail your Tor discipline, I would add some defense-in-depth aspects, in case your browser is compromised and your network address is revealed.
- Use separate hardware. A cheap laptop and a cheap phone.
- Burn the receipt and chuck the packaging.
- Cash. Pay in cash.
- Buy from small stores with no CCTV, or better yet, from people like migrant workers.
- You can buy stored value cards (debit cards) without ID, and some you can load with cash at ATMs. (Also good to buy from travellers.)
- Once you have a debit card you can pay for data without going to a store.
- If you turn on your Wifi tethering and other devices are in range you have created an event in their logs. Just use a cable. If you must, change the SSID regularly and use Android 6 which has MAC randomisation. Never have any other SSIDs saved, especially not your home network.
- Turn the phone off when not in use. Removing the battery is advisable.
- Don't connect to 3G near your home or work or where there is pervasive CCTV or not many people.
- If your commute is logged (via your cellphone, number plate recognition / tolling, personally identified public transport like Oyster cards) then your location can be correlated against when your persona was online.
- It might seem that transmitting from different locations is a good idea. But not really, it gives a more unique history.
- Run Tor on the laptop. Run nothing on the phone, its just a radio.
- If you want to use Signal, get another burner phone.
- Invest in some numbered wafer seals or tamper bags. Keep your kit in them when cached.
- Don't tell fibs to federal agents. Record all interactions with them.
- stevarino 10y agoYou make a lot of interesting points with frequency analysis, but these facts can be used for your benefit. For example, if you're concerned about transit systems being used to identify you, try leaving the devices in a safe location for several hours and have them respond on a timer system. Any analysis ran across millions of users will end up filtering you out, lowering your own suspicion factor and increasing the adversaries uncertainty when facing big data. How a system fails is just as important as how it performs when it comes to security, the young-adult novel Little Brother by Doctorow goes into this in good detail.
- angry_octet 10y agoSure, but it depends how complicated you want to make it. Ideally you would use an electronic dead drop -- any tweets would be sent by a small embedded computer which listens passively on Wifi for a message sent to it from you as you transit past it, then at some random time later fires up the 3G to send to twitter etc (still via Tor). This can be automated to run from an android phone. Of course if this phone is found its credentials can be extracted and it can be turned into a method to locate you. See the FBI CI bust in New York of 'Anna Chapman'. They really should have used Tor, but of course that flags your IP as of interest in the big NSA computer in sub-basement 19. https://vault.fbi.gov/ghost-stories-russian-foreign-intelligence-service-illegals https://vault.fbi.gov/ghost-stories-russian-foreign-intellig...
- Torgo 10y agoHow do you get a "burner phone"? everywhere requires an ID and SSN to buy one.
- sjs382 10y agoMost convenience stores, drugstores or bodegas.