5 ms·

It is impossible to hide from big corporate. People tried (1). There is no was to block all tracking unless you go full luddite and unless every single person y

by Yizahi 7y ago

It is impossible to hide from big corporate. People tried (1). There is no was to block all tracking unless you go full luddite and unless every single person you know or simply met randomly does so too. Otherwise big corps would just create tracking profiles for you based on activity of others. Small recent example - remember that russian spying app FaceApp (iirk) which made aged pics out of your photos? Even if you avoided it there is rather high chance that your friends uploaded pictures of you instead. Or that phone caller ID app (which is a spyware inside too) - even if you never used it they still know your number probably because others filled it in for you. (1) https://gizmodo.com/c/goodbye-big-five https://gizmodo.com/c/goodbye-big-five

mirimir 7y ago
> Otherwise big corps would just create tracking profiles for you based on activity of others. Mirimir is totally trackable. And if you could (not likely) get data from Riseup and Keybase, you could find all his contacts. But even then, none of that is linked to me in meatspace. Nobody I know in meatspace knows about Mirimir. Hiding is not so hard if you just compartmentalize.
- pferde 7y ago
  Sure, but that only works if you compartmentalize from the very beginning, which regular people never do.
  - mirimir 7y ago
    Not at all. Only from the beginning of a particular persona. Mirimir is about eight years old.[0] But I had numerous personas before Mirimir. Some you could maybe track back to, if you worked at it, and knew where to look. But some are just too old, and unconnected. I was lots sloppier, when I started going dark, in the late 90s. I even talked about it in meatspace. But gradually, I compartmentalized more and more. Anyone can do that. Just gradually disappear as your meatspace identity. Or restrict it totally to career, and friends and family. Ideally, keeping those separate, so your friends don't hose your career. And then create and develop an ~anonymous persona.[1] Or a few of them, one for each ~defined set of interests. And just don't talk about it in meatspace. Or mix stuff among personas. 0) https://www.wilderssecurity.com/members/mirimir.121604/ https://www.wilderssecurity.com/members/mirimir.121604/ 1) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...
    - Santosh83 7y ago
      How can you keep these various personas unconnected from each other and your 'meatspace' online identity (for family, banking etc I presume, where you simply can't avoid it) with the emergence of browser and device fingerprinting? Also do you always go online through each persona from behind a different VPN IP address so they can't be correlated (except by your VPN provider of course)?
      - mirimir 7y ago
        For Mirimir and other ~low anonymity personas, I just use a different VM and nested VPN chain for each persona.[0] If keeping them unlinked is not critical, I use the same host machine, and don't obfuscate writing style. And because I use nested VPN chains, no individual VPN provider can correlate stuff from different personas. It's the same distribution of trust thing that Tor does. Albeit far weaker, because I'm only using several VPNs, and not thousands of Tor relays. But still, it'd take some effort to obtain logs from enough VPN providers. If I care more about keeping personas unlinked, I make sure to use different VM OS, given the risk of WebGL fingerprinting. Because using the same virtual graphics driver and physical GPU gives the same fingerprint. If I care even more, I use Whonix via nested VPN chains. With a different Whonix instance for each persona, or group of somewhat linked personas. If I care lots more, I do all of that, using a different host machine, on a different LAN, with different nested VPN chains. 0) https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano...
    - pferde 7y ago
      Well, I actually can see where you're going with this, since my HN account is completely disconnected from almost anything else I do online, or even offline. Apart from the privacy benefits, however, I feel that it is a net negative, because it prevents me from sharing here a lot of interesting stuff that happens in FOSS projects I am a part of, or at work.
      - leppr 7y ago
        This is why granular voluntary information disclosure will be super important in the future. A good social network should allow you to post under a different identity, while still tying-in some attributes of your other identity to the new one. For instance you could easily share your real life experience under another name, while still proving you have between 1000 and 1500 karma on another account. This fixes the problems of traditional throwaway accounts (lack of credibility). The only places I see this idea explored is in crypto(currency) projets. This is great because it will be robust and reliable, but the patterns could already easily be applied to today's centralized social networks.
SmellyGeekBoy 7y ago
> that russian spying app FaceApp Not that I've used it myself but has this been established as fact now?
- Yizahi 7y ago
  It is established that it is russian and hypothesized that it is a spyware. Personally I include in spyware all apps that "only collect metadata" or only do "personalized ads" because for me it is equal with spying almost by definition. And people like Bruce Schneier have the same opinion (2). (2) https://www.schneier.com/blog/archives/2014/03/metadata_survei.html https://www.schneier.com/blog/archives/2014/03/metadata_surv...
  - UncleMeat 7y ago
    Schneier has, imo, lost a fair amount of credibility over the past few years by starting almost every analysis with the maximally uncharitable assumptions. This became most clear when he reported on completely false claims that Facebook was monitoring WhatsApp messages at the client.
mikekchar 7y ago
Drives me crazy: My dad takes a picture of me when I visit my parents. My mom uploads it to Facebook. My cousin tags me. Want to know where I was during my vacations to Canada and who I spent time with? It's all there for the taking and I'm not involved at all!
- lazyjones 7y ago
  > Want to know where I was during my vacations to Canada and who I spent time with? It's all there for the taking and I'm not involved at all! Even if this didn't happen, Big Tech would still know since you probably took your smartphone with you...
  - ignoramous 7y ago
    I guess there are two kinds of privacy issues at play here: 1. Privacy denied. 2. Privacy forfeited. OP, I think, is complaining about the former. Though both forms could either be consentual or not. The latter is usually, in spirit, non-consentual: You agreed to the terms in good faith but wouldn't if you knew the unprecedented scale of the exploit.
  - judge2020 7y ago
    I know this is against the general sentiment but I don't care much what these corporations know about me; we all know we're just ad clickers and numbers in their big data machines. I'm more afraid of who can see the data that's peronally about me, whether it be due to mishap (data brach) or lack of control (see: IG, Facebook tagging). Should any of that get out, it would be devastating if it were put up on shady websites that allow you to look up the data of breached inviduals via only a name or username.
    - lazyjones 7y ago
      > I'm more afraid of who can see the data that's peronally about me, Big Tech knows all about you personally, including your name, address, phone number, locations you've been to, people you've met, things you've bought or considered buying. And guess what: they will sell it to anyone who pays enough.

by Yizahi 7y ago

mirimir 7y ago

> Otherwise big corps would just create tracking profiles for you based on activity of others. Mirimir is totally trackable. And if you could (not likely) get data from Riseup and Keybase, you could find all his contacts. But even then, none of that is linked to me in meatspace. Nobody I know in meatspace knows about Mirimir. Hiding is not so hard if you just compartmentalize.

pferde 7y ago
Sure, but that only works if you compartmentalize from the very beginning, which regular people never do.
- mirimir 7y ago
  Not at all. Only from the beginning of a particular persona. Mirimir is about eight years old.[0] But I had numerous personas before Mirimir. Some you could maybe track back to, if you worked at it, and knew where to look. But some are just too old, and unconnected. I was lots sloppier, when I started going dark, in the late 90s. I even talked about it in meatspace. But gradually, I compartmentalized more and more. Anyone can do that. Just gradually disappear as your meatspace identity. Or restrict it totally to career, and friends and family. Ideally, keeping those separate, so your friends don't hose your career. And then create and develop an ~anonymous persona.[1] Or a few of them, one for each ~defined set of interests. And just don't talk about it in meatspace. Or mix stuff among personas. 0) https://www.wilderssecurity.com/members/mirimir.121604/ https://www.wilderssecurity.com/members/mirimir.121604/ 1) https://www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-1 https://www.ivpn.net/privacy-guides/online-privacy-through-o...
  - Santosh83 7y ago
    How can you keep these various personas unconnected from each other and your 'meatspace' online identity (for family, banking etc I presume, where you simply can't avoid it) with the emergence of browser and device fingerprinting? Also do you always go online through each persona from behind a different VPN IP address so they can't be correlated (except by your VPN provider of course)?
    - mirimir 7y ago
      For Mirimir and other ~low anonymity personas, I just use a different VM and nested VPN chain for each persona.[0] If keeping them unlinked is not critical, I use the same host machine, and don't obfuscate writing style. And because I use nested VPN chains, no individual VPN provider can correlate stuff from different personas. It's the same distribution of trust thing that Tor does. Albeit far weaker, because I'm only using several VPNs, and not thousands of Tor relays. But still, it'd take some effort to obtain logs from enough VPN providers. If I care more about keeping personas unlinked, I make sure to use different VM OS, given the risk of WebGL fingerprinting. Because using the same virtual graphics driver and physical GPU gives the same fingerprint. If I care even more, I use Whonix via nested VPN chains. With a different Whonix instance for each persona, or group of somewhat linked personas. If I care lots more, I do all of that, using a different host machine, on a different LAN, with different nested VPN chains. 0) https://www.ivpn.net/privacy-guides/advanced-privacy-and-anonymity-part-1 https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano...
  - pferde 7y ago
    Well, I actually can see where you're going with this, since my HN account is completely disconnected from almost anything else I do online, or even offline. Apart from the privacy benefits, however, I feel that it is a net negative, because it prevents me from sharing here a lot of interesting stuff that happens in FOSS projects I am a part of, or at work.
    - leppr 7y ago
      This is why granular voluntary information disclosure will be super important in the future. A good social network should allow you to post under a different identity, while still tying-in some attributes of your other identity to the new one. For instance you could easily share your real life experience under another name, while still proving you have between 1000 and 1500 karma on another account. This fixes the problems of traditional throwaway accounts (lack of credibility). The only places I see this idea explored is in crypto(currency) projets. This is great because it will be robust and reliable, but the patterns could already easily be applied to today's centralized social networks.

SmellyGeekBoy 7y ago

> that russian spying app FaceApp Not that I've used it myself but has this been established as fact now?

Yizahi 7y ago
It is established that it is russian and hypothesized that it is a spyware. Personally I include in spyware all apps that "only collect metadata" or only do "personalized ads" because for me it is equal with spying almost by definition. And people like Bruce Schneier have the same opinion (2). (2) https://www.schneier.com/blog/archives/2014/03/metadata_survei.html https://www.schneier.com/blog/archives/2014/03/metadata_surv...
- UncleMeat 7y ago
  Schneier has, imo, lost a fair amount of credibility over the past few years by starting almost every analysis with the maximally uncharitable assumptions. This became most clear when he reported on completely false claims that Facebook was monitoring WhatsApp messages at the client.

mikekchar 7y ago

Drives me crazy: My dad takes a picture of me when I visit my parents. My mom uploads it to Facebook. My cousin tags me. Want to know where I was during my vacations to Canada and who I spent time with? It's all there for the taking and I'm not involved at all!

lazyjones 7y ago
> Want to know where I was during my vacations to Canada and who I spent time with? It's all there for the taking and I'm not involved at all! Even if this didn't happen, Big Tech would still know since you probably took your smartphone with you...
- ignoramous 7y ago
  I guess there are two kinds of privacy issues at play here: 1. Privacy denied. 2. Privacy forfeited. OP, I think, is complaining about the former. Though both forms could either be consentual or not. The latter is usually, in spirit, non-consentual: You agreed to the terms in good faith but wouldn't if you knew the unprecedented scale of the exploit.
- judge2020 7y ago
  I know this is against the general sentiment but I don't care much what these corporations know about me; we all know we're just ad clickers and numbers in their big data machines. I'm more afraid of who can see the data that's peronally about me, whether it be due to mishap (data brach) or lack of control (see: IG, Facebook tagging). Should any of that get out, it would be devastating if it were put up on shady websites that allow you to look up the data of breached inviduals via only a name or username.
  - lazyjones 7y ago
    > I'm more afraid of who can see the data that's peronally about me, Big Tech knows all about you personally, including your name, address, phone number, locations you've been to, people you've met, things you've bought or considered buying. And guess what: they will sell it to anyone who pays enough.