6 ms·

So all the telemetry that Windows collects from the VM's you're running are sent to Microsoft through nested VPNs over TOR? I don't think Microsoft minds or ca

So all the telemetry that Windows collects from the VM's you're running are sent to Microsoft through nested VPNs over TOR? I don't think Microsoft minds or cares that your Windows VM telemetry gets send to them that way or any other way? How are your VPNs and TOR helping you with the Microsoft you don't trust?

mirimir 7y ago
Microsoft can collect anything it wants from those VMs. Because they contain nothing that I don't want them to know. In particular, they don't contain anything about my meatspace identity. Sometimes I do need to put data on VMs that I want kept private. For that, I clone a Windows VM, add a virtual disk containing the data, and then start it with no network connectivity. When I'm done, I detach the data disk, and delete the VM.
- jowsie 7y ago
  Not meaning to come across as mean, but could you explain your reasoning behind such precautions, and why they seem worth the extra effort to you? It would seem to me that if you just need to occasionally run an exe that you could most likely get it working with WINE.
  - mirimir 7y ago
    Once I have a Windows VM that's stable, with the apps that I usually need, the rest of it takes little time. Mainly it's Excel that I need. And I need it to use all available CPU cores. I suppose that might work in Wine, but that seems like an iffy approach. Why do I take such precautions? Well, I've been an anonymous coward for a couple decades. I've corresponded with many people, and played with many projects. I honestly have no idea who might be after me, or for what. Ideally, nobody, for nothing. But ... Given that, I take whatever precautions I practically can. And it's also a hobby. Perhaps like building little ships in glass bottles. But hopefully maybe useful to someone.
  - heavenlyblue 7y ago
    That setup doesn’t work with games, too - unless you’re willing to turn off your GPU in the main OS so that it could be used in the other guest.
    - mirimir 7y ago
      I don't play games. And even if I did, I'd never pass a physical GPU to a VM. That's almost as iffy as direct access to physical storage.
- zaarn 7y ago
  Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion humans) If you set your timezone; that's already leaking 5 bits of information (37 timezones), it lets an observer narrow down your location. The times the VM is active can confirm this (by observing when the VM is more active vs not, your sleep pattern can be derived) Your language setting can nail down north vs south hemisphere, that leaks another bit of information. Since you come from a Tor endpoint, we can exclude with high probability old demographics and very young demographics (>65 and <14 years old), those seem to rarely use such tools. That eliminates about 34% of the population, leading to another 8 bits of entropy leaked. The usage pattern of the mouse can be used to confirm (shaky movements could indicate cognitive impairment common among elderly as well as usage habits like only using VMs outside common school times). We're down to 19 bits; Only 500'000 people share these traits with you. By profiling which websites you visit and the fact you're using tor, one can take a guess at your gender, likely male. Another bit is gone, 250'000 people left. Identifying 1 in 250'000 people based on them using a VPN; depending on region between 18 and 30% of people use a VPN atleast once per month (statista), that fact alone leaves you with 13 bits on both ends of the range. 1 in 8000 people. Are you certain you can hide among 8000 people? Because things like movies being watched or social network usage can further leak entropy and reduce your anonimity set. Your meatspace identity is protected by 13 bits. And if you visit very specific websites, like LGBT-related content, this can be used to identify you as LGBT, moving you down to 4 bits of entropy. 16 people.
  - mirimir 7y ago
    For the most part, I only use Windows VMs when I need Excel for >50MB spreadsheets. Or to test Windows VPN clients. Your analysis strikes me as implausible. Few adversaries could see all of those parameters. For example, it's typically Tor through a nested VPN chain. So it'd be nontrivial for a local observer to know that I'm using Tor. Or for a remote observer to know that I'm using VPNs. And seriously, why would I use my meatspace timezone? But actually, I do sometimes, just to be more random. Also, my sleep schedule is highly irregular, as one can tell from my HN posting history.
    - 7y ago

mirimir 7y ago

Microsoft can collect anything it wants from those VMs. Because they contain nothing that I don't want them to know. In particular, they don't contain anything about my meatspace identity. Sometimes I do need to put data on VMs that I want kept private. For that, I clone a Windows VM, add a virtual disk containing the data, and then start it with no network connectivity. When I'm done, I detach the data disk, and delete the VM.

jowsie 7y ago
Not meaning to come across as mean, but could you explain your reasoning behind such precautions, and why they seem worth the extra effort to you? It would seem to me that if you just need to occasionally run an exe that you could most likely get it working with WINE.
- mirimir 7y ago
  Once I have a Windows VM that's stable, with the apps that I usually need, the rest of it takes little time. Mainly it's Excel that I need. And I need it to use all available CPU cores. I suppose that might work in Wine, but that seems like an iffy approach. Why do I take such precautions? Well, I've been an anonymous coward for a couple decades. I've corresponded with many people, and played with many projects. I honestly have no idea who might be after me, or for what. Ideally, nobody, for nothing. But ... Given that, I take whatever precautions I practically can. And it's also a hobby. Perhaps like building little ships in glass bottles. But hopefully maybe useful to someone.
- heavenlyblue 7y ago
  That setup doesn’t work with games, too - unless you’re willing to turn off your GPU in the main OS so that it could be used in the other guest.
  - mirimir 7y ago
    I don't play games. And even if I did, I'd never pass a physical GPU to a VM. That's almost as iffy as direct access to physical storage.
zaarn 7y ago
Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion humans) If you set your timezone; that's already leaking 5 bits of information (37 timezones), it lets an observer narrow down your location. The times the VM is active can confirm this (by observing when the VM is more active vs not, your sleep pattern can be derived) Your language setting can nail down north vs south hemisphere, that leaks another bit of information. Since you come from a Tor endpoint, we can exclude with high probability old demographics and very young demographics (>65 and <14 years old), those seem to rarely use such tools. That eliminates about 34% of the population, leading to another 8 bits of entropy leaked. The usage pattern of the mouse can be used to confirm (shaky movements could indicate cognitive impairment common among elderly as well as usage habits like only using VMs outside common school times). We're down to 19 bits; Only 500'000 people share these traits with you. By profiling which websites you visit and the fact you're using tor, one can take a guess at your gender, likely male. Another bit is gone, 250'000 people left. Identifying 1 in 250'000 people based on them using a VPN; depending on region between 18 and 30% of people use a VPN atleast once per month (statista), that fact alone leaves you with 13 bits on both ends of the range. 1 in 8000 people. Are you certain you can hide among 8000 people? Because things like movies being watched or social network usage can further leak entropy and reduce your anonimity set. Your meatspace identity is protected by 13 bits. And if you visit very specific websites, like LGBT-related content, this can be used to identify you as LGBT, moving you down to 4 bits of entropy. 16 people.
- mirimir 7y ago
  For the most part, I only use Windows VMs when I need Excel for >50MB spreadsheets. Or to test Windows VPN clients. Your analysis strikes me as implausible. Few adversaries could see all of those parameters. For example, it's typically Tor through a nested VPN chain. So it'd be nontrivial for a local observer to know that I'm using Tor. Or for a remote observer to know that I'm using VPNs. And seriously, why would I use my meatspace timezone? But actually, I do sometimes, just to be more random. Also, my sleep schedule is highly irregular, as one can tell from my HN posting history.
  - 7y ago