5 ms·
Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion
by zaarn 7y ago
Are you sure they don't leak any information sufficient to identify you? Let's play this through; 33 bits of information leak your identity (assuming 8 billion humans)
If you set your timezone; that's already leaking 5 bits of information (37 timezones), it lets an observer narrow down your location. The times the VM is active can confirm this (by observing when the VM is more active vs not, your sleep pattern can be derived)
Your language setting can nail down north vs south hemisphere, that leaks another bit of information.
Since you come from a Tor endpoint, we can exclude with high probability old demographics and very young demographics (>65 and <14 years old), those seem to rarely use such tools. That eliminates about 34% of the population, leading to another 8 bits of entropy leaked. The usage pattern of the mouse can be used to confirm (shaky movements could indicate cognitive impairment common among elderly as well as usage habits like only using VMs outside common school times).
We're down to 19 bits; Only 500'000 people share these traits with you.
By profiling which websites you visit and the fact you're using tor, one can take a guess at your gender, likely male. Another bit is gone, 250'000 people left.
Identifying 1 in 250'000 people based on them using a VPN; depending on region between 18 and 30% of people use a VPN atleast once per month (statista), that fact alone leaves you with 13 bits on both ends of the range.
1 in 8000 people.
Are you certain you can hide among 8000 people? Because things like movies being watched or social network usage can further leak entropy and reduce your anonimity set. Your meatspace identity is protected by 13 bits.
And if you visit very specific websites, like LGBT-related content, this can be used to identify you as LGBT, moving you down to 4 bits of entropy. 16 people.
- mirimir 7y agoFor the most part, I only use Windows VMs when I need Excel for >50MB spreadsheets. Or to test Windows VPN clients. Your analysis strikes me as implausible. Few adversaries could see all of those parameters. For example, it's typically Tor through a nested VPN chain. So it'd be nontrivial for a local observer to know that I'm using Tor. Or for a remote observer to know that I'm using VPNs. And seriously, why would I use my meatspace timezone? But actually, I do sometimes, just to be more random. Also, my sleep schedule is highly irregular, as one can tell from my HN posting history.
- tripzilch 7y agoIt turns out that people's irregular sleep patterns are in fact not quite as irregular when you actually measure them. On the other hand, I believe HN posting history just says "X days ago" for posts older than a day, so you can't get fine grained schedules from that (I might have graphed yours, otherwise, just to see).
- mirimir 7y agoRight, you'd need to scrape HN real-time to get a detailed posting history. About sleep schedule. I really don't have one. I work and sleep when I feel like it. And I nap. And I have modafinil and zolpidem available. And coffee. If you charted my waking and sleeping times long-term, you'd find pretty much a random walk. I can be up as much as 30-40 hours, or as little as ~1 hour. And I can be sleeping for anywhere from ~1 hour to maybe 15 hours or more.
- zaarn 7y agoYou're more likely to sleep at night than not, that's sufficient to establish your timezone with good accuracy. Fefe, a german blogger, had this analysis done using his posting history on his blog, allowing readers to not only determine his timezone, but when he was travelling and where.
- tripzilch 7y agothen, if I were to make a wild guess I'd say you're in Scandinavia or other high latitude place :)
- zaarn 7y agoWindows telemetry will know it's Tor. Irregular sleep schedules are usually very regular when looked at over a long time.
- mirimir 7y agoOK, Microsoft knows that some persona uses Tor. So what? Sure, mine is "regular". In the sense of regularly random.
- tripzilch 7y agoI'm not sure about timezones but there live about 6 times as many people on the northern hemisphere than the southern, so that's not one bit of information. I know (and have known, unfortunately) multiple people over 60 that use Tor. Aha but such people are even rarer and therefore must be even easier to identify ... or are they? :) In fact I know a handful of kids younger than 14 who have on occasion used Tor as well. If you already (reasonably) assume the gender is most likely male, then you should know that is also less than one bit of information. Etc. You need to try a bit harder :)
- zaarn 7y agoYou know a handful of kids but kids aren't that likely to use tor, selection bias strikes again! Same for over 60yo. There is plenty of other ways to wittle away at the bits. I think you're overconfident.
- wolco 7y agoBut changing the timezone to a different value or providing a few false flags would cripple this line of thinking.