4 ms·

Not sure about the priorities here. Fingerprinting should be the main concern, so steps 1,2,3 are obscuring IP address and disabling cookies and JavaScript. Eve

by bo1024 7y ago

Not sure about the priorities here. Fingerprinting should be the main concern, so steps 1,2,3 are obscuring IP address and disabling cookies and JavaScript. Even beyond that, not sure how chaining VMs etc helps much more than a single VPN. Although an ideal solution would spin up a random VM, browser, screen size, and tor connection for each new web page visited...

mirimir 7y ago
> an ideal solution would spin up a random VM, browser, screen size, and tor connection for each new web page visited... Sure. I wouldn't limit it to Tor, though. Because there are just too many CAPTCHAs. That's much less of an issue using VPNs. Chaining VPNs is arguably overkill for avoiding fingerprinting. Still, trusting a single VPN service is risky. If they were complicit, you'd still be tracked. But if you at least chain two VPN services, there's less risk. Overall risk is more or less the product of all the individual risks, if they're independent. Edit: If exploit resistance is less of an issue, it's easy to chain VPNs at the Linux OS level using ip route and iptables. Iptables rules drop everything on enp0s3 except traffic to the first VPN server, and drop everything on tun0 except traffic to the second VPN server. You set enp0s3 as the route for the first VPN server. After connecting to it, you set tun0 as the route for the second VPN server. After connecting to it, you check for leaks using tcpdump.
- pmoriarty 7y ago
  How do you pay for your VPNs in a non-trackable way? If you pay via credit card, the VPN account has your name attached to it, no? So what good will chaining VPNs do when all the VPNs have your name attached to them? Bitcoin is also supposedly not anonymous (or so I've heard.. I really don't know much about bitcoin, so please correct me if I'm wrong here), so paying with it sounds like it won't be any better. Also, I have to ask: Who are you trying to prevent being tracked by? If it's by advertisers, I don't see how chaning VPNs would be any better than using a single VPN.
  - mirimir 7y ago
    I'd prefer to be tracked by nothing. Or at least, by nothing short of a targeted TLA attack. And yes, Bitcoin is not anonymous. Just the opposite, in fact. Some cryptocurrencies arguably are anonymous. But that's never really been tested, and in any case, they're not widely accepted. Any VPN service that I connect to directly, I pay with credit cards. Because there's ~zero anonymity for them, no matter what. But for the rest, I pay with well-mixed Bitcoin. I anonymize Bitcoin using wallets in a series of Whonix instances, via Tor. Using a different mixing service for each step. With N steps, I have somewhere between N/3 and N-1 ~anonymous Bitcoin pools. Depending on how many mixes I consider adequate. So then I select Bitcoin pools for paying VPN services in proportion to the degree of separation.
  - dashwav 7y ago
    I have been using Mullvad[1] for a year or so now and am really happy with the extent they go to avoid storing payment information. One of the things that caught my eye about them initially is that you could literally mail them an envelop containing your account number and $5 cash and they will add that time to your account, which seems to solve what it was you were asking about (although I am sure physically mailing something comes with it's own issues of privacy). [1]https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
    - mirimir 7y ago
      Yeah, love Mullvad. They've been around for about a decade. Along with AirVPN, Insorg and IVPN. IVPN may still accept cash as well.

by bo1024 7y ago

mirimir 7y ago

> an ideal solution would spin up a random VM, browser, screen size, and tor connection for each new web page visited... Sure. I wouldn't limit it to Tor, though. Because there are just too many CAPTCHAs. That's much less of an issue using VPNs. Chaining VPNs is arguably overkill for avoiding fingerprinting. Still, trusting a single VPN service is risky. If they were complicit, you'd still be tracked. But if you at least chain two VPN services, there's less risk. Overall risk is more or less the product of all the individual risks, if they're independent. Edit: If exploit resistance is less of an issue, it's easy to chain VPNs at the Linux OS level using ip route and iptables. Iptables rules drop everything on enp0s3 except traffic to the first VPN server, and drop everything on tun0 except traffic to the second VPN server. You set enp0s3 as the route for the first VPN server. After connecting to it, you set tun0 as the route for the second VPN server. After connecting to it, you check for leaks using tcpdump.

pmoriarty 7y ago
How do you pay for your VPNs in a non-trackable way? If you pay via credit card, the VPN account has your name attached to it, no? So what good will chaining VPNs do when all the VPNs have your name attached to them? Bitcoin is also supposedly not anonymous (or so I've heard.. I really don't know much about bitcoin, so please correct me if I'm wrong here), so paying with it sounds like it won't be any better. Also, I have to ask: Who are you trying to prevent being tracked by? If it's by advertisers, I don't see how chaning VPNs would be any better than using a single VPN.
- mirimir 7y ago
  I'd prefer to be tracked by nothing. Or at least, by nothing short of a targeted TLA attack. And yes, Bitcoin is not anonymous. Just the opposite, in fact. Some cryptocurrencies arguably are anonymous. But that's never really been tested, and in any case, they're not widely accepted. Any VPN service that I connect to directly, I pay with credit cards. Because there's ~zero anonymity for them, no matter what. But for the rest, I pay with well-mixed Bitcoin. I anonymize Bitcoin using wallets in a series of Whonix instances, via Tor. Using a different mixing service for each step. With N steps, I have somewhere between N/3 and N-1 ~anonymous Bitcoin pools. Depending on how many mixes I consider adequate. So then I select Bitcoin pools for paying VPN services in proportion to the degree of separation.
- dashwav 7y ago
  I have been using Mullvad[1] for a year or so now and am really happy with the extent they go to avoid storing payment information. One of the things that caught my eye about them initially is that you could literally mail them an envelop containing your account number and $5 cash and they will add that time to your account, which seems to solve what it was you were asking about (although I am sure physically mailing something comes with it's own issues of privacy). [1]https://mullvad.net/en/help/no-logging-data-policy/ https://mullvad.net/en/help/no-logging-data-policy/
  - mirimir 7y ago
    Yeah, love Mullvad. They've been around for about a decade. Along with AirVPN, Insorg and IVPN. IVPN may still accept cash as well.