6 ms·
Well, if you're willing to accept my paranoia - here's what I did for a reasonable test. Again, it's only a start - there's more fun and paranoia to be had. At
by cik 7y ago
Well, if you're willing to accept my paranoia - here's what I did for a reasonable test. Again, it's only a start - there's more fun and paranoia to be had. At the end of the day it's about having an identity, not a blog.
1. Buy a credit card in cash from somewhere without cameras.
2. Use that credit card to buy a phone number through many of the real voip providers.
3. Buy a used laptop on CL/Kijiji in cash, making sure the pickup is someone's house. Bonus points if you make a friend do it.
4. Go to a Starbucks with your new laptop, sign up for gmail or protonmail using your new phone number.
5. Nuke your laptop and reinstall. It's a burner. Make sure you change the MAC address, just for profit.
6. Sign up for free VPN (500MB start) with something like TunnelBear, using your new email address.
7. Connect to your VPN from the laptop. Now use TOR.
8. Remember that credit card? Time to buy another one - this time so that you can pre-fund Amazon credits (or DO). They'll both accept prepaid credit cards.
9. Blog, do your thing - but only ever publish from a dedicated VM on the laptop. Make sure you're using firefox (or something else) in your VM to test your blog - through the SOCKS proxy you establish (ssh -D) to the host.
10/11. Nuke and rebuild VM and machine at will.
12. Every ~3 months, do a Kijiji exchange for a new laptop.
The above is in no way foolproof. But it's a reasonable start. For the record I don't consider this anonymous or paranoid enough.
- apeace 7y agoIs #2 even possible? Which phone providers accept prepaid cards and no way to verify the user's identity? For #7, make sure you do VPN over Tor, not Tor over VPN. The former is more secure for you, and has the additional benefit that sites won't know you're using Tor. The latter sucks for you and Tor if you relay any traffic.
- cik 7y agoAbsolutely. In fact it's possible with at least 3 different providers for whom I have accounts. Before you ask, yes they're all reputable. I'll definitely agree that VPN over TOR is (by far) more secure - but I feel as if most people aren't capable of it, even though TAILS exists.
- itake 7y ago#2, you can walk into a Target and by prepaid SIM cards for about $15/each. You can also signup Google Fi for free, but they will need an address to ship the card to.
- justboxing 7y ago> #2, you can walk into a Target and by prepaid SIM cards That is in direct violation of #1. >#1 ....from somewhere without cameras Target has cameras everywhere, even OUTSIDE the Restroom (for "Loss Prevention") and inside the elevators between floors, as well as at self-checkouts and customer service kiosks.
- wingerlang 7y agoHow long do they keep it? You could walk in with a getup that makes you unidentifiable. Or even ask a random kid to go buy it for you.
- beefhash 7y agoMind you, you'll also have to travel out of the country if you're basically anywhere in Europe, where buying anonymous prepaid cards is simply not possible anymore because laws mandate taking and storing the identity of the buyer.
- DarrenDev 7y agoYou buy prepaid sim cards in Ireland for cash in all phone shops and give any name you like. No id required.
- FDSGSG 7y agoYeah, if you have no social skills. I've never had trouble with "Uh, I left my ID home. I remember my passport number though, can I just give you that?" I've bought lots of prepaids in probably most European countries.
- algaeontoast 7y agoWhat brand? Most prepaid sims require some kind of account with your legal name :(
- cik 7y agoI admit that I don't know about the US - but I'd assume this would work somewhere there. Might vary by state. In Canada just buy your prepaid credit card at one of the independent corner stores we have all over the place. Several don't have cameras. Equally, there's nothing to stop you from walking in with a facemask; it wouldn't be abnormal at all.
- cryptozeus 7y agoThanks for this, I was entertaining the idea but this sounds exhausting.
- seibelj 7y agoAlways depends on your threat level. If you are, say, whistle blowing on a major government or corporation and don’t want to be public, it isn’t that bad compared to being (psychologically only if lucky) tortured 24/7 for the rest of your life.
- jammygit 7y agoExactly. Journalists in particular need to have more guides like this
- telesilla 7y agoCentre for Investigative Journalism (UK) does workshops to teach these concepts, they welcome volunteers to sign up and share tech knowledge. The conferences are always extremely interesting, too. Well worth attending. https://tcij.org/ https://tcij.org/
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- t-h-e-chief 7y agoThis list is awesome. I would love to shake your hand, but I am fairly sure I would never be able to find you.
- emptysongglass 7y agoInstead of nuking your system and trading it away all the time, why not use Qubes?
- 0x00000000 7y agoThings like canvas fingerprinting and other hardware “side channels” will most likely persist through reimaging
- cik 7y agoAbsolutely. Some of this is solvable through the use of the VM abstraction layer (hence!). Others do rely on macaddress (hence the constance rejig). Ideally one would have multiple machines for this - but we have to be realists about the quick and dirty.
- petercooper 7y agothis time so that you can pre-fund Amazon credits (or DO). They'll both accept prepaid credit cards. What billing address would you use on these though?