9 ms·

The Hitchhiker's Guide to Online Anonymity

387 points by x14km2d 6y ago

simonlc 6y ago
The first sentence of the guide confirms my suspicions > TLDR for the whole guide: “A strange game. The only winning move is not to play”. What I extrapolate from this comment is that there is no real way to be anonymous online. So what's the point of the guide then?
- 100011_100001 6y ago
  Making it much much harder.
- jmcqk6 6y ago
  Because people's threat levels are different. There is nothing you can do to escape from the NSA, for example. But there are things you can do to prevent advertisers, or other adversaries from just getting your data. And for most people, that's what they're looking for. I can't imagine I'm very interesting to the NSA, for example. But I'm probably very interesting to a large number of corporations and organizations competing for my attention.
- Slow_Hand 6y ago
  To reduce your probability of having your identity compromised. Because, practically speaking, most of us will need to rely on the internet.
- bawolff 6y ago
  The first rule of security is that nothing is 100%. There is always someone who can get you if they have sufficient motivation and resources. Security is about taking steps to reduce risk, so that its outside of your adversaries budgets to attack you, and taking mitigating steps so that if you do get attacked the damage is limited. Nothing about this is specific to computers, it applies to all security things, whether that's locking your door or a bank trying to prevent armed roberies.
vmception 6y ago
I'm glad they made this chart on their website https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg But one should practically note that this is just a practical warning. The omnipotence of the Mossad and NSA etc is limited too, and their interest in things is also limited. Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. But 9 out of 10 things you could possibly even do are not things that would have them bother with you, although it is accurate that over time you begin to have a problem if you are really trying to stay both private and anonymous and are doing criminal violations (distinct from civil violations). So just keep rotating keys and move with purpose. Limit your Tor session to implementation and execution and consider using Tor just for casual reading or accessing RDP to actually browse clearnet from someone else's computer.
- simonebrunozzi 6y ago
  > Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. Nicely explained, and AFAIK, pretty much correct.
- tomcooks 6y ago
  Create rogue TOR nodes Use TOR for menial stuff to create background noise Regularly trade laptops and phones with like-minded individuals Assume you've been breached and that the government has full attention to you Be as paranoid as possible, any step towards lack of freedom for the sake of convenience is unretracheable
  - vmception 6y ago
    yeah running 1 or 2 of your own Tor nodes seems to be pretty ideal. One of which being an exit node. Connecting to that is the move. providing an obfs4 bridge seems good too but I really wish there was a docker container for all this, the documentation is all over the place, most of it is just on forums that can only be accessed on Tor and those forums have unreliable uptime, it is really discouraging but it seems like there are some very competent people that are so comfortable doing this that one could just assume they all have this greater level of OPSEC and infrastructure
unixhero 6y ago
Batshit nuts, but I love it.
xioren00 6y ago
"User > VPN > Tor > VPN" This suggests to me the author is giving advice based on paranoia rather than technical knowledge.
- Shared404 6y ago
  Why is do you suspect this? It makes sense to me that you would want to hide from your ISP and whatever service you're using that you're using Tor.
  - xioren00 6y ago
    More complex =/= more secure. Tor, Whonix, Tails, et all have sections in their wikis covering potential tunneling setups and their thoughts on efficacy and rationale behind them. From the Tor wiki: > You -> X --> Tor --> X > No research whether this is technically possible. Remember that this is likely a very poor plan because [#You-Tor-X you -> Tor -> X] is already a really poor plan.
    - Shared404 6y ago
      Fair enough. While I'm comfortable saying I'm more competent at such things then a layperson, I'm definitely not actually competent.
- chrisfosterelli 6y ago
  I don't think the author is recommending that, just discussing it... The guide recommends using a VPN over TOR in "specific cases", for example "when your destination service does not allow Tor Exit nodes", and for "VPN over TOR over VPN" they say it's not recommended because "it is just VPN over Tor but slower".
- gruez 6y ago
  >This suggests to me the author is giving advice based on paranoia rather than technical knowledge. I noticed that immediately on the home page. The author suggests installing and running some sort of python package to verify the pdf is harmless. That sort of makes sense, until you realize that installing a random python package and running it is exposing you to far more risk than a opening a pdf ever will.
m0ck 6y ago
Heh, I remember spending hours in college tweaking Firefox config flags and then checking which websites broke this time. Nowadays I just enable uBlock and call it a day. For ordinary people it's jut not worth it. Cool guide though, I will check it out.
giantg2 6y ago
This has been posted before... I wouldn't mind if it was posted every month, as I think it's that important (at least from a conceptual point or starting point).
neatze 6y ago
If you are that paranoid and not doing something very illegal, hmm, like pedo stuff, may be just quit social networks. There is healthy level of paranoia, this document is not healthy level.
- bszupnick 6y ago
  As someone who isn't THIS paranoid, but definitely closer to it than most, I can add a criteria for a reason one would be this paranoid. If you've worked in/with some of the agencies listed, you're not just paranoid but feel totally justified knowing exactly what some old pals can see.
sneak 6y ago
FWIW, this site appears to plagiarize text from my HN comments and website. I hadn't noticed, but another HN user did and brought it to my attention.
- meowface 6y ago
  What's an example?
gypsyharlot 6y ago
I would like to add that by introducing too many "special features" into browsers and such, you are making your fingerprint really unique.

387 points by x14km2d 6y ago

The first sentence of the guide confirms my suspicions > TLDR for the whole guide: “A strange game. The only winning move is not to play”. What I extrapolate from this comment is that there is no real way to be anonymous online. So what's the point of the guide then?

100011_100001 6y ago
Making it much much harder.
jmcqk6 6y ago
Because people's threat levels are different. There is nothing you can do to escape from the NSA, for example. But there are things you can do to prevent advertisers, or other adversaries from just getting your data. And for most people, that's what they're looking for. I can't imagine I'm very interesting to the NSA, for example. But I'm probably very interesting to a large number of corporations and organizations competing for my attention.
Slow_Hand 6y ago
To reduce your probability of having your identity compromised. Because, practically speaking, most of us will need to rely on the internet.
bawolff 6y ago
The first rule of security is that nothing is 100%. There is always someone who can get you if they have sufficient motivation and resources. Security is about taking steps to reduce risk, so that its outside of your adversaries budgets to attack you, and taking mitigating steps so that if you do get attacked the damage is limited. Nothing about this is specific to computers, it applies to all security things, whether that's locking your door or a bank trying to prevent armed roberies.

vmception 6y ago

I'm glad they made this chart on their website https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg But one should practically note that this is just a practical warning. The omnipotence of the Mossad and NSA etc is limited too, and their interest in things is also limited. Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. But 9 out of 10 things you could possibly even do are not things that would have them bother with you, although it is accurate that over time you begin to have a problem if you are really trying to stay both private and anonymous and are doing criminal violations (distinct from civil violations). So just keep rotating keys and move with purpose. Limit your Tor session to implementation and execution and consider using Tor just for casual reading or accessing RDP to actually browse clearnet from someone else's computer.

simonebrunozzi 6y ago
> Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. Nicely explained, and AFAIK, pretty much correct.
tomcooks 6y ago
Create rogue TOR nodes Use TOR for menial stuff to create background noise Regularly trade laptops and phones with like-minded individuals Assume you've been breached and that the government has full attention to you Be as paranoid as possible, any step towards lack of freedom for the sake of convenience is unretracheable
- vmception 6y ago
  yeah running 1 or 2 of your own Tor nodes seems to be pretty ideal. One of which being an exit node. Connecting to that is the move. providing an obfs4 bridge seems good too but I really wish there was a docker container for all this, the documentation is all over the place, most of it is just on forums that can only be accessed on Tor and those forums have unreliable uptime, it is really discouraging but it seems like there are some very competent people that are so comfortable doing this that one could just assume they all have this greater level of OPSEC and infrastructure

unixhero 6y ago

Batshit nuts, but I love it.

xioren00 6y ago

"User > VPN > Tor > VPN" This suggests to me the author is giving advice based on paranoia rather than technical knowledge.

Shared404 6y ago
Why is do you suspect this? It makes sense to me that you would want to hide from your ISP and whatever service you're using that you're using Tor.
- xioren00 6y ago
  More complex =/= more secure. Tor, Whonix, Tails, et all have sections in their wikis covering potential tunneling setups and their thoughts on efficacy and rationale behind them. From the Tor wiki: > You -> X --> Tor --> X > No research whether this is technically possible. Remember that this is likely a very poor plan because [#You-Tor-X you -> Tor -> X] is already a really poor plan.
  - Shared404 6y ago
    Fair enough. While I'm comfortable saying I'm more competent at such things then a layperson, I'm definitely not actually competent.
chrisfosterelli 6y ago
I don't think the author is recommending that, just discussing it... The guide recommends using a VPN over TOR in "specific cases", for example "when your destination service does not allow Tor Exit nodes", and for "VPN over TOR over VPN" they say it's not recommended because "it is just VPN over Tor but slower".
gruez 6y ago
>This suggests to me the author is giving advice based on paranoia rather than technical knowledge. I noticed that immediately on the home page. The author suggests installing and running some sort of python package to verify the pdf is harmless. That sort of makes sense, until you realize that installing a random python package and running it is exposing you to far more risk than a opening a pdf ever will.

m0ck 6y ago

Heh, I remember spending hours in college tweaking Firefox config flags and then checking which websites broke this time. Nowadays I just enable uBlock and call it a day. For ordinary people it's jut not worth it. Cool guide though, I will check it out.

giantg2 6y ago

This has been posted before... I wouldn't mind if it was posted every month, as I think it's that important (at least from a conceptual point or starting point).

neatze 6y ago

If you are that paranoid and not doing something very illegal, hmm, like pedo stuff, may be just quit social networks. There is healthy level of paranoia, this document is not healthy level.

bszupnick 6y ago
As someone who isn't THIS paranoid, but definitely closer to it than most, I can add a criteria for a reason one would be this paranoid. If you've worked in/with some of the agencies listed, you're not just paranoid but feel totally justified knowing exactly what some old pals can see.

sneak 6y ago

FWIW, this site appears to plagiarize text from my HN comments and website. I hadn't noticed, but another HN user did and brought it to my attention.

meowface 6y ago
What's an example?

gypsyharlot 6y ago

I would like to add that by introducing too many "special features" into browsers and such, you are making your fingerprint really unique.