8 ms·

I'm glad they made this chart on their website https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg But one should prac

I'm glad they made this chart on their website https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg But one should practically note that this is just a practical warning. The omnipotence of the Mossad and NSA etc is limited too, and their interest in things is also limited. Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. But 9 out of 10 things you could possibly even do are not things that would have them bother with you, although it is accurate that over time you begin to have a problem if you are really trying to stay both private and anonymous and are doing criminal violations (distinct from civil violations). So just keep rotating keys and move with purpose. Limit your Tor session to implementation and execution and consider using Tor just for casual reading or accessing RDP to actually browse clearnet from someone else's computer.

simonebrunozzi 6y ago
> Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. Nicely explained, and AFAIK, pretty much correct.
tomcooks 6y ago
Create rogue TOR nodes Use TOR for menial stuff to create background noise Regularly trade laptops and phones with like-minded individuals Assume you've been breached and that the government has full attention to you Be as paranoid as possible, any step towards lack of freedom for the sake of convenience is unretracheable
- vmception 6y ago
  yeah running 1 or 2 of your own Tor nodes seems to be pretty ideal. One of which being an exit node. Connecting to that is the move. providing an obfs4 bridge seems good too but I really wish there was a docker container for all this, the documentation is all over the place, most of it is just on forums that can only be accessed on Tor and those forums have unreliable uptime, it is really discouraging but it seems like there are some very competent people that are so comfortable doing this that one could just assume they all have this greater level of OPSEC and infrastructure
  - jstanley 6y ago
    I possibly misunderstand you, but why would connecting to your own Tor exit node help your anonymity?
    - vmception 6y ago
      your traffic is mixed in with others using your exit node, and you control the data and logging of that exit node
      - ramraj07 6y ago
        But if they can trace back all the activity pertaining to a case they can show strongly though not conclusively that you were probably the source? Also as long as they can prove that you constructed the setup you also start looking guilty as hell..
        vmception 6y ago
        varies by jurisdiction, so far us and its states havent made exit node owners responsible for traffic or let that go beyond the doubt
  - tomcooks 6y ago
    With a solution like https://github.com/jaromil/TorTV https://github.com/jaromil/TorTV one could have much more than a couple of exit nodes.
- geuis 6y ago
  > Regularly trade laptops and phones with like-minded individuals That puts you into a group of people then. Groups are easier to infiltrate. In opsec, people are vulnerabilities.
  - rodolphoarruda 6y ago
    I agree with you. But I like the idea of trading devices with people who have already tied their ID with IMEI, wi-fi networks, ISP IPs etc. Identity theft? Not really... Just borrowing it for a while.
    - geuis 6y ago
      Problem is, you essentially can’t trust people. Not even in a personal “do I know this person” way. But fundamentally people are squishy. If you squish them too much, they’ll do things they never wanted to do. That unfortunately is why groups greater than 1 are a weak spot. In your scenario, you’ll never know if the last person increments an ID somewhere or did some other activity that adds compromises the chain.
    - gruez 6y ago
      Your ISMI (aka your sim card) is going to be sent alongside your IMEI, which makes that type of identity "borrowing" pointless because the carrier can see right through it. wifi mac addresses can be easily spoofed without swapping hardware. Overall I don't see much value in swapping hardware.
      - rodolphoarruda 6y ago
        In this case I would use the SIM card used by the former owner, if it's a pre-paid plan, for example. This is quite common trade in the place I live.
        zie 6y ago
        only if they are still paying the bill will this be useful. If you start paying the bill, well then.. they know exactly who you are.
- throw_nbvc1234 6y ago
  Are you truly free if you're forced to be paranoid about everything? Secure maybe but that doesn't sound "free".
  - deleted 6y ago
    [deleted]
  - tomcooks 6y ago
    I'm free to give up technology, the price to pay if I want to use tech is to be careful and paranoid. Not for myself but for other people in this world who aren't as lucky as myself in terms of freedom.
    - lupire 6y ago
      You're still restricted from going about the life the way you want. Having to make that tradeoff is an imposition on liberty.
metters 6y ago
Mossad’s gonna do mossad things
ngcc_hk 6y ago
Unless you are in a totalitarian state ... everything is collected and fished. Interested. May be wring but after you are wrong.
giantg2 6y ago
"...and feeding local law enforcement around the globe the information about you." Local law enforcement gets almost nothing from them. Providing info on low level offenders greatly decreases the effectiveness of the program, especially if those offenders are being prosecuted in open courts (ie not the secret courts or foreign countries).
gruez 6y ago
>https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg The second column is a bit puzzling. The adversaries are listed as advertisers and people randomly googling you, but the suggested mitigation is to... add 2fa? What type of advertisers and/or googlers are breaking into your accounts?
- harry8 6y ago
  Didn't linked in and facebook do this? Give us your email account and password and we'll add your friends for you! So easy! You can bet someone is still doing it and more will try it until such time as there are negative consequences for it. Seems that there aren't any now.
  - gruez 6y ago
    If you're going to get social engineered into giving up your password, chances are you're going to get social engineered for your 2fa code as well.
  - lupire 6y ago
    They'll use Oauth now, which won't be stopped by 2FA
seibelj 6y ago
And in the offline world - pay for things in cash. Government is lazy and they love being able to search everything. Sending people to actually investigate things with actual leg work is not ideal. Paying in cash, or doing anything physical (pen and paper, in-person talking) breaks everything.
- marshmallow_12 6y ago
  which is why laws are being made to prevent large cash transfers. I won't say which country i'm referring to, but it sounds like a police state. I'm terrified this will become the new reality. Bitcoin to the rescue? I shudder at the thought.
  - botwriter 6y ago
    could easily be the UK.
- ramraj07 6y ago
  And live in New York City? Probably the one last city where you at least have a chance at being anonymous. The train station camera coverage is a joke.
andai 6y ago
Most of this info seems like overkill for most people's purposes, and as mentioned even following all of it won't protect you against the NSA etc. Maybe it would be good to have an interactive version of the guide with a slider or something, which shows you the most relevant steps to take for your situation?
- m463 6y ago
  What I wonder about is the democratization of technology. Basically, the technology available to the folks with "unlimited global resources" trickles to the left and becomes available to even to those with lesser skills/motivation. For example, databases and tools formerly available only to governments are widely available. Things like DL data, wifi ap databases, rainbow tables, gps trackers - a web search + a credit card.
sneak 6y ago
The bottom right cell in this chart is directly plagiarized (poorly, the dropped question mark makes the joke less funny) from a great article by James Mickens. https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf The site also plagiarized text from some HN comments I've made, so there is a clear pattern here.

simonebrunozzi 6y ago

> Basically the attack vector from them is polluting the Tor nodes (so that they control enough of them to understand information), timing attacks on onion services to figure out locations of people accessing the hidden services solely within in Tor, as well as undeclared exploits, and feeding local law enforcement around the globe the information about you. Nicely explained, and AFAIK, pretty much correct.

tomcooks 6y ago

Create rogue TOR nodes Use TOR for menial stuff to create background noise Regularly trade laptops and phones with like-minded individuals Assume you've been breached and that the government has full attention to you Be as paranoid as possible, any step towards lack of freedom for the sake of convenience is unretracheable

vmception 6y ago
yeah running 1 or 2 of your own Tor nodes seems to be pretty ideal. One of which being an exit node. Connecting to that is the move. providing an obfs4 bridge seems good too but I really wish there was a docker container for all this, the documentation is all over the place, most of it is just on forums that can only be accessed on Tor and those forums have unreliable uptime, it is really discouraging but it seems like there are some very competent people that are so comfortable doing this that one could just assume they all have this greater level of OPSEC and infrastructure
- jstanley 6y ago
  I possibly misunderstand you, but why would connecting to your own Tor exit node help your anonymity?
  - vmception 6y ago
    your traffic is mixed in with others using your exit node, and you control the data and logging of that exit node
    - ramraj07 6y ago
      But if they can trace back all the activity pertaining to a case they can show strongly though not conclusively that you were probably the source? Also as long as they can prove that you constructed the setup you also start looking guilty as hell..
      - vmception 6y ago
        varies by jurisdiction, so far us and its states havent made exit node owners responsible for traffic or let that go beyond the doubt
- tomcooks 6y ago
  With a solution like https://github.com/jaromil/TorTV https://github.com/jaromil/TorTV one could have much more than a couple of exit nodes.
geuis 6y ago
> Regularly trade laptops and phones with like-minded individuals That puts you into a group of people then. Groups are easier to infiltrate. In opsec, people are vulnerabilities.
- rodolphoarruda 6y ago
  I agree with you. But I like the idea of trading devices with people who have already tied their ID with IMEI, wi-fi networks, ISP IPs etc. Identity theft? Not really... Just borrowing it for a while.
  - geuis 6y ago
    Problem is, you essentially can’t trust people. Not even in a personal “do I know this person” way. But fundamentally people are squishy. If you squish them too much, they’ll do things they never wanted to do. That unfortunately is why groups greater than 1 are a weak spot. In your scenario, you’ll never know if the last person increments an ID somewhere or did some other activity that adds compromises the chain.
  - gruez 6y ago
    Your ISMI (aka your sim card) is going to be sent alongside your IMEI, which makes that type of identity "borrowing" pointless because the carrier can see right through it. wifi mac addresses can be easily spoofed without swapping hardware. Overall I don't see much value in swapping hardware.
    - rodolphoarruda 6y ago
      In this case I would use the SIM card used by the former owner, if it's a pre-paid plan, for example. This is quite common trade in the place I live.
      - zie 6y ago
        only if they are still paying the bill will this be useful. If you start paying the bill, well then.. they know exactly who you are.
throw_nbvc1234 6y ago
Are you truly free if you're forced to be paranoid about everything? Secure maybe but that doesn't sound "free".
- deleted 6y ago
  [deleted]
- tomcooks 6y ago
  I'm free to give up technology, the price to pay if I want to use tech is to be careful and paranoid. Not for myself but for other people in this world who aren't as lucky as myself in terms of freedom.
  - lupire 6y ago
    You're still restricted from going about the life the way you want. Having to make that tradeoff is an imposition on liberty.

metters 6y ago

Mossad’s gonna do mossad things

ngcc_hk 6y ago

Unless you are in a totalitarian state ... everything is collected and fished. Interested. May be wring but after you are wrong.

giantg2 6y ago

"...and feeding local law enforcement around the globe the information about you." Local law enforcement gets almost nothing from them. Providing info on low level offenders greatly decreases the effectiveness of the program, especially if those offenders are being prosecuted in open courts (ie not the secret courts or foreign countries).

gruez 6y ago

>https://anonymousplanet.org/media/image6.jpeg https://anonymousplanet.org/media/image6.jpeg The second column is a bit puzzling. The adversaries are listed as advertisers and people randomly googling you, but the suggested mitigation is to... add 2fa? What type of advertisers and/or googlers are breaking into your accounts?

harry8 6y ago
Didn't linked in and facebook do this? Give us your email account and password and we'll add your friends for you! So easy! You can bet someone is still doing it and more will try it until such time as there are negative consequences for it. Seems that there aren't any now.
- gruez 6y ago
  If you're going to get social engineered into giving up your password, chances are you're going to get social engineered for your 2fa code as well.
- lupire 6y ago
  They'll use Oauth now, which won't be stopped by 2FA

seibelj 6y ago

And in the offline world - pay for things in cash. Government is lazy and they love being able to search everything. Sending people to actually investigate things with actual leg work is not ideal. Paying in cash, or doing anything physical (pen and paper, in-person talking) breaks everything.

marshmallow_12 6y ago
which is why laws are being made to prevent large cash transfers. I won't say which country i'm referring to, but it sounds like a police state. I'm terrified this will become the new reality. Bitcoin to the rescue? I shudder at the thought.
- botwriter 6y ago
  could easily be the UK.
ramraj07 6y ago
And live in New York City? Probably the one last city where you at least have a chance at being anonymous. The train station camera coverage is a joke.

andai 6y ago

Most of this info seems like overkill for most people's purposes, and as mentioned even following all of it won't protect you against the NSA etc. Maybe it would be good to have an interactive version of the guide with a slider or something, which shows you the most relevant steps to take for your situation?

m463 6y ago
What I wonder about is the democratization of technology. Basically, the technology available to the folks with "unlimited global resources" trickles to the left and becomes available to even to those with lesser skills/motivation. For example, databases and tools formerly available only to governments are widely available. Things like DL data, wifi ap databases, rainbow tables, gps trackers - a web search + a credit card.

sneak 6y ago

The bottom right cell in this chart is directly plagiarized (poorly, the dropped question mark makes the joke less funny) from a great article by James Mickens. https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf The site also plagiarized text from some HN comments I've made, so there is a clear pattern here.