9 ms·
Starting a new digital identity
- cyberlab 6y agoThis is a form of blue team hacking, and instead of doing offense, you are doing defense. It's worth remembering how it can all come crumbling down due to bad OPSEC. Read this for more information: https://blogsofwar.com/hacker-opsec-with-the-grugq/ https://blogsofwar.com/hacker-opsec-with-the-grugq/ The covert lifestyle can be mentally taxing, and you will make mistakes (if you're not consistently careful). Here's a good quote from that Grugq article: As I phrased it in my “The Ten Hack Commandments” — be proactively paranoid, it doesn’t work retroactively.
- deleted 6y ago[deleted]
- DoreenMichele 6y agoThe covert lifestyle can be mentally taxing, and you will make mistakes (if you're not consistently careful). Catch the flu or a cold, get shorted on sleep for one or more nights or have one distracted moment for any random reason and that can make the whole thing fall apart. People seem to vastly underestimate this reality. Also: In practice, people who are in earnest on the run are often identified based on things like subscribing to their favorite magazines related to their hobby. I think for most people that's the harder thing to address: How do you just stop being yourself and develop entirely new interests? Trying to just not do X because it's closely associated with who you are is amazingly hard and can rapidly start making people actually crazy. This is much harder to do than breaking a bad habit which is infamously hard for most people under the best of circumstances.
- ghaff 6y ago>How do you just stop being yourself and develop entirely new interests? Furthermore, no contact with people from prior life. Access to healthcare. Access to money if you didn't take a big pile out (and then where do you keep it?) Where do you live without a bank account? Driving is a big risk. The list goes on.
- deleted 6y ago[deleted]
- ASalazarMX 6y ago> I think for most people that's the harder thing to address: How do you just stop being yourself and develop entirely new interests? But why? There's countless people that enjoy the same things you do. Unless you're into very niche activities, it should dilute in the noise. Maybe drop the least popular activities/subscriptions/toys?
- imwillofficial 6y agoI read an article on people who work for life insurance companies that track down “missing presumed dead” people. The most common trip up was that they did not fully cut ties from their old life. Including friends, family, and hobbies and such. You’d be surprised. Anyone have the link? I can’t seem to find it.
- jellicle 6y agoThere are lots of people who like cars, and lots of people who like avocados, and lots of people in your ZIP code, but the intersection of those sets is... you.
- mooreds 6y ago> The only social media I would have is a nym twitter account What is nym in this context? That's a new word for me.
- HugoDaniel 6y agoNym The pseudonym a person selects and uses to sign his or her postings to websites, blogs, etc. so as to create a unique online identity without revealing their actual name/identity. "With his most recent idiotic post, Little_Brain really lived down to his nym." Source: https://www.urbandictionary.com/define.php?term=Nym https://www.urbandictionary.com/define.php?term=Nym
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- rsync 6y ago"What is nym in this context?" It is shorthand for pseudonym.
- dobladov 6y agoI can see some logic in buying second hand devices, but wouldn't be better to buy new ones with cash since second hand devices already have a history of usage that could lead to locate you?
- thedanbob 6y agoMight not be an option for the phone as it takes a while for alternative OSes to add support for particular hardware, so generally only older models are compatible.
- joe-collins 6y agoWhat's your threat model? That new phone's serial number has records of being shipped to the store you bought it at. The store has cameras and sales receipts.
- trungdq88 6y agoCan someone explain to me why doesn't he use his existing cash to buy stuff?
- botwriter 6y agoWould make sense if he withdrew small amounts from an ATM incrementally, but if he withdrew say $5k and then his web footprint went dead it draws a lot of red flags. Although it depends who your adversary is at the end of the day.
- Mediterraneo10 6y agoPeople commonly withdraw thousands of dollars and then disappear from online banking or bank-card use, if they leave to travel for some months in e.g. sub-Saharan Africa or Andean villages where all transactions will be made in cash.
- krisgee 6y agoThat's associated with a big travel purchase so you can cut that possibility out pretty quickly.
- cyberlab 6y ago> People commonly withdraw thousands of dollars and then disappear from online banking or bank-card use In fairness, using contactless payments is super convenient and although it leaves a data trail, the sheer convenience of being able to buy a beer without fumbling around in my pockets is great. It's the old privacy versus convenience argument. But then, here in the EU you can compartment your card use with things like Revolut, and you can even secure your card by setting a limit on how much you can spend with contactless (no affiliation with Revolut, I just enjoy their app). Of course in an ideal world, there would be no such (transparent) data trail and you would pay for everything with Monero, over Tor lol
- Mediterraneo10 6y ago
- deleted 6y ago[deleted]
- rsync 6y agoThis is a topic I think a lot about. I don't have a lot of time this morning so I will just say a few things ... First, the OP describes an eSIM for his mobile phone - in this case with a provider named "silent.link". In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers. This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code. So you are quite limited in what services you can sign up for and maintain with just an eSIM. Second, the term "threat model" does not appear in the article. This is important because if your threat model is "everyone except state level actors" or "everyone but state level actors AND my bank" the possibilities open up dramatically. I think there is a tremendous amount of benefit in remaining anonymous in relation to your carrier and the FAANGs and (various vendors) that is realistic to achieve - but anonymity in relation to state level actors is practically impossible. Third, there is a big, giant blind spot in the entire chain of identity and that is the following: VISA/MC do not validate name and address[3]. It seems like they do - and merchants believe that they do - but they do not. This means you can use your bank card with any name you like and the minimal address match (which, in the US, is zip code). I'm not going to diagram this out for you but if your threat model is (everyone except bank and state level actors) you now have the basis for a working pseudonym. Fourth, a second blind spot in the chain of identity is a business tax ID (which you can get for free at[4]). Many providers (like mobile carriers) ask for things like SSN, etc., but if you say "business" and give them a tax ID, it's like their brains turn off. They typically don't even ask for ID. You can initiate service over the phone. You may be forced to pay a higher rate for "business service". [1] gmail, your bank, even twilio (ironically). [2] https://en.wikipedia.org/wiki/Short_code https://en.wikipedia.org/wiki/Short_code [3] AMEX does. [4] https://sa.www4.irs.gov/modiein/individual/index.jsp https://sa.www4.irs.gov/modiein/individual/index.jsp
- gruez 6y ago> In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers Are you conflating eSIMs (which are just equivalent to physical SIMs) with "burner phone" apps? I guess it's possible that the MVNO uses voip numbers rather than "real" phone numbers, but several large mobile providers (eg t-mobile) use eSims. > This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code jmp.chat is a voip service and supports short codes just fine. https://jmp.chat/sp1a/faq/ https://jmp.chat/sp1a/faq/
- captn3m0 6y ago>[...] but instead opt for a free Protonmail account Protonmail faces a lot of spammer signups for their free plan and require a reCaptcha, Email, or SMS to create a free account[0]. In practice I've always been asked for a email or SMS. They do clarify: >We don’t save reCaptcha results. If you are presented with Email or SMS verification, we only save a cryptographic hash of your email or phone number which is not permanently associated with the account that you create. so it seems okay, but there is a temporary trail (I remember reading that they delete these after some time) to your original email/mobile to maintain rate-limits. Something to keep in mind. [0]: https://protonmail.com/support/knowledge-base/human-verification/ https://protonmail.com/support/knowledge-base/human-verifica...
- gruez 6y ago>In practice I've always been asked for a email or SMS. I suspect it depends on your IP reputation. A VPN or tor exit code would definitely get hit with those measures, given how much abuse emanate from them. The IP reputation of a local library would be relatively clean.
- tacostakohashi 6y agoA "digital identity" should be easy enough, using the steps mentioned or by other means. I have sometimes thought it would be (more) interesting doing this with a real identity. I suspect it wouldn't actually be that hard to find an identity / birth certificate for someone from an obscure county, perhaps with poor / lost records and try to build up a paper trail from there, as much as a sport as anything else. I have a suspicion that it would be fairly doable to get quite far with it, but of course one slip-up and you could end up in prison.
- ghaff 6y agoRemaining anonymous in the physical world is much tougher--although, again, it depends on your threat model. I think you'd almost have to have a fake ID which you wouldn't want to use in circumstances where it might actually be checked against databases, such as driving.
- tacostakohashi 6y agoThe goal wouldn't be anonymity, rather to have a real, valid (state-issued) driver's license with a different name on it to use when convenient.
- ghaff 6y ago>an identity / birth certificate for someone from an obscure county That would not get you a driver's license in the US. You're also required (probably in all states--certainly to get a REAL ID-compliant card), you need proof of citizenship or lawful presence.
- tacostakohashi 6y agoBirth certificate in an obscure county is proof of citizenship - perhaps you misread that as "country".
- mjochim 6y ago
- JKCalhoun 6y agoReads sort of like part nerd romance and part paranoia-tinged thriller. 3 out of 5 stars, would recommend to my engineer friends.
- imwillofficial 6y agoNot useful. How would you improve? What made you dock those 2 stars? Any better advice?
- majewsky 6y agoBy starting with a more relatable premise. Even within this very tech-minded and privacy-conscious audience, only a microscopic minority will be interested in actually taking such measures.
- vlfig 6y agoFor a less romanticised, more practical resource on the topic, I recommend The Hitchhiker’s Guide to Online Anonymity https://anonymousplanet.org/guide.html https://anonymousplanet.org/guide.html (also, Monero > bitcoin)
- jpeter 6y agoThe "get an anonymous pre-paid sim card" section doesn't tell you what to do if you can't get one in your country.
- choeger 6y agoYou buy one. You can probably buy a sim card for cash in any high school, college, or public park.
- 3np 6y agoYou may be surprised to find this is getting increasingly unlikely in more and more places.
- pwdisswordfish8 6y agoIf you're not bothered by having a conversation with the homeless, indigent, or hard-up, then it's more doable than you think. You're not just subject to the chance of happening upon someone already in the business of providing these services. You can be a job creator. With mandatory (and otherwise widespread) masking policies right now, it's even easier than under normal circumstances.
- numpad0 6y ago> You can be a job creator. And the godfather, depending on how local laws are written.
- 3np 6y agoAt least where I live, there is simply no option for voice/SMS SIM cards other than a subscription drawing from your credit card or bank account etc. So it would take the proxy person to also hold a bank account or credit card and be on the hook for any charges to the SIM card. Even with government ID etc they can't just go to a shop and pick up a prepaid for cash. Theoretically possible, yes, but in practice, I think the only option is if you have the "right" connections with organized crime. I don't think you'd be able to solicit on the streets, even in the capital.
- shanecleveland 6y agoThis is more about avoiding having a digital identity. I recently created a second Twitter account to create some separation between personal and business interests, conversations, etc. Not that I want to have two identities, but I would like to be able to distinguish between them. It was not difficult, but required some effort to create separation (I didn't want twitter suggesting my "business" account to my friends I already followed on my personal account). Facebook was another story. I have never had a Facebook account until a couple of weeks ago. I took on a new hobby recently, and the most active community around this topic is exclusively on Facebook. I joined and immediately disabled the ability to be seen to the extent I saw possible. But then Facebook disabled my account within 24 hours – the irony! They allowed a review process, which required a selfie (they clearly know my identity through facial recognition, despite having never supplied a picture myself). They let me back in fairly quickly. But I hate having to "support" the ecosystem. And it turns out I cannot friend anybody without allowing their friends to view my account.
- hpoe 6y agoOne thing that helped me a lot with this is Firefox containers. I started using it just to separate work and personal, but now I have Work, Personal, School, my professional blog, and my DND sessions and it is great, it really promotes separation and helps me manage all of them seamlessly and independently.
- shanecleveland 6y agoThat's a good tip. Thanks. Twitter actually makes it easy to switch between accounts in their app, but I do have a mangled mess of folders, files, bookmarks, etc.
- ticviking 6y agoWe don't have to support it. We are unwilling to pay the cost of the friction facebook removes from our ability to connect to their community.
- shanecleveland 6y ago
- mywittyname 6y agoI would think that true digital hiding requires a good bit of misdirection. If you go completely off the grid, then you leave a hole where a person should be. But if you have a legitimate house, credit card, phone, facebook account, etc. then you have plausible deniability when it comes to hiding. The person looking into you might shrug and be like, "this is all we have on them."
- KirillPanov 6y ago> But if you have a legitimate house, credit card, phone, facebook account, etc. then you have ... committed identity theft, punishable by 20 years in the can.
- dkarras 6y agoyeah facebook does not f*ck around
- dominojab 6y agopaying with bitcoin for an esim , isn't bitcoin digital gold have the narrative changed ?
- deleted 6y ago[deleted]
- dj_mc_merlin 6y agoLeading an identity-less life will not protect you from having your business intruded upon. It requires a lot of effort and setup, which means a lot of possible trails to leave behind. And if people look into you and see nothing where you should be, that's immediately suspicious. Criminals have been doing it for ages though, by keeping a low profile. You cannot reliably hide from the state, but if you seem insignificant you can go unnoticed for a long time. Low-level dealers in many countries just use WhatsApp, some straight up text and call, despite knowing police could always be listening. If you're selling to a couple dozen people, the police won't bother tracking you down. They have bigger fish to fry. Higher-level dealers engage in much more OPSEC: using fake names, not letting anyone not involved see them, meeting in person etc. This is a consequence of the fact that they are more likely to be noticed.