21 ms·

Be anonymous

650 points by kashnote 5y ago

kwhitefoot 5y ago
The title is misleading, clickbait. The article is in fact about why it probably isn't necessary to be anonymous and even then says nothing particularly important.
- djur 5y ago
  A title not precisely describing the premise and conclusion of the article is neither misleading nor clickbait. The article is about online anonymity. It could be "On being anonymous" or "To be anonymous"; "Be anonymous" is fine, too.
Janiya 5y ago
blakesterz 5y ago
"Ultimately, anonymity comes down to one thing: Control. You should educate yourself on data privacy and make sure that you know what data you're sharing and what is possibly out there." That's some REALLY good Solid advice.
- touisteur 5y ago
  And be OK that sometimes some people don't want to interact with anonymous randos... Credentials are not everything, but they are a filter on medias with large amounts of time-wasters...
- anderspitman 5y ago
  I see what you did there https://solidproject.org/ https://solidproject.org/
nickstinemates 5y ago
The conclusion is a weird one, given the premise. The crux of the argument is basically true. Its an all or nothing proposition. Or you can lead a double life. One for your public persona, where you don't care at all about security, and your real persona, where you do. This has been my approach on the internet since basically it started and handles were a common thing.
- caslon 5y ago
  With that in mind, you just might have posted this comment on the wrong account.
- ReactiveJelly 5y ago
  > The crux of the argument is basically true. Its an all or nothing proposition. No, it's not. Every online account (that doesn't involve money or legal paperwork) can have its own name. Then you can decide whether to have _some_ accounts ultimately link back to your legal name, or all accounts, or none. > Or you can lead a double life. ... This has been my approach on the internet since basically it started and handles were a common thing. That's exactly what I'm doing, and neither of us are living in the Brazilian rainforest, so anonymity really is a spectrum.
  - numpad0 5y ago
    > Then you can decide whether to have _some_ accounts ultimately link back to your legal name, No, you don't. Someone else could, if there is one with high enough affection to you. I think you'll have to think of bulk ingestion and on-prem processing to be sure your activities won't trace back to you.
- aqme28 5y ago
  I don’t think it’s all or nothing. Look at anonymous public personas like Banksy or Dril. People have tracked them down, and you can look up who they are if you try. But for the most part these people are anonymous, and get to enjoy some of the benefits of that.
  - 5y ago
ReactiveJelly 5y ago
Agreed. Anonymity is a spectrum. Just like personal finance, most people haven't even begun to assess what state they're in. You should not accept the state you're in without knowing what state that is. Most people should have more anonymity than they're giving themselves. "Defend your rights. Nobody else will do it for you." -- ReactiveJelly
indigodaddy 5y ago
Feels like the article is slanting this Alex guy as a hero of sorts? I don’t like the tone of the article and wish I hadn’t clicked on it now..
- jokethrowaway 5y ago
  Who's more harmful, someone who facilitate the selling of illegal items or those who define what is legal? In a lawless society what this guy was doing would have been a respectable trade like any other.
  - indigodaddy 5y ago
    You can twist your way into thinking any very bad thing or practice isn’t so. We can extend your line of thinking to murder and rape— does that sound acceptable too? No, this guy was much worse and more harmful than the norms of our society and those that propagate those norms.
    - anonymoushn 5y ago
      It is difficult to articulate how much worse Henry Kissinger and Phil Bokovoy are for the world than Alexandre Cazes and Ross Ulbricht.
      - CRConrad 5y ago
        > Henry Kissinger Holy shit, that fucker is still alive!
srmarm 5y ago
Privacy is on a spectrum, but is also compounded by time and once the cats out the bag it can be impossible to turn back. In the example given of Alex Cazes he could change the from email but the damage was already done - there's no way to recall the emails already sent that led a trail back to him.
- upofadown 5y ago
  The article states that anonymity is on a spectrum. Privacy is a different issue. You can lead an entirely private but non-anonymous life.
ur-whale 5y ago
I would strongly advise anyone who really wants to be anonymous on the internet such as a freedom activist in a totalitarian country, not to follow the advice listed at the end of the article. Or rather: these are very basic and very naive recommendations, certainly good first steps, but absolutely nowhere near enough to guarantee strong anonymity on the internet. Remaining truly anonymous on the net is extremely hard, especially in these days where ML can be used to statistically narrow down and pinpoint who wrote a specific piece of text only based on things like use of punctuation, vocabulary, sentence structure and style.
- Swenrekcah 5y ago
  Would the solution be a digital version of the old newspaper cutout ransom letter? Generate via GPT-3 a text giving roughly the impression you want to make and then copy/paste sentences from online news media if you need the names of particular persons or events. Would be rather crude though, but less tedious than literally cutting and pasting letters was.
  - kgeist 5y ago
    I had a similar idea in a sibling post. But this only works if you basically have a secret alter ego which has nothing to do with your work/public persona, because otherwise they can match your favorite topics in those GPT-3 generated texts to your interests in real life, by factoring in also other little facts, like when you usually appear online, etc. It's probably enough to protect the average Joe but imho not enough to protect a targeted freedom activist, unless their activism is their alter ago and publicly they aren't known to be activists. Otherwise their every step is monitored in a typical dictatorship and it's not that hard for them to connect the dots who was the author of a certain message.
- kgeist 5y ago
  >especially in these days where ML can be used to statistically narrow down and pinpoint who wrote a specific piece of text only based on things like use of punctuation, vocabulary, sentence structure and style. I think you can fight ML with ML - for example, use GPT-like algorithms generate text for you. But then you must also be careful about when you post - I remember some of the Russian trolls were exposed because their bursts of activity coincided with 9am-6pm Moscow time. So you have to use a random number generator decide when to appear online if you want to hide your location. There's always something which can narrow down their search. One small mistake and you are busted. They don't even need to pinpoint you exactly, if it's narrowed down to 1000-10000 people who meet the criteria, they already win because they have the capacity to go through the list one by one and eventually find you.
oh_sigh 5y ago
Alex Cazes had bad op-sec. His #2, DeSnake, didn't, and is still alive and well and has restarted his marketplace and gives anonymous interviews to media outlets: https://www.wired.com/story/alphabay-desnake-dark-web-interview/ https://www.wired.com/story/alphabay-desnake-dark-web-interv...
vmception 5y ago
Exhibit A: Was Mary only from Syracuse, or was Kash, kg.dev, using dating apps in Syracuse well, I got tired of caring already, but maybe others havent.
formerly_proven 5y ago
Be anonymous Become ungovernable
m348e912 5y ago
I don’t know if dating app users understand that it doesn’t take much information to find out who they really are. Sometimes all that’s needed is a first name, profession, or university is enough if one of the three is somewhat unique for the area. If you’re concerned about privacy on dating apps, you’re better off being really vague about basic aspects of your life, or trying a bar instead :)
Ansil849 5y ago
> Don't use macOS or Windows -- only Linux > Move to Brazil and live in the rainforest Juvenile, snarky, irreverent and irrelevant advice I'd expect to read on a 12 year old's Reddit post.
- i_am_proteus 5y ago
  That might be why the next thing in the article is: >I don't know about you, but I don't want to do all of that.
- retrac 5y ago
  > I don't know about you, but I don't want to do all of that. [...] I don't recommend being on either extreme of this spectrum. It's a list of extreme techniques for protecting ones' identity online. Of course, completely sanitizing your online presence is difficult, and probably unnecessary. I thought the two lists were a nice rhetorical framing - present a dilemma (total openness vs. total anonymity) and then wiggle out of it to a compromise.
  - Ansil849 5y ago
    > It's a list of extreme techniques for protecting ones' identity online. The items I quoted do nothing to protect ones' identity online. Snark is only effective if relevant.
    - AitchEmArsey 5y ago
      The closed nature of MacOS and Windows means that you have no guarantees (and no audit mechanism) to determine how much the machine is passing your data back to HQ. As the post very clearly states, most people don't need to care - but someone with extreme paranoia has only one obvious choice here. Your aggressive negativity is far less interesting than this blog, and serves no purpose whatsoever.
    - RustyConsul 5y ago
      holy cow! I literally laughed out loud when i read the rainforest remark. Chill out dude, you're reading something called 'Thoughts' by some random dude on the internet lol
mindvirus 5y ago
The article touches on a good point: one mistake and you're out. It doesn't even have to be your mistake - you didn't choose to put your SSN out there after all, yet here we are. This gave me a radical company idea, on the other end of the spectrum: spam as a service. Something that'll take your name, email, and other things and put it all over the internet in questionable and plausibly denial ways. That way, even when someone is trying to find things out about you, it'll be hard to find, and easy to deny. (I'm kidding of course).
- propesh 5y ago
  Kidding aside, this is exactly how it will go down. Politician in a scrape of financial corruption or etc.? Deepfake s*x video or other viral blatant misinformation & obfuscation; what's the risk? Upside, no one knows what to believe. Exactly what various "countries" are doing. It will be extreme; to the point where, don't believe half of what you actually see.
  - bee_rider 5y ago
    It should be noted that this is a pretty bad end state. Reporting is already an extremely weak force for preventing corruption on the part of the powerful. Journalists entering a state of total uselessness is only going to make the problem bigger. In a realm of total bullshit the winners are the one who are best at lying. "I don't know what to believe and everyone involved is probably corrupt" is usually just an excuse to disengage and follow base instincts.
    - jimkleiber 5y ago
      > It should be noted that this is a pretty bad end state I agree. The parent poster didn't ask what's the downside, and I think it's this: when no one knows what to believe and starts to distrust most things, society may start to fall apart, as society relies on us trusting each other. So while I think disinformation is one of the best privacy strategies (not so different from differential privacy efforts by Google and others, suggested by the OP but without the term name), I think the more we lie to hide, the more we spin others and ourselves in circles. I really like Sam Lessin's essay on this at The Information, where he talks about how, with the nature of the internet being so easy to share info, we have to start spreading disinfo to even close colleagues, so far as even lying to ourselves. I think this paradox is one of the most challenging paradoxes of our time: the internet makes it so easy for us to open up and share and yet it makes it so hard for us to not open up and share. [0]: https://www.theinformation.com/articles/the-future-of-privacy-disinformation https://www.theinformation.com/articles/the-future-of-privac...
alfiedotwtf 5y ago
Good article! As an experiment, a few years ago I put my mobile phone number on my blog, and to date I've only received 2 anonmous messages on Signal but no calls besides recruiters. The old adage "No one is thinking about you as much as they are thinking about themselves" is true. While it's good to practice good security hygiene, be mindful of also being practical.
- CRConrad 5y ago
  > The old adage "No one is thinking about you as much as they are thinking about themselves" is true. Or "No one is thinking about you as much as you are".
underwater 5y ago
I mix @realname and @pseudonym accounts. I'm generally pretty careful about what I post under my real name and less so under an alias. However, over time I drop enough clues that people could figure my real identity with a little work. That leaves me with the worst of both worlds. It seems safest to assume that your identity is always tied to everything you do online.
- can16358p 5y ago
  I think with ML getting smarter and people posting (either with their identity or anonymously) more and more content, it will be trivial to crossmatch anonymously posted content to real identities by ML examining "styles" of text: from punctuation to sentence structure to vocabulary use, and it will have an accurate estimation of who that "anonymous" person is.
  - kibwen 5y ago
    This would be pretty easy to counter by having a tool that would analyze any comment you post and strip all the identifying marks out of it; no punctuation other than periods, no complex or compound sentences, all words replaced by equivalents from the list of the most common thousand English words, all voices and tenses normalized, no paragraphs, no capitalization, etc.
    - bufordtwain 5y ago
      At which point, nobody would want to read it.
    - marvin 5y ago
      That's a bit of a nightmare for communication, though. Subtlety is a thing, both for nuance and clarity.
      - can16358p 5y ago
        There is another side of the coin though. If the "countering" software is smart enough to analyze the semantics and the meaning of the sentence (which I think will definitely have the ability to), it can easily convert it to an intermediate representation and create an actually gramatically correcy, good looking, easy to understand sentences. It can even improve the original text, making it more clear and anonymous-style.
chayesfss 5y ago
Share accounts with others, widely. No reason not to unless you’re trying to build up some type of e-cred with your other account.
ChrisMarshallNY 5y ago
I'm sort of the opposite. I make sure that I can be found and attributed. I deleted my last anonymous account, a couple of years ago. In the Days of Yore, I was pretty much "Dick From the Internet." A real neckbeard troll. There's a lot of reasons that I do it. The biggest, is that I want to be in control of my narrative. I learned from a couple of folks that are really good at curating their SEO results. Also, these days (for a change), I'm pretty well-behaved. Doing it this way, helps to keep it that way.
- mqnfred 5y ago
  You’ve said it better than I could have. Many people on HN probably know your handle/identity, if only by virtue of you referring to it in your comments somewhat systematically. You manage your identity with an SEO mindset indeed. I do not mean to offend, but it does read just as fake as any SEO search results.
  - deleted 5y ago
    [deleted]
jefftk 5y ago
The article presents a spectrum, dismisses both extremes, and advocates that people aim for the middle. The problem is, you may think you are hanging out in the middle, but you probably have much less privacy than you think you do. Even if you are making the right choices for today, you can't trust that the future will keep things private (advances in ML, ubiquitous surveillance) and you don't know that futures isn't here yet. Personally, I hang out at the fully open end of that spectrum. This has worked out pretty well for me; I don't think I've run into any downsides.
- Tepix 5y ago
  I think we have to ask ourselves: What do we want to achieve by protecting our online identity? For me, escaping the pervasive tracking and profiling by FAANG is one goal. I'm sure that tracking me across the internet is a lot more difficult (not impossible) than tracking the average user. Hopefully it can't be done in an automated fashion. That way tracking me is hopefully just not worth doing just for a few advertising dollars.
ronnier 5y ago
I don't care about being anon, but I don't want all my info sitting in databases, so I've made done the following and trying to evolve over time and fix gaps that I currently have. This is things I've done... * Use Brave browser with ublock origins and privacy badger * Use pihole + unbound to resolve my own DNS and do not use google * Run wireguard on my home network that I connect to when I'm out and need to use wifi * Be anti-google as much as possible. I'm still in the process of this, i'll switch my domain based email off of google soon * Be anti-facebook and delete all accounts (whatsapp and insta included) * Be anti-reddit * Be anti-cloud and host everything internally as much as possible (except for encrypted backups, say for video cam footage) * All of my home automation is local and blocked from the internet. If I want access, I'll connect to my VPN. * Use signal with disappearing chats to communicate with my friends. Still a lot to do, but it's a start...
- hammock 5y ago
  I believe Brave browser has fallen out of favor but I'm not an expert on why
  - ronnier 5y ago
    Interesting. Please let me know if you have a better alternative. Ideally I'd like to just run chromium but then I have to build it myself or use some build by some untrusted person so I've decided I'll trust Brave for now...
    - xvector 5y ago
      Aside from Tor Browser, Firefox with arkenfox/user.js is ideal for privacy [1]. Chromium-based browsers like Brave are ideal for security [2]. An ideal solution for privacy and security would be running Firefox+user.js in Qubes OS [3], or for even more anonymity, Tor Browser in Qubes-Whonix [4]. However, even this isn't bulletproof, and a 3 letter agency can still determine who you are with techniques like keystroke deanonymization [5] or other techniques [6] like traffic analysis. Tor is also not reliable for anonymity because the project is kind of a shitshow [7], so there's really nothing you can do to truly hide. [1]: https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js [2]: https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... [3]: https://www.qubes-os.org/ https://www.qubes-os.org/ [4]: https://www.whonix.org/wiki/Qubes https://www.whonix.org/wiki/Qubes [5]: https://www.whonix.org/wiki/Keystroke_Deanonymization https://www.whonix.org/wiki/Keystroke_Deanonymization [6]: https://www.whonix.org/wiki/Warning https://www.whonix.org/wiki/Warning [7]: https://www.hackerfactor.com/blog/index.php?/archives/906-Tor-0day-The-Management-Vulnerability.html https://www.hackerfactor.com/blog/index.php?/archives/906-To...
cellis 5y ago
As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could easily flag you to your government. If you use wifi at a common point you're likely to be flagged and there isn't an easy way other than keeping on the move. But moving often is another anomalous event, and it's very difficult to do even for Drug Lords ( El Chapo ) or Terrorists that it behooves to do. This puts you in a sort of Zugzwang, to borrow a chess term. - there's always leakage, for instance, in the way you talk with people in the real world. At some point you send enough communication for sophisticated frequency analysis. - and there are other patterns of usage that could be used to identify you, like searches or even keyboard frequency on anonymized accounts can be de-anonymized by very specific markers ( ML works! ). - off ramps for crypto aren't very good. If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed. Mixers and tumblers will eventually leak and you'll be caught. - you're very vulnerable to social engineering by people you do business with. one slip where you stop communicating in a transactional mode of communication and that's a weak link in your armor. In the end, the FBI only has to be right once, and you have to be right every time.
- xvector 5y ago
  > keyboard frequency on anonymized accounts can be de-anonymized Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix. > Mixers and tumblers will eventually leak Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. But, you are right that it is futile to maintain defense against a determined 3 letter agency. [1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak
  - beardog 5y ago
    I made this Firefox extension to defend against keyboard deanonymization on desktops https://git.voidnet.tech/kev/PrivateKeyboardAddon https://git.voidnet.tech/kev/PrivateKeyboardAddon I'm about to publish an update to it that uses a toolbar popup to fill out forms instead of the current lag approach, which will also protect against keyboard layout leaks[1] (which Tor browser/privacy.resistFingerprinting protects against anyway) https://bugzilla.mozilla.org/show_bug.cgi?id=1222285 https://bugzilla.mozilla.org/show_bug.cgi?id=1222285
14 5y ago
This reminds me of a time I was having a yelling match with a guy on reddit and he started calling me names. I google searched his username and he had used it across multiple sites, several being porn sites, and he also posted his reddit user name on his Facebook and a Facebook search I found his real name and pictures of him. When I called him by his real name and linked a picture of him he immediately changed his tune. In the end he and I both laughed and thought it was funny and he was more curious how I found all those thing. I told him he used the same username across multiple sites including Facebook. He said he was a lot younger and didn’t think of those things when he originally did it. I removed any post where I used his name and tried not to dox him for others to see.
psacawa 5y ago
> Don't buy domain names Can anyone explain this? Assuming your data isn't in the WHOIS record, why does this increase your exposure more than any other company knowing your name? A search shows up options for anonymous domain name services.
- octoberfranklin 5y ago
  If you don't provide a real name when registering a domain, you lose the domain as soon as the registrar gets served with papers. This is an ICANN policy, you can't escape it. All the registrars sell access to the real names behind their "privacy protection" service. They do not bother checking if the requester has a warrant or is even affiliated with law enforcement. They simply charge a fee (around $50 per request) to prevent bulk extraction, and possibly review the top 50-100 highest-volume requesters. njalla is really the only way around this, but you have to trust them with legal ownership of your domain.
numpad0 5y ago
Notably missing aspect is precise time of events. Personas like someone who posts content during 08:34:40 - 09:23:23 except 08:43:30-08:55:23, never seems to be active during 22:00 - 06:00, can be narrowed down to something like a person commuting via bus route A from stop B to C changing to a train route from C to D through passageway E in the station. From there you can look for a man looking down at a phone, or couple information with other factors, or throw in a bait like a giant stinking dead fish or a rare and loud car in front of him and watch for responses he'd make. IMSI catchers and Bluetooth scanners can be useful as well if your adversaries are resourceful. Time and location of transmissions and time of receptions can be correlated, in theory. This type of attacks can't be mitigated on fast-paced social media at all; both posts and requests has to be queued and obfuscated for time.
- mhitza 5y ago
  That's a bultin feature of messaging systems like I2P-bote (running on I2P darknet). It's been a while since experimenting with Bitmessage but I think they queue/batch messages as well. But for forum like software that's definitely true, can't easily have variable delayed posting. Another aspect that's important and often ignored, is writing style anonymization. You practically want an offline tool, that removes idiosyncrasies from the text you write and makes it sound as bland as possible. edit: A related story. Around 2010-2012 I was working for a company, and I was part of a somewhat managerial group. At one point we decided to pull in direct employee feedback in an anonymous free-text form. Due to their writing style being reflective on the way they spoke, it was possible to point exactly who wrote what message. Of course, few exceptions existed, I didn't personally know all the employees in the company.
Barrin92 5y ago
It's good advice. The problem with anonymity in an environment of ubiquitous surveillance is that it's paradoxical. The point of anonymity is achieving freedom, but staying anonymous expends energy and makes you a target, so you can't actually do any things that anonymity was supposed to get you. If what you really want is sovereignty, which is what most people confuse anonymity with, the goal is to be like what Ernst Jünger called the anarch (in contrast to the anarchist), which is someone who complies and renders herself indifferent to authority, rather than standing out and drawing attention. A much better practice is to be as open as possible about the boring stuff, so you're not constrained and can do what everyone else does. Trying to be absolutist about anonymity is automatically like wearing a straitjacket.
- roughly 5y ago
  > If what you really want is sovereignty, which is what most people confuse anonymity with, the goal is to be like what Ernst Jünger called the anarch (in contrast to the anarchist), which is someone who complies and renders herself indifferent to authority, rather than standing out and drawing attention. This works right up until the thing you want to do - or the person you find yourself to be - is something authority is not indifferent to.
- chaxor 5y ago
  > expending energy One thing I noticed out of many of the list items given in the post here: > Only use Tor > Always use a VPN > Never use Google -- only DuckDuckGo > Disable JavaScript on your browser > Watch all incoming and outgoing network calls regularly and scan for abnormalities > Encrypt your laptop and any external drives > End-to-end encrypted communication only > Don't use Gmail -- use ProtonMail > Never pay with cards. Use cryptocurrencies. > Turn off all location services from your laptop and phone Is that these can actually be solved with technology in a way that these are thedefault and popular behavior (as TLS 1.3 is in HTTPS). So it's important that we realize that these technologies (or something like them) are important anddesired by everyone, but just need a bit of development to work. Https and signal are great examples. Many of my parents and grandparents are on signal now, because it's better than most other apps (whatscrap, Facebook msg, imsg, etc). Is the Loki network and Session better? Sure. Of course. But grandparents aren't using it yet because not everyone they know is on it yet like signal, just the tech knowledgeable, or many of their grandchildren. But ultimately, None of this should require any effort whatsoever. The rest of the points about concealing your name or not is more obviously a choice by the user, as they have to provide it knowingly - so it's less of an issue because they're more likely aware of their choice. > Don't buy domain names I'm not sure I understand this one - anyone have an explanation?
chillycurve 5y ago
I have been afraid of sharing my ideas, post history, etc. in a way that could be easily traced back to my identity for years. I made sure my accounts and usernames bore no personally identifiable tid-bits. I use a VPN religiously (that won't change). I've since decided that I am done with all that. I was afraid my employer might question my Reddit posting history (they wouldn't.) I was worried someone who Googled me would think my past self was dumb (who cares). Now my ideas are almost all public and growing more so by the day. I am working up the energy to start a personal blog, if anything just to document my ideas over time. I am adding my real name and email to my Github, HN, (not Reddit, yet, though it would not be hard to connect), IH, etc. I want someone to be able to Google me and find my best work. On the other hand, there are clearly cases and types of info/accounts that should remain private. I self-host as much as possible. I encrypt personal files before uploading. I have multiple Protonmail accounts. I use custom DNS, etc. Ideas should be public. Information is a case by case basis, but I generally care a lot less than I used to.
- chaxor 5y ago
  What do you use as a custom DNS?
  - chillycurve 5y ago
    I use NextDNS and love it. It provides fine control over what is allowed, what's logged, etc. If I was ultra-privacy focused, I'd probably go with the DNS provided by my VPN or a self-hosted resolver like unbound+pihole.
- kayodelycaon 5y ago
  Unfortunately, not everyone has this luxury. I know many people who are LGBT and still hiding from family. I’m bipolar, which I really do not want anyone hiring me to know. I don’t want people at work (or my family!) knowing and reading what I write. As a friend put it: once your coworkers find your Reddit account, it’s over.
  - chillycurve 5y ago
alliao 5y ago
Photos easily pinpoint you too, any pictures you upload + user name is pretty much game over
DantesKite 5y ago
There's a middle ground somewhere here, in between "Don't be a criminal" and "Don't be stupid." I don't think the lesson we should take from AlphaBay is "Take better privacy safeguards" but "Don't set up an illegal dark web operation."
- drsnow 5y ago
  'Don't be a criminal' is trite. Something being criminal doesn't mean it's wrong to do. If you're saying not to do something specific then specify.
  - DantesKite 5y ago
    > “Don't set up an illegal dark web operation."
- nivenkos 5y ago
  Look at Canada though - what is considered "criminal" can change overnight and then suddenly the government is freezing protesters' bank accounts.
sampo 5y ago
Maybe Eric S. Raymond's advice from 21 years ago is no longer true in today's internet: > Concealing your identity behind a handle is a juvenile and silly behavior characteristic of crackers, warez d00dz, and other lower life forms. Hackers don't do this; they're proud of what they do and want it associated with their real names. So if you have a handle, drop it. In the hacker culture it will only mark you as a loser. http://www.catb.org/~esr/faqs/hacker-howto.html#style http://www.catb.org/~esr/faqs/hacker-howto.html#style
- YaBomm 5y ago
- hkon 5y ago
  Easily. It was advice for another time.
- ad404b8a372f2b9 5y ago
  In the late 90s I remember being advised to always use an anonymous handle by my older privacy and security conscious friends. I don't think that Raymond's advice was widely accepted.
- tejohnso 5y ago
  In a tribe of people who tend to do illegal things, or are perceived that way, especially by those employed by three letter acronym agencies, I don't want to be among the few who are using their real name.
- _carbyau_ 5y ago
  At the time, hacking also wasn't synonymous with "computer crime". So it was possible to be proud of stuff you did.
- sedatk 5y ago
- atmosx 5y ago
  The ESR idea of "a hacker" has nothing to do with someone running illegal markets on darknet. ESR was thinking about ppl like Daniel: https://twitter.com/bagder https://twitter.com/bagder
lrvick 5y ago
Some of the anonymous advice here is pretty poor and recommends centralized services that require some level of identification. If you actually need to be anonymous the daunting but doable tactics on https://anonymousplanet.org/ https://anonymousplanet.org/ are a much better bet.
jokethrowaway 5y ago
The best thing if you want to do something nefarious is to join a state actor. Anything else and either your crimes are small enough or you won't have protection.
aloer 5y ago
There’s been a push in recent years to teach the non-tech public that reusing passwords is bad, in part because if there is a leak in one service it’s easy to try the same somewhere else. Easy enough to relate to. I wish the messaging would include email addresses as well. It’s easy for everyone to use different passwords nowadays with deep integrations everywhere. But generated email addresses still require a lot of extra steps for most users. To change this has to first become a mainstream concern. Today there is iCloud email forwarding. But it’s still new and not as convenient to use outside of iOS. Also I have no idea about the longevity of that service. Wouldn’t trust it as recovery mail for important accounts
deleted 5y ago
[deleted]
awslattery 5y ago
> Make a developer account on Twilio and buy a number from them. Use this whenever a phone number is required online Non-carrier numbers won't work for many services, and unless I'm mistaken, you are required to provide an address, recurring payment method, and a phone number for 2FA to sign up.
emptyparadise 5y ago
What you do online doesn't have to spill over to real life. Anonymity isn't just about committing crime, it's about not getting stalked over petty arguments online, be it by insane people, potential employers, or other scary things. It's liberating to be able to silo your social interactions. We used to have this.
deleted 5y ago
[deleted]
imnotlost 5y ago
Or you can just be a known drug lord, launder billions of USD through a respected international bank, no one goes to jail, small fine, and they're probably still laundering 10 years later and no one cares. No one is anonymous. They're probably all using SMS and corporate email. Sell a little bit of drugs through the silk road and you'll get royally f-ed! Sell all the opioids in the world through a public pharma corp and you can keep enjoying your jet-set life and yacht. The allegedly smartest people in the world are focusing on the dumbest problems while being reamed by the frat-boys that went to Wall Street and Politics, guns and drugs. LULZ.
- hbbio 5y ago
  Your comment echoes today's Credit Suisse news: https://www.theguardian.com/news/2022/feb/20/credit-suisse-secrets-leak-unmasks-criminals-fraudsters-corrupt-politicians https://www.theguardian.com/news/2022/feb/20/credit-suisse-s... “The pretext of protecting financial privacy is merely a fig leaf covering the shameful role of Swiss banks as collaborators of tax evaders.” And it's more than tax evasion, "include a human trafficker in the Philippines, a Hong Kong stock exchange boss jailed for bribery, a billionaire who ordered the murder of his Lebanese pop star girlfriend and executives who looted Venezuela’s state oil company, as well as corrupt politicians from Egypt to Ukraine".
- Thorrez 5y ago
  >Or you can just be a known drug lord, launder billions of USD through a respected international bank, no one goes to jail, small fine, Are you referring to some specific drug lord? Who?
  - NaturalPhallacy 5y ago
    Pfizer?
    - Thorrez 5y ago
      That's not the normal definition of "drug lord". Also, was Pfizer involved in money laundering?
scaramanga 5y ago
I wonder if the author lives in a democracy or in a state which has rule of law. Because it strikes me that the solution space also includes many political, legislative, and judicial options such as, perhaps most obviously, the regulation of tech, or the effective policing of online abuse.
jrd259 5y ago
I miss the point of this discussion. Does the HN readership really include a substantial number of drug lords, cyber criminals, spies, informants or live under a regime where they fear for their lives from state actors? I'm not cheating on my taxes or my spouse. Are there really many people being paid in cybercash from a genuine need to avoid state or corporate interest?
- drsnow 5y ago
  all of those are genuine needs
  - CRConrad 5y ago
    "Genuine", sure, but justifiable? Most reasonable people would want drug lords and cyber criminals to get caught.
ssklash 5y ago
I think the point about most people not choosing anonymity at all is a bit misleading. It assumes that these people are making a reason, informed choice, and going ahead and living the way they do. I don't think that's the case. Most "normal" people, and even many tech people, don't know what companies like Google and Facebook are capable of. If you showed someone exactly what information of theirs was collected, for how long, the predictions they could make with it,and god knows what else is being done with it, I think many people would change their behavior. But they don't know, and this is not an accident. Most people do not even know what the business model of Facebook and Google are. If you ask, they'd probably say something like "oh they're an email company" or "they help me share photos of my grand kids" or god-forbid, they're "helping connect people connect". Both are surveillance-based, personal information-driven ad companies. That's it. No amount of Google X or Android or Gmail or Libra or FB Live or any other program will change what their business is. And they will never, ever admit to this.
spdebbarma 5y ago
I am a little sad that there's no conclusion after the introduction of the spectrum, which most people are already aware of.
Janiya 5y ago
sedatk 5y ago
That article is full of terrible advice. Example: > Don't use Gmail -- use ProtonMail "ProtonMail logged IP address of French activist after order by Swiss authorities" https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
- Havoc 5y ago
  They don't log by default, but were legally compelled to do so in this instance. Which is about as good as it gets. Unless you know of a reputable email provider that ignores court orders? (bit of an oxymoron)
  - sedatk 5y ago
    I agree that ProtonMail and GMail are not the same in terms of privacy protections. But, the article implies that the bulk of advice provided in the article is somehow a guarantee to anonymity. A reader may easily assume that ProtonMail doesn't log any IP addresses at all based on that misconception. ProtonMail even used to claim exactly that in their sales page until that incident I linked to. In fact, the article is the anti-thesis of itself. Blanket anonymity advice is the worst anonymity advice.
- samfather 5y ago
  It also recommends using DuckDuckGo ... the "private" search engine hosted on US Microsoft servers.
drewcoo 5y ago
<tinfoil>In the world of global governmental (often extra-legal) surveillance, aren't attempts to be anonymous likely to make you a person of interest?</tinfoil>
fallmonkey 5y ago
On personal anecdotes, I've used the same internet identity across all platforms and it's not hard to locate my real life identity from there...since like 20 years ago when I got on the internet. So all the good reputation and bad reputation followed me through, and surprised me in best and worst way. There're times when I wished I had concealed myself saying certain things (or just haven't said it), and times when I felt the joy of recognition when people connected dots about me and became closer friend. Now as I'm getting old, it's just a habit, no longer about risks or rewards. Yet, both younger me and older me will probably be very indecisive about doing this if they've never done it and are told about all the fortune/misfortune this has brought to me, including meeting my wife and thinking about suicides.
- CRConrad 5y ago
  > On personal anecdotes, I've used the same internet identity across all platforms and it's not hard to locate my real life identity from there...since like 20 years ago when I got on the internet. Me too. > So all the good reputation and bad reputation followed me through, and surprised me in best and worst way. Not so much for me, AFAIK. I think quite simply, pretty much nobody could be bothered to look for it.
slimeboty 5y ago
"Don't buy domain names" OK but why? The dodgy guy who ran that website had to own the domain name somehow?
- patricklorio 5y ago
  It was a tor hidden service. Do domain purchase required.
dredmorbius 5y ago
43 bits. It requires 43 bits of defining information to identify a single entity online. Those bits might be your name and date of birth. Or they could be your home and work postal code (effective for better than 90% of the population, at least when commuting to work was a thing). It could be your activity patterns, and what that says about your sleep/wake cycle, and possibly travel patterns. EFF's Panopticlicck found enough distinctive information within Web browser characteristics to uniquely identify the vast majority of people submitting data to the project. If you want to duck most casual observation ... then yes, standard precautions can be effective, though it's quite likely you'll slip and leak information at some point. Those clues can wait years, or decades, to be unraveled. Against law enforcement or state-level actors, you'll probably need to try considerably harder, though it's helpful to realise that what such entities have is typically far more data and the motivation to look through it for patterns and correlations, rather than superhuman cracking skills. An area that's been of interest to me for some time has been the question of just how many investigations might be possible under various security or investigative services. My suspicion is that capabilities are constrained --- that is, there are fewer investigations than one might think --- but that the resources which can be brought to bear are considerable. As an example, the US Federal Bureau of Investigation had a 2019 budget of $9.6 billion, with 13,412 special agents and 20,420 support professionals, as of 2009. By news stories, the January 6, 2021 investigation has been the largest in the Bureau's history, with 350--400 arrests and 1,300--1,500 grand jury subpoenas. I haven't seen data on how many investigations the FBI conducts annually, or how many cases are submitted for prosecution, but suspect it's on the order of thousands. The Bureau no longer seems to produce blunt gun-in-your-face reports typical of the Hoover era as with the 1969 annual report showing a chart of convictions by fiscal year (over 13,150 for 1969, here: https://archive.org/details/FBIAnnualReport1969/page/n5/mode/2up?view=theater https://archive.org/details/FBIAnnualReport1969/page/n5/mode...), though I suspect levels are at least roughly similar. That was an average of three arrests per agent, and the 1969 report states 2.8 million name searches were conducted that year, along with 2.6 million pieces of mail and 241,000 telephone and telegraph communications.
makach 5y ago
I believe that truly anonymous can only be achieved in bursts, and not continuously maintained. For day to day existence, blending in with the common population is hiding in plain sight.
saos 5y ago
Really good. I’m always cautious of how I say things on Reddit as to not give too much away. I’m sure Reddit data scientists can build all sorts of models based in comments from users
imdsm 5y ago
As much as dark mode is becoming a thing, I can't read light on dark text without it messing with my eyes. It has to be the worst way to render text.
- z_zetetic_z 5y ago
  Thank goodness for firefox reader mode. I don't like seeing white lines as an after image on my retinas.
Cthulhu_ 5y ago
One of my forum's members had (has?) a stalker. We had a new user once who implied he was familiar with our community, but never specified. He was fairly active for about a year or so, but at some point he started to post rants about his family or something that was eerily familiar to the stalker's rants. I looked up his e-mail address in his profile (I'm the admin). I punched it into google, which led to what looked like a public chat log. The e-mail address he used to register his account there was listed right next to his old username, which we recognized as the stalker's. We banned his account and the stalked member had to contact their solicitor, again. anyway tl;dr never post your e-mail address or a variant thereof publicly, especially if you're trying to be anonymous.
SergeAx 5y ago
> Sure, a "bad guy" could use that info and blackmail her This is the place where I lost OP. How can anybody be blackmailed with publicly available info? On the topic: I believe that the serious level of anonymity makes life extremely inconvenient and uncomfortable. Always using VPNs, keeping small hosts in different places as exit points, checking and rechecking everything when connecting to WiFi or roaming. Keeping separate hardware, for that matter. I don't see how all this parafernalia justified. Identity stealing? Just use 2FA for your key service accounts. Don't reuse passwords, use a password manager - those are today's basics every schoolchild knows. Use debit card instead of credit and never keep it's balance above $100. Turn on 3D-security on all your cards. Don't get involved into drug dealing. Things like this.
- CRConrad 5y ago
  > How can anybody be blackmailed with publicly available info? By pointing out to people who haven't gone looking for that info, or who might have come across it but not connected it to you, that it is indeed about or by you.
jpalomaki 5y ago
If you are participating in discussion forums under pseudonym, you quite easily give quite many bits of personal information over time even if you try to be careful about it. You give hints about your age, where you have lived, maybe about hobbies, education, work history, time when you are online. Each individual bit is not much, but when you combine few of these, they actually identify you exactly.
wallacoloo 5y ago
live offline. as long as you’re not completely socially incompetent you can be largely yourself in most situations, find people you jive with, and then be completely yourself with them. unless your threat level is “my phone’s recording everything in the room 24/7 and sending that to authorities”, you’re free to do all the illegal drugs you want with your friends, use the N-word, do all the other things which you thing you should be able to freely do but for some reason aren’t able to do comfortably in public. if you must do things online that are best kept detached from your IRL/govt identity, setup a box running something like Tails that doesn’t accept any non-Tor traffic, and interact with it through a text-only interface (i.e. a shell, or links-like keyboard-driven web browser). people sometimes discourage using obscure setups because they allow better fingerprinting but that’s not always as bad as it’s made out to be. primarily you want to break the link between your pseudonymous identity and your IRL identity. it doesn’t matter how fingerprintable your pseudonym is so long as the overlap between it and your IRL identity is small. and that’s the reason to prefer simpler interfaces like text-only: they prevent leaking things like cursor movements which might otherwise build a tie between those identities.
Janiya 5y ago

650 points by kashnote 5y ago

The title is misleading, clickbait. The article is in fact about why it probably isn't necessary to be anonymous and even then says nothing particularly important.

djur 5y ago
A title not precisely describing the premise and conclusion of the article is neither misleading nor clickbait. The article is about online anonymity. It could be "On being anonymous" or "To be anonymous"; "Be anonymous" is fine, too.

Janiya 5y ago

blakesterz 5y ago

"Ultimately, anonymity comes down to one thing: Control. You should educate yourself on data privacy and make sure that you know what data you're sharing and what is possibly out there." That's some REALLY good Solid advice.

touisteur 5y ago
And be OK that sometimes some people don't want to interact with anonymous randos... Credentials are not everything, but they are a filter on medias with large amounts of time-wasters...
anderspitman 5y ago
I see what you did there https://solidproject.org/ https://solidproject.org/

nickstinemates 5y ago

The conclusion is a weird one, given the premise. The crux of the argument is basically true. Its an all or nothing proposition. Or you can lead a double life. One for your public persona, where you don't care at all about security, and your real persona, where you do. This has been my approach on the internet since basically it started and handles were a common thing.

caslon 5y ago
With that in mind, you just might have posted this comment on the wrong account.
ReactiveJelly 5y ago
> The crux of the argument is basically true. Its an all or nothing proposition. No, it's not. Every online account (that doesn't involve money or legal paperwork) can have its own name. Then you can decide whether to have _some_ accounts ultimately link back to your legal name, or all accounts, or none. > Or you can lead a double life. ... This has been my approach on the internet since basically it started and handles were a common thing. That's exactly what I'm doing, and neither of us are living in the Brazilian rainforest, so anonymity really is a spectrum.
- numpad0 5y ago
  > Then you can decide whether to have _some_ accounts ultimately link back to your legal name, No, you don't. Someone else could, if there is one with high enough affection to you. I think you'll have to think of bulk ingestion and on-prem processing to be sure your activities won't trace back to you.
aqme28 5y ago
I don’t think it’s all or nothing. Look at anonymous public personas like Banksy or Dril. People have tracked them down, and you can look up who they are if you try. But for the most part these people are anonymous, and get to enjoy some of the benefits of that.
- 5y ago

ReactiveJelly 5y ago

Agreed. Anonymity is a spectrum. Just like personal finance, most people haven't even begun to assess what state they're in. You should not accept the state you're in without knowing what state that is. Most people should have more anonymity than they're giving themselves. "Defend your rights. Nobody else will do it for you." -- ReactiveJelly

indigodaddy 5y ago

Feels like the article is slanting this Alex guy as a hero of sorts? I don’t like the tone of the article and wish I hadn’t clicked on it now..

jokethrowaway 5y ago
Who's more harmful, someone who facilitate the selling of illegal items or those who define what is legal? In a lawless society what this guy was doing would have been a respectable trade like any other.
- indigodaddy 5y ago
  You can twist your way into thinking any very bad thing or practice isn’t so. We can extend your line of thinking to murder and rape— does that sound acceptable too? No, this guy was much worse and more harmful than the norms of our society and those that propagate those norms.
  - anonymoushn 5y ago
    It is difficult to articulate how much worse Henry Kissinger and Phil Bokovoy are for the world than Alexandre Cazes and Ross Ulbricht.
    - CRConrad 5y ago
      > Henry Kissinger Holy shit, that fucker is still alive!

srmarm 5y ago

Privacy is on a spectrum, but is also compounded by time and once the cats out the bag it can be impossible to turn back. In the example given of Alex Cazes he could change the from email but the damage was already done - there's no way to recall the emails already sent that led a trail back to him.

upofadown 5y ago
The article states that anonymity is on a spectrum. Privacy is a different issue. You can lead an entirely private but non-anonymous life.

ur-whale 5y ago

I would strongly advise anyone who really wants to be anonymous on the internet such as a freedom activist in a totalitarian country, not to follow the advice listed at the end of the article. Or rather: these are very basic and very naive recommendations, certainly good first steps, but absolutely nowhere near enough to guarantee strong anonymity on the internet. Remaining truly anonymous on the net is extremely hard, especially in these days where ML can be used to statistically narrow down and pinpoint who wrote a specific piece of text only based on things like use of punctuation, vocabulary, sentence structure and style.

Swenrekcah 5y ago
Would the solution be a digital version of the old newspaper cutout ransom letter? Generate via GPT-3 a text giving roughly the impression you want to make and then copy/paste sentences from online news media if you need the names of particular persons or events. Would be rather crude though, but less tedious than literally cutting and pasting letters was.
- kgeist 5y ago
  I had a similar idea in a sibling post. But this only works if you basically have a secret alter ego which has nothing to do with your work/public persona, because otherwise they can match your favorite topics in those GPT-3 generated texts to your interests in real life, by factoring in also other little facts, like when you usually appear online, etc. It's probably enough to protect the average Joe but imho not enough to protect a targeted freedom activist, unless their activism is their alter ago and publicly they aren't known to be activists. Otherwise their every step is monitored in a typical dictatorship and it's not that hard for them to connect the dots who was the author of a certain message.
kgeist 5y ago
>especially in these days where ML can be used to statistically narrow down and pinpoint who wrote a specific piece of text only based on things like use of punctuation, vocabulary, sentence structure and style. I think you can fight ML with ML - for example, use GPT-like algorithms generate text for you. But then you must also be careful about when you post - I remember some of the Russian trolls were exposed because their bursts of activity coincided with 9am-6pm Moscow time. So you have to use a random number generator decide when to appear online if you want to hide your location. There's always something which can narrow down their search. One small mistake and you are busted. They don't even need to pinpoint you exactly, if it's narrowed down to 1000-10000 people who meet the criteria, they already win because they have the capacity to go through the list one by one and eventually find you.

oh_sigh 5y ago

Alex Cazes had bad op-sec. His #2, DeSnake, didn't, and is still alive and well and has restarted his marketplace and gives anonymous interviews to media outlets: https://www.wired.com/story/alphabay-desnake-dark-web-interview/ https://www.wired.com/story/alphabay-desnake-dark-web-interv...

vmception 5y ago

Exhibit A: Was Mary only from Syracuse, or was Kash, kg.dev, using dating apps in Syracuse well, I got tired of caring already, but maybe others havent.

formerly_proven 5y ago

Be anonymous Become ungovernable

m348e912 5y ago

I don’t know if dating app users understand that it doesn’t take much information to find out who they really are. Sometimes all that’s needed is a first name, profession, or university is enough if one of the three is somewhat unique for the area. If you’re concerned about privacy on dating apps, you’re better off being really vague about basic aspects of your life, or trying a bar instead :)

Ansil849 5y ago

> Don't use macOS or Windows -- only Linux > Move to Brazil and live in the rainforest Juvenile, snarky, irreverent and irrelevant advice I'd expect to read on a 12 year old's Reddit post.

i_am_proteus 5y ago
That might be why the next thing in the article is: >I don't know about you, but I don't want to do all of that.
retrac 5y ago
> I don't know about you, but I don't want to do all of that. [...] I don't recommend being on either extreme of this spectrum. It's a list of extreme techniques for protecting ones' identity online. Of course, completely sanitizing your online presence is difficult, and probably unnecessary. I thought the two lists were a nice rhetorical framing - present a dilemma (total openness vs. total anonymity) and then wiggle out of it to a compromise.
- Ansil849 5y ago
  > It's a list of extreme techniques for protecting ones' identity online. The items I quoted do nothing to protect ones' identity online. Snark is only effective if relevant.
  - AitchEmArsey 5y ago
    The closed nature of MacOS and Windows means that you have no guarantees (and no audit mechanism) to determine how much the machine is passing your data back to HQ. As the post very clearly states, most people don't need to care - but someone with extreme paranoia has only one obvious choice here. Your aggressive negativity is far less interesting than this blog, and serves no purpose whatsoever.
  - RustyConsul 5y ago
    holy cow! I literally laughed out loud when i read the rainforest remark. Chill out dude, you're reading something called 'Thoughts' by some random dude on the internet lol

mindvirus 5y ago

The article touches on a good point: one mistake and you're out. It doesn't even have to be your mistake - you didn't choose to put your SSN out there after all, yet here we are. This gave me a radical company idea, on the other end of the spectrum: spam as a service. Something that'll take your name, email, and other things and put it all over the internet in questionable and plausibly denial ways. That way, even when someone is trying to find things out about you, it'll be hard to find, and easy to deny. (I'm kidding of course).

propesh 5y ago
Kidding aside, this is exactly how it will go down. Politician in a scrape of financial corruption or etc.? Deepfake s*x video or other viral blatant misinformation & obfuscation; what's the risk? Upside, no one knows what to believe. Exactly what various "countries" are doing. It will be extreme; to the point where, don't believe half of what you actually see.
- bee_rider 5y ago
  It should be noted that this is a pretty bad end state. Reporting is already an extremely weak force for preventing corruption on the part of the powerful. Journalists entering a state of total uselessness is only going to make the problem bigger. In a realm of total bullshit the winners are the one who are best at lying. "I don't know what to believe and everyone involved is probably corrupt" is usually just an excuse to disengage and follow base instincts.
  - jimkleiber 5y ago
    > It should be noted that this is a pretty bad end state I agree. The parent poster didn't ask what's the downside, and I think it's this: when no one knows what to believe and starts to distrust most things, society may start to fall apart, as society relies on us trusting each other. So while I think disinformation is one of the best privacy strategies (not so different from differential privacy efforts by Google and others, suggested by the OP but without the term name), I think the more we lie to hide, the more we spin others and ourselves in circles. I really like Sam Lessin's essay on this at The Information, where he talks about how, with the nature of the internet being so easy to share info, we have to start spreading disinfo to even close colleagues, so far as even lying to ourselves. I think this paradox is one of the most challenging paradoxes of our time: the internet makes it so easy for us to open up and share and yet it makes it so hard for us to not open up and share. [0]: https://www.theinformation.com/articles/the-future-of-privacy-disinformation https://www.theinformation.com/articles/the-future-of-privac...

alfiedotwtf 5y ago

Good article! As an experiment, a few years ago I put my mobile phone number on my blog, and to date I've only received 2 anonmous messages on Signal but no calls besides recruiters. The old adage "No one is thinking about you as much as they are thinking about themselves" is true. While it's good to practice good security hygiene, be mindful of also being practical.

CRConrad 5y ago
> The old adage "No one is thinking about you as much as they are thinking about themselves" is true. Or "No one is thinking about you as much as you are".

underwater 5y ago

I mix @realname and @pseudonym accounts. I'm generally pretty careful about what I post under my real name and less so under an alias. However, over time I drop enough clues that people could figure my real identity with a little work. That leaves me with the worst of both worlds. It seems safest to assume that your identity is always tied to everything you do online.

can16358p 5y ago
I think with ML getting smarter and people posting (either with their identity or anonymously) more and more content, it will be trivial to crossmatch anonymously posted content to real identities by ML examining "styles" of text: from punctuation to sentence structure to vocabulary use, and it will have an accurate estimation of who that "anonymous" person is.
- kibwen 5y ago
  This would be pretty easy to counter by having a tool that would analyze any comment you post and strip all the identifying marks out of it; no punctuation other than periods, no complex or compound sentences, all words replaced by equivalents from the list of the most common thousand English words, all voices and tenses normalized, no paragraphs, no capitalization, etc.
  - bufordtwain 5y ago
    At which point, nobody would want to read it.
  - marvin 5y ago
    That's a bit of a nightmare for communication, though. Subtlety is a thing, both for nuance and clarity.
    - can16358p 5y ago
      There is another side of the coin though. If the "countering" software is smart enough to analyze the semantics and the meaning of the sentence (which I think will definitely have the ability to), it can easily convert it to an intermediate representation and create an actually gramatically correcy, good looking, easy to understand sentences. It can even improve the original text, making it more clear and anonymous-style.

chayesfss 5y ago

Share accounts with others, widely. No reason not to unless you’re trying to build up some type of e-cred with your other account.

ChrisMarshallNY 5y ago

I'm sort of the opposite. I make sure that I can be found and attributed. I deleted my last anonymous account, a couple of years ago. In the Days of Yore, I was pretty much "Dick From the Internet." A real neckbeard troll. There's a lot of reasons that I do it. The biggest, is that I want to be in control of my narrative. I learned from a couple of folks that are really good at curating their SEO results. Also, these days (for a change), I'm pretty well-behaved. Doing it this way, helps to keep it that way.

mqnfred 5y ago
You’ve said it better than I could have. Many people on HN probably know your handle/identity, if only by virtue of you referring to it in your comments somewhat systematically. You manage your identity with an SEO mindset indeed. I do not mean to offend, but it does read just as fake as any SEO search results.
- deleted 5y ago
  [deleted]

jefftk 5y ago

The article presents a spectrum, dismisses both extremes, and advocates that people aim for the middle. The problem is, you may think you are hanging out in the middle, but you probably have much less privacy than you think you do. Even if you are making the right choices for today, you can't trust that the future will keep things private (advances in ML, ubiquitous surveillance) and you don't know that futures isn't here yet. Personally, I hang out at the fully open end of that spectrum. This has worked out pretty well for me; I don't think I've run into any downsides.

Tepix 5y ago
I think we have to ask ourselves: What do we want to achieve by protecting our online identity? For me, escaping the pervasive tracking and profiling by FAANG is one goal. I'm sure that tracking me across the internet is a lot more difficult (not impossible) than tracking the average user. Hopefully it can't be done in an automated fashion. That way tracking me is hopefully just not worth doing just for a few advertising dollars.

ronnier 5y ago

I don't care about being anon, but I don't want all my info sitting in databases, so I've made done the following and trying to evolve over time and fix gaps that I currently have. This is things I've done... * Use Brave browser with ublock origins and privacy badger * Use pihole + unbound to resolve my own DNS and do not use google * Run wireguard on my home network that I connect to when I'm out and need to use wifi * Be anti-google as much as possible. I'm still in the process of this, i'll switch my domain based email off of google soon * Be anti-facebook and delete all accounts (whatsapp and insta included) * Be anti-reddit * Be anti-cloud and host everything internally as much as possible (except for encrypted backups, say for video cam footage) * All of my home automation is local and blocked from the internet. If I want access, I'll connect to my VPN. * Use signal with disappearing chats to communicate with my friends. Still a lot to do, but it's a start...

hammock 5y ago
I believe Brave browser has fallen out of favor but I'm not an expert on why
- ronnier 5y ago
  Interesting. Please let me know if you have a better alternative. Ideally I'd like to just run chromium but then I have to build it myself or use some build by some untrusted person so I've decided I'll trust Brave for now...
  - xvector 5y ago
    Aside from Tor Browser, Firefox with arkenfox/user.js is ideal for privacy [1]. Chromium-based browsers like Brave are ideal for security [2]. An ideal solution for privacy and security would be running Firefox+user.js in Qubes OS [3], or for even more anonymity, Tor Browser in Qubes-Whonix [4]. However, even this isn't bulletproof, and a 3 letter agency can still determine who you are with techniques like keystroke deanonymization [5] or other techniques [6] like traffic analysis. Tor is also not reliable for anonymity because the project is kind of a shitshow [7], so there's really nothing you can do to truly hide. [1]: https://github.com/arkenfox/user.js https://github.com/arkenfox/user.js [2]: https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... [3]: https://www.qubes-os.org/ https://www.qubes-os.org/ [4]: https://www.whonix.org/wiki/Qubes https://www.whonix.org/wiki/Qubes [5]: https://www.whonix.org/wiki/Keystroke_Deanonymization https://www.whonix.org/wiki/Keystroke_Deanonymization [6]: https://www.whonix.org/wiki/Warning https://www.whonix.org/wiki/Warning [7]: https://www.hackerfactor.com/blog/index.php?/archives/906-Tor-0day-The-Management-Vulnerability.html https://www.hackerfactor.com/blog/index.php?/archives/906-To...

cellis 5y ago

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could easily flag you to your government. If you use wifi at a common point you're likely to be flagged and there isn't an easy way other than keeping on the move. But moving often is another anomalous event, and it's very difficult to do even for Drug Lords ( El Chapo ) or Terrorists that it behooves to do. This puts you in a sort of Zugzwang, to borrow a chess term. - there's always leakage, for instance, in the way you talk with people in the real world. At some point you send enough communication for sophisticated frequency analysis. - and there are other patterns of usage that could be used to identify you, like searches or even keyboard frequency on anonymized accounts can be de-anonymized by very specific markers ( ML works! ). - off ramps for crypto aren't very good. If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed. Mixers and tumblers will eventually leak and you'll be caught. - you're very vulnerable to social engineering by people you do business with. one slip where you stop communicating in a transactional mode of communication and that's a weak link in your armor. In the end, the FBI only has to be right once, and you have to be right every time.

xvector 5y ago
> keyboard frequency on anonymized accounts can be de-anonymized Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix. > Mixers and tumblers will eventually leak Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. But, you are right that it is futile to maintain defense against a determined 3 letter agency. [1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak
- beardog 5y ago
  I made this Firefox extension to defend against keyboard deanonymization on desktops https://git.voidnet.tech/kev/PrivateKeyboardAddon https://git.voidnet.tech/kev/PrivateKeyboardAddon I'm about to publish an update to it that uses a toolbar popup to fill out forms instead of the current lag approach, which will also protect against keyboard layout leaks[1] (which Tor browser/privacy.resistFingerprinting protects against anyway) https://bugzilla.mozilla.org/show_bug.cgi?id=1222285 https://bugzilla.mozilla.org/show_bug.cgi?id=1222285

14 5y ago

This reminds me of a time I was having a yelling match with a guy on reddit and he started calling me names. I google searched his username and he had used it across multiple sites, several being porn sites, and he also posted his reddit user name on his Facebook and a Facebook search I found his real name and pictures of him. When I called him by his real name and linked a picture of him he immediately changed his tune. In the end he and I both laughed and thought it was funny and he was more curious how I found all those thing. I told him he used the same username across multiple sites including Facebook. He said he was a lot younger and didn’t think of those things when he originally did it. I removed any post where I used his name and tried not to dox him for others to see.

psacawa 5y ago

> Don't buy domain names Can anyone explain this? Assuming your data isn't in the WHOIS record, why does this increase your exposure more than any other company knowing your name? A search shows up options for anonymous domain name services.

octoberfranklin 5y ago
If you don't provide a real name when registering a domain, you lose the domain as soon as the registrar gets served with papers. This is an ICANN policy, you can't escape it. All the registrars sell access to the real names behind their "privacy protection" service. They do not bother checking if the requester has a warrant or is even affiliated with law enforcement. They simply charge a fee (around $50 per request) to prevent bulk extraction, and possibly review the top 50-100 highest-volume requesters. njalla is really the only way around this, but you have to trust them with legal ownership of your domain.

numpad0 5y ago

Notably missing aspect is precise time of events. Personas like someone who posts content during 08:34:40 - 09:23:23 except 08:43:30-08:55:23, never seems to be active during 22:00 - 06:00, can be narrowed down to something like a person commuting via bus route A from stop B to C changing to a train route from C to D through passageway E in the station. From there you can look for a man looking down at a phone, or couple information with other factors, or throw in a bait like a giant stinking dead fish or a rare and loud car in front of him and watch for responses he'd make. IMSI catchers and Bluetooth scanners can be useful as well if your adversaries are resourceful. Time and location of transmissions and time of receptions can be correlated, in theory. This type of attacks can't be mitigated on fast-paced social media at all; both posts and requests has to be queued and obfuscated for time.

mhitza 5y ago
That's a bultin feature of messaging systems like I2P-bote (running on I2P darknet). It's been a while since experimenting with Bitmessage but I think they queue/batch messages as well. But for forum like software that's definitely true, can't easily have variable delayed posting. Another aspect that's important and often ignored, is writing style anonymization. You practically want an offline tool, that removes idiosyncrasies from the text you write and makes it sound as bland as possible. edit: A related story. Around 2010-2012 I was working for a company, and I was part of a somewhat managerial group. At one point we decided to pull in direct employee feedback in an anonymous free-text form. Due to their writing style being reflective on the way they spoke, it was possible to point exactly who wrote what message. Of course, few exceptions existed, I didn't personally know all the employees in the company.

Barrin92 5y ago

It's good advice. The problem with anonymity in an environment of ubiquitous surveillance is that it's paradoxical. The point of anonymity is achieving freedom, but staying anonymous expends energy and makes you a target, so you can't actually do any things that anonymity was supposed to get you. If what you really want is sovereignty, which is what most people confuse anonymity with, the goal is to be like what Ernst Jünger called the anarch (in contrast to the anarchist), which is someone who complies and renders herself indifferent to authority, rather than standing out and drawing attention. A much better practice is to be as open as possible about the boring stuff, so you're not constrained and can do what everyone else does. Trying to be absolutist about anonymity is automatically like wearing a straitjacket.

roughly 5y ago
> If what you really want is sovereignty, which is what most people confuse anonymity with, the goal is to be like what Ernst Jünger called the anarch (in contrast to the anarchist), which is someone who complies and renders herself indifferent to authority, rather than standing out and drawing attention. This works right up until the thing you want to do - or the person you find yourself to be - is something authority is not indifferent to.
chaxor 5y ago
> expending energy One thing I noticed out of many of the list items given in the post here: > Only use Tor > Always use a VPN > Never use Google -- only DuckDuckGo > Disable JavaScript on your browser > Watch all incoming and outgoing network calls regularly and scan for abnormalities > Encrypt your laptop and any external drives > End-to-end encrypted communication only > Don't use Gmail -- use ProtonMail > Never pay with cards. Use cryptocurrencies. > Turn off all location services from your laptop and phone Is that these can actually be solved with technology in a way that these are thedefault and popular behavior (as TLS 1.3 is in HTTPS). So it's important that we realize that these technologies (or something like them) are important anddesired by everyone, but just need a bit of development to work. Https and signal are great examples. Many of my parents and grandparents are on signal now, because it's better than most other apps (whatscrap, Facebook msg, imsg, etc). Is the Loki network and Session better? Sure. Of course. But grandparents aren't using it yet because not everyone they know is on it yet like signal, just the tech knowledgeable, or many of their grandchildren. But ultimately, None of this should require any effort whatsoever. The rest of the points about concealing your name or not is more obviously a choice by the user, as they have to provide it knowingly - so it's less of an issue because they're more likely aware of their choice. > Don't buy domain names I'm not sure I understand this one - anyone have an explanation?

chillycurve 5y ago

I have been afraid of sharing my ideas, post history, etc. in a way that could be easily traced back to my identity for years. I made sure my accounts and usernames bore no personally identifiable tid-bits. I use a VPN religiously (that won't change). I've since decided that I am done with all that. I was afraid my employer might question my Reddit posting history (they wouldn't.) I was worried someone who Googled me would think my past self was dumb (who cares). Now my ideas are almost all public and growing more so by the day. I am working up the energy to start a personal blog, if anything just to document my ideas over time. I am adding my real name and email to my Github, HN, (not Reddit, yet, though it would not be hard to connect), IH, etc. I want someone to be able to Google me and find my best work. On the other hand, there are clearly cases and types of info/accounts that should remain private. I self-host as much as possible. I encrypt personal files before uploading. I have multiple Protonmail accounts. I use custom DNS, etc. Ideas should be public. Information is a case by case basis, but I generally care a lot less than I used to.

chaxor 5y ago
What do you use as a custom DNS?
- chillycurve 5y ago
  I use NextDNS and love it. It provides fine control over what is allowed, what's logged, etc. If I was ultra-privacy focused, I'd probably go with the DNS provided by my VPN or a self-hosted resolver like unbound+pihole.
kayodelycaon 5y ago
Unfortunately, not everyone has this luxury. I know many people who are LGBT and still hiding from family. I’m bipolar, which I really do not want anyone hiring me to know. I don’t want people at work (or my family!) knowing and reading what I write. As a friend put it: once your coworkers find your Reddit account, it’s over.
- chillycurve 5y ago

alliao 5y ago

Photos easily pinpoint you too, any pictures you upload + user name is pretty much game over

DantesKite 5y ago

There's a middle ground somewhere here, in between "Don't be a criminal" and "Don't be stupid." I don't think the lesson we should take from AlphaBay is "Take better privacy safeguards" but "Don't set up an illegal dark web operation."

drsnow 5y ago
'Don't be a criminal' is trite. Something being criminal doesn't mean it's wrong to do. If you're saying not to do something specific then specify.
- DantesKite 5y ago
  > “Don't set up an illegal dark web operation."
nivenkos 5y ago
Look at Canada though - what is considered "criminal" can change overnight and then suddenly the government is freezing protesters' bank accounts.

sampo 5y ago

Maybe Eric S. Raymond's advice from 21 years ago is no longer true in today's internet: > Concealing your identity behind a handle is a juvenile and silly behavior characteristic of crackers, warez d00dz, and other lower life forms. Hackers don't do this; they're proud of what they do and want it associated with their real names. So if you have a handle, drop it. In the hacker culture it will only mark you as a loser. http://www.catb.org/~esr/faqs/hacker-howto.html#style http://www.catb.org/~esr/faqs/hacker-howto.html#style

YaBomm 5y ago
hkon 5y ago
Easily. It was advice for another time.
ad404b8a372f2b9 5y ago
In the late 90s I remember being advised to always use an anonymous handle by my older privacy and security conscious friends. I don't think that Raymond's advice was widely accepted.
tejohnso 5y ago
In a tribe of people who tend to do illegal things, or are perceived that way, especially by those employed by three letter acronym agencies, I don't want to be among the few who are using their real name.
_carbyau_ 5y ago
At the time, hacking also wasn't synonymous with "computer crime". So it was possible to be proud of stuff you did.
sedatk 5y ago
atmosx 5y ago
The ESR idea of "a hacker" has nothing to do with someone running illegal markets on darknet. ESR was thinking about ppl like Daniel: https://twitter.com/bagder https://twitter.com/bagder

lrvick 5y ago

Some of the anonymous advice here is pretty poor and recommends centralized services that require some level of identification. If you actually need to be anonymous the daunting but doable tactics on https://anonymousplanet.org/ https://anonymousplanet.org/ are a much better bet.

jokethrowaway 5y ago

The best thing if you want to do something nefarious is to join a state actor. Anything else and either your crimes are small enough or you won't have protection.

aloer 5y ago

There’s been a push in recent years to teach the non-tech public that reusing passwords is bad, in part because if there is a leak in one service it’s easy to try the same somewhere else. Easy enough to relate to. I wish the messaging would include email addresses as well. It’s easy for everyone to use different passwords nowadays with deep integrations everywhere. But generated email addresses still require a lot of extra steps for most users. To change this has to first become a mainstream concern. Today there is iCloud email forwarding. But it’s still new and not as convenient to use outside of iOS. Also I have no idea about the longevity of that service. Wouldn’t trust it as recovery mail for important accounts

deleted 5y ago

[deleted]

awslattery 5y ago

> Make a developer account on Twilio and buy a number from them. Use this whenever a phone number is required online Non-carrier numbers won't work for many services, and unless I'm mistaken, you are required to provide an address, recurring payment method, and a phone number for 2FA to sign up.

emptyparadise 5y ago

What you do online doesn't have to spill over to real life. Anonymity isn't just about committing crime, it's about not getting stalked over petty arguments online, be it by insane people, potential employers, or other scary things. It's liberating to be able to silo your social interactions. We used to have this.

deleted 5y ago

[deleted]

imnotlost 5y ago

Or you can just be a known drug lord, launder billions of USD through a respected international bank, no one goes to jail, small fine, and they're probably still laundering 10 years later and no one cares. No one is anonymous. They're probably all using SMS and corporate email. Sell a little bit of drugs through the silk road and you'll get royally f-ed! Sell all the opioids in the world through a public pharma corp and you can keep enjoying your jet-set life and yacht. The allegedly smartest people in the world are focusing on the dumbest problems while being reamed by the frat-boys that went to Wall Street and Politics, guns and drugs. LULZ.

hbbio 5y ago
Your comment echoes today's Credit Suisse news: https://www.theguardian.com/news/2022/feb/20/credit-suisse-secrets-leak-unmasks-criminals-fraudsters-corrupt-politicians https://www.theguardian.com/news/2022/feb/20/credit-suisse-s... “The pretext of protecting financial privacy is merely a fig leaf covering the shameful role of Swiss banks as collaborators of tax evaders.” And it's more than tax evasion, "include a human trafficker in the Philippines, a Hong Kong stock exchange boss jailed for bribery, a billionaire who ordered the murder of his Lebanese pop star girlfriend and executives who looted Venezuela’s state oil company, as well as corrupt politicians from Egypt to Ukraine".
Thorrez 5y ago
>Or you can just be a known drug lord, launder billions of USD through a respected international bank, no one goes to jail, small fine, Are you referring to some specific drug lord? Who?
- NaturalPhallacy 5y ago
  Pfizer?
  - Thorrez 5y ago
    That's not the normal definition of "drug lord". Also, was Pfizer involved in money laundering?

scaramanga 5y ago

I wonder if the author lives in a democracy or in a state which has rule of law. Because it strikes me that the solution space also includes many political, legislative, and judicial options such as, perhaps most obviously, the regulation of tech, or the effective policing of online abuse.

jrd259 5y ago

I miss the point of this discussion. Does the HN readership really include a substantial number of drug lords, cyber criminals, spies, informants or live under a regime where they fear for their lives from state actors? I'm not cheating on my taxes or my spouse. Are there really many people being paid in cybercash from a genuine need to avoid state or corporate interest?

drsnow 5y ago
all of those are genuine needs
- CRConrad 5y ago
  "Genuine", sure, but justifiable? Most reasonable people would want drug lords and cyber criminals to get caught.

ssklash 5y ago

I think the point about most people not choosing anonymity at all is a bit misleading. It assumes that these people are making a reason, informed choice, and going ahead and living the way they do. I don't think that's the case. Most "normal" people, and even many tech people, don't know what companies like Google and Facebook are capable of. If you showed someone exactly what information of theirs was collected, for how long, the predictions they could make with it,and god knows what else is being done with it, I think many people would change their behavior. But they don't know, and this is not an accident. Most people do not even know what the business model of Facebook and Google are. If you ask, they'd probably say something like "oh they're an email company" or "they help me share photos of my grand kids" or god-forbid, they're "helping connect people connect". Both are surveillance-based, personal information-driven ad companies. That's it. No amount of Google X or Android or Gmail or Libra or FB Live or any other program will change what their business is. And they will never, ever admit to this.

spdebbarma 5y ago

I am a little sad that there's no conclusion after the introduction of the spectrum, which most people are already aware of.

Janiya 5y ago

sedatk 5y ago

That article is full of terrible advice. Example: > Don't use Gmail -- use ProtonMail "ProtonMail logged IP address of French activist after order by Swiss authorities" https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

Havoc 5y ago
They don't log by default, but were legally compelled to do so in this instance. Which is about as good as it gets. Unless you know of a reputable email provider that ignores court orders? (bit of an oxymoron)
- sedatk 5y ago
  I agree that ProtonMail and GMail are not the same in terms of privacy protections. But, the article implies that the bulk of advice provided in the article is somehow a guarantee to anonymity. A reader may easily assume that ProtonMail doesn't log any IP addresses at all based on that misconception. ProtonMail even used to claim exactly that in their sales page until that incident I linked to. In fact, the article is the anti-thesis of itself. Blanket anonymity advice is the worst anonymity advice.
samfather 5y ago
It also recommends using DuckDuckGo ... the "private" search engine hosted on US Microsoft servers.

drewcoo 5y ago

<tinfoil>In the world of global governmental (often extra-legal) surveillance, aren't attempts to be anonymous likely to make you a person of interest?</tinfoil>

fallmonkey 5y ago

On personal anecdotes, I've used the same internet identity across all platforms and it's not hard to locate my real life identity from there...since like 20 years ago when I got on the internet. So all the good reputation and bad reputation followed me through, and surprised me in best and worst way. There're times when I wished I had concealed myself saying certain things (or just haven't said it), and times when I felt the joy of recognition when people connected dots about me and became closer friend. Now as I'm getting old, it's just a habit, no longer about risks or rewards. Yet, both younger me and older me will probably be very indecisive about doing this if they've never done it and are told about all the fortune/misfortune this has brought to me, including meeting my wife and thinking about suicides.

CRConrad 5y ago
> On personal anecdotes, I've used the same internet identity across all platforms and it's not hard to locate my real life identity from there...since like 20 years ago when I got on the internet. Me too. > So all the good reputation and bad reputation followed me through, and surprised me in best and worst way. Not so much for me, AFAIK. I think quite simply, pretty much nobody could be bothered to look for it.

slimeboty 5y ago

"Don't buy domain names" OK but why? The dodgy guy who ran that website had to own the domain name somehow?

patricklorio 5y ago
It was a tor hidden service. Do domain purchase required.

dredmorbius 5y ago

43 bits. It requires 43 bits of defining information to identify a single entity online. Those bits might be your name and date of birth. Or they could be your home and work postal code (effective for better than 90% of the population, at least when commuting to work was a thing). It could be your activity patterns, and what that says about your sleep/wake cycle, and possibly travel patterns. EFF's Panopticlicck found enough distinctive information within Web browser characteristics to uniquely identify the vast majority of people submitting data to the project. If you want to duck most casual observation ... then yes, standard precautions can be effective, though it's quite likely you'll slip and leak information at some point. Those clues can wait years, or decades, to be unraveled. Against law enforcement or state-level actors, you'll probably need to try considerably harder, though it's helpful to realise that what such entities have is typically far more data and the motivation to look through it for patterns and correlations, rather than superhuman cracking skills. An area that's been of interest to me for some time has been the question of just how many investigations might be possible under various security or investigative services. My suspicion is that capabilities are constrained --- that is, there are fewer investigations than one might think --- but that the resources which can be brought to bear are considerable. As an example, the US Federal Bureau of Investigation had a 2019 budget of $9.6 billion, with 13,412 special agents and 20,420 support professionals, as of 2009. By news stories, the January 6, 2021 investigation has been the largest in the Bureau's history, with 350--400 arrests and 1,300--1,500 grand jury subpoenas. I haven't seen data on how many investigations the FBI conducts annually, or how many cases are submitted for prosecution, but suspect it's on the order of thousands. The Bureau no longer seems to produce blunt gun-in-your-face reports typical of the Hoover era as with the 1969 annual report showing a chart of convictions by fiscal year (over 13,150 for 1969, here: https://archive.org/details/FBIAnnualReport1969/page/n5/mode/2up?view=theater https://archive.org/details/FBIAnnualReport1969/page/n5/mode...), though I suspect levels are at least roughly similar. That was an average of three arrests per agent, and the 1969 report states 2.8 million name searches were conducted that year, along with 2.6 million pieces of mail and 241,000 telephone and telegraph communications.

makach 5y ago

I believe that truly anonymous can only be achieved in bursts, and not continuously maintained. For day to day existence, blending in with the common population is hiding in plain sight.

saos 5y ago

Really good. I’m always cautious of how I say things on Reddit as to not give too much away. I’m sure Reddit data scientists can build all sorts of models based in comments from users

imdsm 5y ago

As much as dark mode is becoming a thing, I can't read light on dark text without it messing with my eyes. It has to be the worst way to render text.

z_zetetic_z 5y ago
Thank goodness for firefox reader mode. I don't like seeing white lines as an after image on my retinas.

Cthulhu_ 5y ago

One of my forum's members had (has?) a stalker. We had a new user once who implied he was familiar with our community, but never specified. He was fairly active for about a year or so, but at some point he started to post rants about his family or something that was eerily familiar to the stalker's rants. I looked up his e-mail address in his profile (I'm the admin). I punched it into google, which led to what looked like a public chat log. The e-mail address he used to register his account there was listed right next to his old username, which we recognized as the stalker's. We banned his account and the stalked member had to contact their solicitor, again. anyway tl;dr never post your e-mail address or a variant thereof publicly, especially if you're trying to be anonymous.

SergeAx 5y ago

> Sure, a "bad guy" could use that info and blackmail her This is the place where I lost OP. How can anybody be blackmailed with publicly available info? On the topic: I believe that the serious level of anonymity makes life extremely inconvenient and uncomfortable. Always using VPNs, keeping small hosts in different places as exit points, checking and rechecking everything when connecting to WiFi or roaming. Keeping separate hardware, for that matter. I don't see how all this parafernalia justified. Identity stealing? Just use 2FA for your key service accounts. Don't reuse passwords, use a password manager - those are today's basics every schoolchild knows. Use debit card instead of credit and never keep it's balance above $100. Turn on 3D-security on all your cards. Don't get involved into drug dealing. Things like this.

CRConrad 5y ago
> How can anybody be blackmailed with publicly available info? By pointing out to people who haven't gone looking for that info, or who might have come across it but not connected it to you, that it is indeed about or by you.

jpalomaki 5y ago

If you are participating in discussion forums under pseudonym, you quite easily give quite many bits of personal information over time even if you try to be careful about it. You give hints about your age, where you have lived, maybe about hobbies, education, work history, time when you are online. Each individual bit is not much, but when you combine few of these, they actually identify you exactly.

wallacoloo 5y ago

live offline. as long as you’re not completely socially incompetent you can be largely yourself in most situations, find people you jive with, and then be completely yourself with them. unless your threat level is “my phone’s recording everything in the room 24/7 and sending that to authorities”, you’re free to do all the illegal drugs you want with your friends, use the N-word, do all the other things which you thing you should be able to freely do but for some reason aren’t able to do comfortably in public. if you must do things online that are best kept detached from your IRL/govt identity, setup a box running something like Tails that doesn’t accept any non-Tor traffic, and interact with it through a text-only interface (i.e. a shell, or links-like keyboard-driven web browser). people sometimes discourage using obscure setups because they allow better fingerprinting but that’s not always as bad as it’s made out to be. primarily you want to break the link between your pseudonymous identity and your IRL identity. it doesn’t matter how fingerprintable your pseudonym is so long as the overlap between it and your IRL identity is small. and that’s the reason to prefer simpler interfaces like text-only: they prevent leaking things like cursor movements which might otherwise build a tie between those identities.

Janiya 5y ago