9 ms·

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide b

by cellis 5y ago

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could easily flag you to your government. If you use wifi at a common point you're likely to be flagged and there isn't an easy way other than keeping on the move. But moving often is another anomalous event, and it's very difficult to do even for Drug Lords ( El Chapo ) or Terrorists that it behooves to do. This puts you in a sort of Zugzwang, to borrow a chess term. - there's always leakage, for instance, in the way you talk with people in the real world. At some point you send enough communication for sophisticated frequency analysis. - and there are other patterns of usage that could be used to identify you, like searches or even keyboard frequency on anonymized accounts can be de-anonymized by very specific markers ( ML works! ). - off ramps for crypto aren't very good. If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed. Mixers and tumblers will eventually leak and you'll be caught. - you're very vulnerable to social engineering by people you do business with. one slip where you stop communicating in a transactional mode of communication and that's a weak link in your armor. In the end, the FBI only has to be right once, and you have to be right every time.

xvector 5y ago
> keyboard frequency on anonymized accounts can be de-anonymized Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix. > Mixers and tumblers will eventually leak Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. But, you are right that it is futile to maintain defense against a determined 3 letter agency. [1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak
- beardog 5y ago
  I made this Firefox extension to defend against keyboard deanonymization on desktops https://git.voidnet.tech/kev/PrivateKeyboardAddon https://git.voidnet.tech/kev/PrivateKeyboardAddon I'm about to publish an update to it that uses a toolbar popup to fill out forms instead of the current lag approach, which will also protect against keyboard layout leaks[1] (which Tor browser/privacy.resistFingerprinting protects against anyway) https://bugzilla.mozilla.org/show_bug.cgi?id=1222285 https://bugzilla.mozilla.org/show_bug.cgi?id=1222285
- wallacoloo 5y ago
  > Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. Monero doesn’t make your transactions anonymous, it makes them ambiguous. your wallet might default to using an n=6 ring signature, meaning it picks 5 random addresses with balances and creates a transaction that could have plausibly originated from any of those 5 or your own. so you get plausible deniability, but also if your threat actor can unmask the other 5 addresses (which might not be so hard if those accounts are regularly interacting with exchanges) then you’re done. zcash gets you actual transaction-level anonymity, not just ambiguity. fewer places accept it, but in theory you can still break the link by obtaining zcash and then exchanging it for the currency of your choice on any exchange that doesn’t ask for PII (e.g. a DEX)
3s 5y ago
You're absolutely right. It is not enough to use anonymity tools, you also have to make sure everything else around you doesn't compromise your anonymity. Made me think of a Harvard bomb threat incident where the student posting a fake bomb threat (through Tor) to avoid final exams was the only person using Tor on campus at the time, which trivially identified him. https://theprivacyblog.com/blog/anonymity/why-tor-failed-to-hide-the-bomb-hoaxer-at-harvard https://theprivacyblog.com/blog/anonymity/why-tor-failed-to-...
- klysm 5y ago
  Many anonymity tools have the k-anonymity property. It’s really unfortunate for k to be 1.
  - 323 5y ago
    This is the big problem of crypto coin mixers. 99% of their users are trying to launder illegal bitcoin.
- sfilmeyer 5y ago
  I remember being shocked at the time that he had the foresight to use Tor but not to use literally any wifi network other than the campus wifi. That being said, there are a whole list of things he'd have to do to keep anonymous and it only takes one slip to identify someone.
- deleted 5y ago
  [deleted]
- notsoanonynous 5y ago
  Tor is amateur hour. The Feds can easily deanomymize things where a server is up 24/7 servicing requests. The author of this article is also very wrong: Anonymity is not on a spectrum. It’s all or nothing. Like a Mario game where any mistaken encounter makes you start over (and that’s if you don’t get in trouble for what you did). First step is to understand that any system could be bugged. Every IRL confidant could sell you out. Every keyboard could have a keylogger, etc. Every store could have a security camera. Phones are giving out their MAC numbers to every cell tower and wifi radio. They now have chips you can’t turn off, and so forth. You should also assume there is no such thing as an “anonymous” account and that every service COULD sell out whatever information you gave it. (Yes, even Telegram or ProtonMail, however unlikely that may be.) The below is a playbook for how to become truly anonymous. Continue to live your everyday life but the below is only for your “anonymous” identities, which you can gradually bootstrap as a hobby: The first thing you do, therefore, is bootstrap your identity by taking advantage of unlinkability that is available to you. Buy a bunch of Android phones on Craigslist for cash, for example. (Or pay a homeless guy to buy a phone in a store for you.) Do not use SIM cards at all, only WiFi. Never take photos, etc. Keep your phone off or in a faraday cage until you use it. For extra points, always use it through a VPN on WiFi at home, which you purchased using the accounts below: Then make an anonymous google account on the Android phone. Make some ProtonMail accoung usinf such an anonymous Google account. Now you can bootstrap from email addresses. Buy some Google Play gift cards and download some apps to get a second number. Now you can bootstrap from a phone number. Sign up to Telegram, Signal and other accounts using this. Now you have end to end encrypted messaging. Frankly, though, realtime messaging is a bit of a luxury to continue to stay in normie world. To stay truly anonymous, you should continue to: 1. Schedule posts and mail send/receive at random times. Do not ever use realtime audio or video because it might be recorded. You might make an exception for early days of your projects when people would have no reason to go out of their way to record you — just to give them confidence you’re a real person. But afterwarss, stop doing that. Let the people build your movement for you. 2. Never mention your anonymous identity or projects from your real one, and vice versa. This means your anonymous identity MUST NEVER have confidants or colleagues IRL. Build up a network of colleagues who are “fronts” for what you do. Eventually you can step back and let the movement do things for you. 3. Pay and get paid in cryptocurrency. Have smart contracts send you the money (think Richard Heart’s Hex origin address, but actually anonymous). 4. You will only ever be able to spend the crypto on paying people for services and DeFi protocols. You can never cash out to fiat, because the IRL purchases catch up with you when they follow the money. There is a surprising amount of online services you can spend $97 million dollars on, while staying anonymous ;-) If you really do need to spend money IRL (because you went broke somehow in your everyday life) then you can cashout using cross-chain bridges and Monero to pay for goods. But still, never get ostentatious wealth IRL! 5. The weakest link then becomes your writing or coding style. Never publish any code or writing, let others do it for you. Make your communication to others from your anonymous identity sufficiently different than anything saved later would not identify you (this is the weakest link, but you can consider “playing a character” when speaking to others). 6. Any private keys that you used to sign your messages can be periodically published in some conspicuous place, effectively giving you plausible deniability about all your previous and future posts. It’s hard to prove a negative (that no one else has access to your private keys before your public disclosure.) Alright, Hacker News. I have given away the non-amateur anonymity playbook using https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle Go ahead and try to deanonymize this in the comments below. Assume you are a state actor with all tools at your disposal.
323 5y ago
What you said and much more. For example, you buy a burner phone, but the place you bought it from, even if a second hand shop, had a security camera. Maybe they also record IMEI's before selling phones. Or you carry your burner phone together with your real phone. Or alternatively, you leave one at home when using the other. Both of these things can be linked by a sufficiently determined actor (FBI/NSA level). Or they track you to using a public square WiFi one day. Again, cameras are everywhere. If they got your real name, no matter how, it's game over. You will be surveilled and they will find proof to link you. This is why all those posts "if only DPR used this kind of encryption or dead-men-switch" are ridiculous. Once they knew his real name it was just a matter of time and building a case.
- cellis 5y ago
  I would say that if you're caught and ... somehow manage to delete all the evidence linking you ( you have device explosives or, idk, 2048 bit encryption ), you may be able to escape, but come on, who are we kidding: the FBI has like a 99.96% conviction rate and that's without even going to into the "parallel construction" or other conspiratorial lines of attack.
  - 323 5y ago
    I don't think the FBI would be that dumb to arrest you before they have solid proof.
    - deleted 5y ago
      [deleted]
  - ethbr0 5y ago
    The FBI has "like a 99.96% conviction rate"?
    - chihuahua 5y ago
      99.96333 (repeating of course)
blowski 5y ago
It’s a bit like Schneier’s Law. You can put in place protections that you personally cannot workaround, but that doesn’t mean someone with sufficient means and motivation would also be blocked.
weq 5y ago
Scamming is BOOMING. We are talking entire developing countries getting onboard. The noise ratio is very high on all these services. There are hundreds of "alphabays" running RIGHT now with millions of people using them, right now. This isnt 2013, those big take-downs of high profile sites did nothing but diversify, fracture the community. Sure, if u piss off the wrong agent and they spend a few years on the case you may get busted. But the vast majority?
deleted 5y ago
[deleted]
makecheck 5y ago
Having to be right “every time” is why it’s insane we still rely on things like SSNs and phone numbers that are difficult to replace but highly valuable and damaging if leaked. We need to be exchanging personal data only in forms that become worthless and unidentifying in a short period of time, requiring secure refreshes to maintain.
pc86 5y ago
Do you think it's fair to say that if you need to be anonymous/hidden from state-level actors that you need state-level support?
soheil 5y ago
Why is this comment the top comment when it's a bunch of conjectures, scare mongering tactics and half-truths at best? Sure if you're on tor and no one else around you is then you stand out, so what? Now there is a faint signal that there is something suspicious going on. To assume one could with sufficient accuracy narrow down a target based on a weak signal like that to see what they're up to is like assuming we're going to general AI any day now because obviously imageNet is so good. Let's not allow the creation of an echo chamber to add confusion to the great work people at the Tor project are doing and to instill even more fear in those who may want to dissent against authoritarian forces.
- cellis 5y ago
  I’ll start out by saying I agree with you on Tor being a layer in a “defense in depth” strategy but to imply my response to this is fearmongering is quite premature. Feel free to give a point by point rebuttal for the community. I have given quite a bit of thought to how to stay anonymous even though I use my real name and identity here, and have no real issues with government. Tor is the definition of deceptively simple, and there are a lot of impressionable people who read articles like this on the web when they’re first starting out who could easily be lulled into a false sense of security and then start transacting on the darknet and think they can’t be touched. OGs on HN know better and remember the threads where tptacek and cperciva would routinely dismantle this notion of tor or VPN anonymity/security.
rtpg 5y ago
It's very odd to list all these (pretty theoretical!) things when, in practice, everyone gets owned by much more basic operational security concerns (except for the last "social engineering" one, where moving to a different communication network is a super common way for law enforcement to close the loop on an investigation). Like "being super careful isn't enough" _might be true_, but if you did everything on this list and get caught anyways, you are in a super minority of people getting caught. The example in the article (a hotmail-based email address being used). Everyone sees this and immediately goes "OK the feds can get this info". If such a basic opsec failure was happening, how is it that this person was still able to get as far as they did building up their website? Being worried about the feds finding you from speech analysis of your posts online seems a bit silly when it's always _not_ that and much more just "finding the one simple thing you did wrong".
sizzle 5y ago
VPN providers can also be compelled to share all logs, even if they say they don’t log your info or activity, there are court cases that prove there are weaknesses in VPN providers, whether it was the method of payment you signed up with or if they logged your meta data on sign up, location services and telemetry from a mobile app backend etc. Privacy is never a guaranteed thing when you introduce ubiquitous computing to the mix, even things outside of computers can profile you like being captured in CCTV around the time when your signals are picked up from a computer/smartphone phoning home or unusual internet activity, like the scene out of Mr. Robot.
noduerme 5y ago
>> If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed South America is the greatest tumbler of all. I spent years in Argentina under the currency restrictions and paid my rent in Bitcoin, bought USD and pesos at black market rates in Bitcoin, all with people I met on localbitcoins and never using an exchange. I don't know about Brazil, but there is a huge market for peer to peer BTC in AR and UY, and you can just trade an envelope of cash over the table at a Starbucks in Buenos Aires for anywhere up to $10K USD. In the USA I would be scared of being on camera, but I really doubt you would have that problem if you meet someone in a bar or on the beach in Brazil. [edit] Just to explain this comment for people who think of BTC as something that you have to buy or sell on an exchange where you're allowing the endpoints to be tracked; the original reason for cryptocurrency was that you don't have to show your passport or link it to a bank account. That still obtains in lots of places in the world where people will happily give you their shitty paper money for bitcoin, and you can use the paper to pay your rent. Don't buy BTC on an exchange, and don't sell it on an exchange. Buy it from someone in person in a phone-to-phone transfer, or win it in a poker game. Keep it in a private wallet, not an exchange. Sell it P2P in person when you want to. You don't need to use an exchange at all.
otabdeveloper4 5y ago
> if you're using VPN traffic but most people "around" you aren't, you're a suspicious node Yes, working from home is very suspicious. :P (That said, the VPN companies that work in the B2C segment for those who can't set up their own VPN server is small and they're all well-known to the government.)
xurukefi 5y ago
Are there reported incidents where somebody was caught with such sophisticated techniques? It seems like every time I read about how the FBI caught some big darknet criminal it was pretty much always some trivial mistake on the criminal's side.
- toss1 5y ago
  But that is just it - you can use all the sophisticated techniques but there are 10000 ways to make a fatal error, and that number increases with every action. So even if you are 99.99% rock solid in your technique, it is a certainty that you will get caught with that one 'dumb' mistake. It only looks dumb in hindsight, but it was inevitable. Getting to 99.99999% reliability is very difficult for one person, it usually takes a highly diligent team with very well-sorted processes.

by cellis 5y ago

xvector 5y ago

> keyboard frequency on anonymized accounts can be de-anonymized Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix. > Mixers and tumblers will eventually leak Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. But, you are right that it is futile to maintain defense against a determined 3 letter agency. [1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak

beardog 5y ago
I made this Firefox extension to defend against keyboard deanonymization on desktops https://git.voidnet.tech/kev/PrivateKeyboardAddon https://git.voidnet.tech/kev/PrivateKeyboardAddon I'm about to publish an update to it that uses a toolbar popup to fill out forms instead of the current lag approach, which will also protect against keyboard layout leaks[1] (which Tor browser/privacy.resistFingerprinting protects against anyway) https://bugzilla.mozilla.org/show_bug.cgi?id=1222285 https://bugzilla.mozilla.org/show_bug.cgi?id=1222285
wallacoloo 5y ago
> Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. Monero doesn’t make your transactions anonymous, it makes them ambiguous. your wallet might default to using an n=6 ring signature, meaning it picks 5 random addresses with balances and creates a transaction that could have plausibly originated from any of those 5 or your own. so you get plausible deniability, but also if your threat actor can unmask the other 5 addresses (which might not be so hard if those accounts are regularly interacting with exchanges) then you’re done. zcash gets you actual transaction-level anonymity, not just ambiguity. fewer places accept it, but in theory you can still break the link by obtaining zcash and then exchanging it for the currency of your choice on any exchange that doesn’t ask for PII (e.g. a DEX)

3s 5y ago

You're absolutely right. It is not enough to use anonymity tools, you also have to make sure everything else around you doesn't compromise your anonymity. Made me think of a Harvard bomb threat incident where the student posting a fake bomb threat (through Tor) to avoid final exams was the only person using Tor on campus at the time, which trivially identified him. https://theprivacyblog.com/blog/anonymity/why-tor-failed-to-hide-the-bomb-hoaxer-at-harvard https://theprivacyblog.com/blog/anonymity/why-tor-failed-to-...

klysm 5y ago
Many anonymity tools have the k-anonymity property. It’s really unfortunate for k to be 1.
- 323 5y ago
  This is the big problem of crypto coin mixers. 99% of their users are trying to launder illegal bitcoin.
sfilmeyer 5y ago
I remember being shocked at the time that he had the foresight to use Tor but not to use literally any wifi network other than the campus wifi. That being said, there are a whole list of things he'd have to do to keep anonymous and it only takes one slip to identify someone.
deleted 5y ago
[deleted]
notsoanonynous 5y ago
Tor is amateur hour. The Feds can easily deanomymize things where a server is up 24/7 servicing requests. The author of this article is also very wrong: Anonymity is not on a spectrum. It’s all or nothing. Like a Mario game where any mistaken encounter makes you start over (and that’s if you don’t get in trouble for what you did). First step is to understand that any system could be bugged. Every IRL confidant could sell you out. Every keyboard could have a keylogger, etc. Every store could have a security camera. Phones are giving out their MAC numbers to every cell tower and wifi radio. They now have chips you can’t turn off, and so forth. You should also assume there is no such thing as an “anonymous” account and that every service COULD sell out whatever information you gave it. (Yes, even Telegram or ProtonMail, however unlikely that may be.) The below is a playbook for how to become truly anonymous. Continue to live your everyday life but the below is only for your “anonymous” identities, which you can gradually bootstrap as a hobby: The first thing you do, therefore, is bootstrap your identity by taking advantage of unlinkability that is available to you. Buy a bunch of Android phones on Craigslist for cash, for example. (Or pay a homeless guy to buy a phone in a store for you.) Do not use SIM cards at all, only WiFi. Never take photos, etc. Keep your phone off or in a faraday cage until you use it. For extra points, always use it through a VPN on WiFi at home, which you purchased using the accounts below: Then make an anonymous google account on the Android phone. Make some ProtonMail accoung usinf such an anonymous Google account. Now you can bootstrap from email addresses. Buy some Google Play gift cards and download some apps to get a second number. Now you can bootstrap from a phone number. Sign up to Telegram, Signal and other accounts using this. Now you have end to end encrypted messaging. Frankly, though, realtime messaging is a bit of a luxury to continue to stay in normie world. To stay truly anonymous, you should continue to: 1. Schedule posts and mail send/receive at random times. Do not ever use realtime audio or video because it might be recorded. You might make an exception for early days of your projects when people would have no reason to go out of their way to record you — just to give them confidence you’re a real person. But afterwarss, stop doing that. Let the people build your movement for you. 2. Never mention your anonymous identity or projects from your real one, and vice versa. This means your anonymous identity MUST NEVER have confidants or colleagues IRL. Build up a network of colleagues who are “fronts” for what you do. Eventually you can step back and let the movement do things for you. 3. Pay and get paid in cryptocurrency. Have smart contracts send you the money (think Richard Heart’s Hex origin address, but actually anonymous). 4. You will only ever be able to spend the crypto on paying people for services and DeFi protocols. You can never cash out to fiat, because the IRL purchases catch up with you when they follow the money. There is a surprising amount of online services you can spend $97 million dollars on, while staying anonymous ;-) If you really do need to spend money IRL (because you went broke somehow in your everyday life) then you can cashout using cross-chain bridges and Monero to pay for goods. But still, never get ostentatious wealth IRL! 5. The weakest link then becomes your writing or coding style. Never publish any code or writing, let others do it for you. Make your communication to others from your anonymous identity sufficiently different than anything saved later would not identify you (this is the weakest link, but you can consider “playing a character” when speaking to others). 6. Any private keys that you used to sign your messages can be periodically published in some conspicuous place, effectively giving you plausible deniability about all your previous and future posts. It’s hard to prove a negative (that no one else has access to your private keys before your public disclosure.) Alright, Hacker News. I have given away the non-amateur anonymity playbook using https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle Go ahead and try to deanonymize this in the comments below. Assume you are a state actor with all tools at your disposal.

323 5y ago

What you said and much more. For example, you buy a burner phone, but the place you bought it from, even if a second hand shop, had a security camera. Maybe they also record IMEI's before selling phones. Or you carry your burner phone together with your real phone. Or alternatively, you leave one at home when using the other. Both of these things can be linked by a sufficiently determined actor (FBI/NSA level). Or they track you to using a public square WiFi one day. Again, cameras are everywhere. If they got your real name, no matter how, it's game over. You will be surveilled and they will find proof to link you. This is why all those posts "if only DPR used this kind of encryption or dead-men-switch" are ridiculous. Once they knew his real name it was just a matter of time and building a case.

cellis 5y ago
I would say that if you're caught and ... somehow manage to delete all the evidence linking you ( you have device explosives or, idk, 2048 bit encryption ), you may be able to escape, but come on, who are we kidding: the FBI has like a 99.96% conviction rate and that's without even going to into the "parallel construction" or other conspiratorial lines of attack.
- 323 5y ago
  I don't think the FBI would be that dumb to arrest you before they have solid proof.
  - deleted 5y ago
    [deleted]
- ethbr0 5y ago
  The FBI has "like a 99.96% conviction rate"?
  - chihuahua 5y ago
    99.96333 (repeating of course)

blowski 5y ago

It’s a bit like Schneier’s Law. You can put in place protections that you personally cannot workaround, but that doesn’t mean someone with sufficient means and motivation would also be blocked.

weq 5y ago

Scamming is BOOMING. We are talking entire developing countries getting onboard. The noise ratio is very high on all these services. There are hundreds of "alphabays" running RIGHT now with millions of people using them, right now. This isnt 2013, those big take-downs of high profile sites did nothing but diversify, fracture the community. Sure, if u piss off the wrong agent and they spend a few years on the case you may get busted. But the vast majority?

deleted 5y ago

[deleted]

makecheck 5y ago

Having to be right “every time” is why it’s insane we still rely on things like SSNs and phone numbers that are difficult to replace but highly valuable and damaging if leaked. We need to be exchanging personal data only in forms that become worthless and unidentifying in a short period of time, requiring secure refreshes to maintain.

pc86 5y ago

Do you think it's fair to say that if you need to be anonymous/hidden from state-level actors that you need state-level support?

soheil 5y ago

Why is this comment the top comment when it's a bunch of conjectures, scare mongering tactics and half-truths at best? Sure if you're on tor and no one else around you is then you stand out, so what? Now there is a faint signal that there is something suspicious going on. To assume one could with sufficient accuracy narrow down a target based on a weak signal like that to see what they're up to is like assuming we're going to general AI any day now because obviously imageNet is so good. Let's not allow the creation of an echo chamber to add confusion to the great work people at the Tor project are doing and to instill even more fear in those who may want to dissent against authoritarian forces.

cellis 5y ago
I’ll start out by saying I agree with you on Tor being a layer in a “defense in depth” strategy but to imply my response to this is fearmongering is quite premature. Feel free to give a point by point rebuttal for the community. I have given quite a bit of thought to how to stay anonymous even though I use my real name and identity here, and have no real issues with government. Tor is the definition of deceptively simple, and there are a lot of impressionable people who read articles like this on the web when they’re first starting out who could easily be lulled into a false sense of security and then start transacting on the darknet and think they can’t be touched. OGs on HN know better and remember the threads where tptacek and cperciva would routinely dismantle this notion of tor or VPN anonymity/security.

rtpg 5y ago

It's very odd to list all these (pretty theoretical!) things when, in practice, everyone gets owned by much more basic operational security concerns (except for the last "social engineering" one, where moving to a different communication network is a super common way for law enforcement to close the loop on an investigation). Like "being super careful isn't enough" _might be true_, but if you did everything on this list and get caught anyways, you are in a super minority of people getting caught. The example in the article (a hotmail-based email address being used). Everyone sees this and immediately goes "OK the feds can get this info". If such a basic opsec failure was happening, how is it that this person was still able to get as far as they did building up their website? Being worried about the feds finding you from speech analysis of your posts online seems a bit silly when it's always _not_ that and much more just "finding the one simple thing you did wrong".

sizzle 5y ago

VPN providers can also be compelled to share all logs, even if they say they don’t log your info or activity, there are court cases that prove there are weaknesses in VPN providers, whether it was the method of payment you signed up with or if they logged your meta data on sign up, location services and telemetry from a mobile app backend etc. Privacy is never a guaranteed thing when you introduce ubiquitous computing to the mix, even things outside of computers can profile you like being captured in CCTV around the time when your signals are picked up from a computer/smartphone phoning home or unusual internet activity, like the scene out of Mr. Robot.

noduerme 5y ago

>> If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed South America is the greatest tumbler of all. I spent years in Argentina under the currency restrictions and paid my rent in Bitcoin, bought USD and pesos at black market rates in Bitcoin, all with people I met on localbitcoins and never using an exchange. I don't know about Brazil, but there is a huge market for peer to peer BTC in AR and UY, and you can just trade an envelope of cash over the table at a Starbucks in Buenos Aires for anywhere up to $10K USD. In the USA I would be scared of being on camera, but I really doubt you would have that problem if you meet someone in a bar or on the beach in Brazil. [edit] Just to explain this comment for people who think of BTC as something that you have to buy or sell on an exchange where you're allowing the endpoints to be tracked; the original reason for cryptocurrency was that you don't have to show your passport or link it to a bank account. That still obtains in lots of places in the world where people will happily give you their shitty paper money for bitcoin, and you can use the paper to pay your rent. Don't buy BTC on an exchange, and don't sell it on an exchange. Buy it from someone in person in a phone-to-phone transfer, or win it in a poker game. Keep it in a private wallet, not an exchange. Sell it P2P in person when you want to. You don't need to use an exchange at all.

otabdeveloper4 5y ago

> if you're using VPN traffic but most people "around" you aren't, you're a suspicious node Yes, working from home is very suspicious. :P (That said, the VPN companies that work in the B2C segment for those who can't set up their own VPN server is small and they're all well-known to the government.)

xurukefi 5y ago

Are there reported incidents where somebody was caught with such sophisticated techniques? It seems like every time I read about how the FBI caught some big darknet criminal it was pretty much always some trivial mistake on the criminal's side.

toss1 5y ago
But that is just it - you can use all the sophisticated techniques but there are 10000 ways to make a fatal error, and that number increases with every action. So even if you are 99.99% rock solid in your technique, it is a certainty that you will get caught with that one 'dumb' mistake. It only looks dumb in hindsight, but it was inevitable. Getting to 99.99999% reliability is very difficult for one person, it usually takes a highly diligent team with very well-sorted processes.