Be anonymous

> keyboard frequency on anonymized accounts can be de-anonymized

Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix.

> Mixers and tumblers will eventually leak

Don't use mixers and tumblers, use Monero and/or Monero atomic swaps.

But, you are right that it is futile to maintain defense against a determined 3 letter agency.

[1]: https://www.whonix.org/wiki/Keystroke_Deanonymization#Kloak

Notably missing aspect is precise time of events.

Personas like someone who posts content during 08:34:40 - 09:23:23 except 08:43:30-08:55:23, never seems to be active during 22:00 - 06:00, can be narrowed down to something like a person commuting via bus route A from stop B to C changing to a train route from C to D through passageway E in the station.

From there you can look for a man looking down at a phone, or couple information with other factors, or throw in a bait like a giant stinking dead fish or a rare and loud car in front of him and watch for responses he'd make. IMSI catchers and Bluetooth scanners can be useful as well if your adversaries are resourceful. Time and location of transmissions and time of receptions can be correlated, in theory.

This type of attacks can't be mitigated on fast-paced social media at all; both posts and requests has to be queued and obfuscated for time.

That's a bultin feature of messaging systems like I2P-bote (running on I2P darknet). It's been a while since experimenting with Bitmessage but I think they queue/batch messages as well. But for forum like software that's definitely true, can't easily have variable delayed posting.

Another aspect that's important and often ignored, is writing style anonymization. You practically want an offline tool, that removes idiosyncrasies from the text you write and makes it sound as bland as possible.

edit:

A related story. Around 2010-2012 I was working for a company, and I was part of a somewhat managerial group. At one point we decided to pull in direct employee feedback in an anonymous free-text form. Due to their writing style being reflective on the way they spoke, it was possible to point exactly who wrote what message. Of course, few exceptions existed, I didn't personally know all the employees in the company.

You're absolutely right. It is not enough to use anonymity tools, you also have to make sure everything else around you doesn't compromise your anonymity. Made me think of a Harvard bomb threat incident where the student posting a fake bomb threat (through Tor) to avoid final exams was the only person using Tor on campus at the time, which trivially identified him.

https://theprivacyblog.com/blog/anonymity/why-tor-failed-to-...

I have been afraid of sharing my ideas, post history, etc. in a way that could be easily traced back to my identity for years. I made sure my accounts and usernames bore no personally identifiable tid-bits. I use a VPN religiously (that won't change).

I've since decided that I am done with all that.

I was afraid my employer might question my Reddit posting history (they wouldn't.) I was worried someone who Googled me would think my past self was dumb (who cares).

Now my ideas are almost all public and growing more so by the day. I am working up the energy to start a personal blog, if anything just to document my ideas over time. I am adding my real name and email to my Github, HN, (not Reddit, yet, though it would not be hard to connect), IH, etc.

I want someone to be able to Google me and find my best work.

On the other hand, there are clearly cases and types of info/accounts that should remain private. I self-host as much as possible. I encrypt personal files before uploading. I have multiple Protonmail accounts. I use custom DNS, etc.

Ideas should be public. Information is a case by case basis, but I generally care a lot less than I used to.