Live data from Hacker News

Be anonymous

kg.dev

181–190 of 260 posts

Re: Be anonymous

#181
post #126

Earlier quoted context omitted.

Just some suggestions for the connection part. Using a phone is probably the first mistake. If you are going to use your home network you are better off using a machine you control and an operating system that is open source. I suggest these steps: Step 1: Connect to a popular vpn. Step 2: Connect to tor Step 3: Get free vps or pay with cryto you trade for gift cards purchased or some other method Step 4: Connect to…

Iirc phones will broadcast previously connected access point max addresses. I doubt gp truly understands what it takes to be anonymous (imo it’s probably impossible).

So what if they find that you used a phone?

They still had to somehow link your online identity to your phone. And how would they do that? The phone is simply a computer that you use, through VPNs, to send and reveive mail and post messages to groups etc. They’d have to approach ProtonMail, then your VPNs in order, and then get security footage from the place where you were accessing the VPN at that time. And then cross-reference your gait etc. to a database. Maybe in 10 years they would have such coordination, and we will need better tactics.

What’s far more interesting is what to do if VPNs are banned in a country. You can’t be using one there. You’d have to have set up anonymous hosting and port forward stuff yourself.

Again, it’s possible that all anonymous hosting, VPN etc. is shut down and requires KYC by say 2050. That is why you must bootstrap from what are valid but essentially “compromised* accounts now while you still can, and hope they are grandfathered into the new totalitarian surveillance system. Buying phones on craigslist is one example.

Another example is those eyes Anderton installs in Minority Report, but security in that movie is like a bad joke, IRL he’d be outed instantly by his gait, heart patterns via wifi and so on. In fact they didnt even change the access keys after he ran LMAO

Re: Be anonymous

#182
post #150

Earlier quoted context omitted.

Kind of makes the concept of lists pointless, doesn't it?

~150 people commented on this post is manageable number. Narrow it down by sophistication in the topic.

Maybe I already did this and maybe I didn’t. Maybe it’s all armchair theorizing. Then again…

https://m.youtube.com/watch?v=wUJccK4lV74

https://m.youtube.com/watch?v=SYZqC7EGMfM

To not share how you secure anonymity is to rely on security by obscurity. Now I think it’s better to lay out the playbook using Kerchkoff’s principle so k will become far larger than 150. Remember… to improve anonymity, at some point you have to publish your private keys. And where better than Hacker News?

The playbook is yours. Improve it!

Step 1: try to break it. Post how you’d defeat the anonymization scheme. The threat model is that you’re all state level actors combined. I’d love to see what you come up with.

Re: Be anonymous

#183
post #104
post #68

Earlier quoted context omitted.

What you said and much more. For example, you buy a burner phone, but the place you bought it from, even if a second hand shop, had a security camera. Maybe they also record IMEI's before selling phones. Or you carry your burner phone together with your real phone. Or alternatively, you leave one at home when using the other. Both of these things can be linked by a sufficiently determined actor (FBI/NSA level). Or th…

You should just assume a "real phone" is rooted by the FBI and functions to track your movements 24/7, accurate to the meter, is capable of remotely enabling mic/camera and all sensors, including WiFi, accelerometer, GPS, etc. Because even if it isn't, the software on it already (system software, apps, everything) already does a massive amount of snooping, distilling, and uploading. The feds "enabling" targeted surve…

Charles Stross has a book series about a family of people that can step between different timelines of alternate Earth's that explores this a little.

**SPOILERS** Once the US that's basically our world discovers the existence of "world walkers" when they nuke the Whitehouse, it quickly steps into an authoritarian surveillance hellstate capable of realtime surveiling the population around the country to the point where they can track people entering their timeline because they were on camera exiting a building they were never recorded entering, or were flagged buying a plane/bus ticket from a city they shouldn't have been in according to previous records, or in one case for leaving a coffee shop with a noticeably empty backpack when she'd entered the shop with it completely full, having passed the contents to a world walker she was meeting. That irregularity automatically flagged everyone entering/leaving that building for review in their system and they backtracked all of these people through their paths that day until finding the gap where he'd stepped through to their world. That all happened in a matter of minutes and then quickly homed in on him.

Anyhow,it goes into detail about the lengths they go to to avoid detection by these systems and honestly didn't strike me at as all farfetched. The technology and capacity exists and it's a concentrated effort on part of the government is all it would take to implement it.

Re: Be anonymous

#184

Feels like the article is slanting this Alex guy as a hero of sorts? I don’t like the tone of the article and wish I hadn’t clicked on it now..

Who's more harmful, someone who facilitate the selling of illegal items or those who define what is legal? In a lawless society what this guy was doing would have been a respectable trade like any other.

You can twist your way into thinking any very bad thing or practice isn’t so. We can extend your line of thinking to murder and rape— does that sound acceptable too?

No, this guy was much worse and more harmful than the norms of our society and those that propagate those norms.

Re: Be anonymous

#185
post #38

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could e…

VPN providers can also be compelled to share all logs, even if they say they don’t log your info or activity, there are court cases that prove there are weaknesses in VPN providers, whether it was the method of payment you signed up with or if they logged your meta data on sign up, location services and telemetry from a mobile app backend etc.

Privacy is never a guaranteed thing when you introduce ubiquitous computing to the mix, even things outside of computers can profile you like being captured in CCTV around the time when your signals are picked up from a computer/smartphone phoning home or unusual internet activity, like the scene out of Mr. Robot.

Re: Be anonymous

#186

Earlier quoted context omitted.

~150 people commented on this post is manageable number. Narrow it down by sophistication in the topic.

Maybe I already did this and maybe I didn’t. Maybe it’s all armchair theorizing. Then again… https://m.youtube.com/watch?v=wUJccK4lV74 https://m.youtube.com/watch?v=SYZqC7EGMfM To not share how you secure anonymity is to rely on security by obscurity. Now I think it’s better to lay out the playbook using Kerchkoff’s principle so k will become far larger than 150. Remember… to improve anonymity, at some point you have…

> I’d love to see what you come up with.

Nice try, Feds! :P

Re: Be anonymous

#187
post #63

Earlier quoted context omitted.

I think with ML getting smarter and people posting (either with their identity or anonymously) more and more content, it will be trivial to crossmatch anonymously posted content to real identities by ML examining "styles" of text: from punctuation to sentence structure to vocabulary use, and it will have an accurate estimation of who that "anonymous" person is.

This would be pretty easy to counter by having a tool that would analyze any comment you post and strip all the identifying marks out of it; no punctuation other than periods, no complex or compound sentences, all words replaced by equivalents from the list of the most common thousand English words, all voices and tenses normalized, no paragraphs, no capitalization, etc.

Yup.

Then it would again boil back down to who forgets to run that to get caught/doxxed.

Re: Be anonymous

#188
post #112
post #63

Earlier quoted context omitted.

This would be pretty easy to counter by having a tool that would analyze any comment you post and strip all the identifying marks out of it; no punctuation other than periods, no complex or compound sentences, all words replaced by equivalents from the list of the most common thousand English words, all voices and tenses normalized, no paragraphs, no capitalization, etc.

That's a bit of a nightmare for communication, though. Subtlety is a thing, both for nuance and clarity.

There is another side of the coin though. If the "countering" software is smart enough to analyze the semantics and the meaning of the sentence (which I think will definitely have the ability to), it can easily convert it to an intermediate representation and create an actually gramatically correcy, good looking, easy to understand sentences.

It can even improve the original text, making it more clear and anonymous-style.

Re: Be anonymous

#189
post #38

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could e…

>> If you're in e.g. Brazil, haha, yeah, good luck spending bitcoin or any other crypto and going unnoticed

South America is the greatest tumbler of all. I spent years in Argentina under the currency restrictions and paid my rent in Bitcoin, bought USD and pesos at black market rates in Bitcoin, all with people I met on localbitcoins and never using an exchange. I don't know about Brazil, but there is a huge market for peer to peer BTC in AR and UY, and you can just trade an envelope of cash over the table at a Starbucks in Buenos Aires for anywhere up to $10K USD.

In the USA I would be scared of being on camera, but I really doubt you would have that problem if you meet someone in a bar or on the beach in Brazil.

[edit] Just to explain this comment for people who think of BTC as something that you have to buy or sell on an exchange where you're allowing the endpoints to be tracked; the original reason for cryptocurrency was that you don't have to show your passport or link it to a bank account. That still obtains in lots of places in the world where people will happily give you their shitty paper money for bitcoin, and you can use the paper to pay your rent. Don't buy BTC on an exchange, and don't sell it on an exchange. Buy it from someone in person in a phone-to-phone transfer, or win it in a poker game. Keep it in a private wallet, not an exchange. Sell it P2P in person when you want to. You don't need to use an exchange at all.

Re: Be anonymous

#190
43 bits.

It requires 43 bits of defining information to identify a single entity online.

Those bits might be your name and date of birth.

Or they could be your home and work postal code (effective for better than 90% of the population, at least when commuting to work was a thing).

It could be your activity patterns, and what that says about your sleep/wake cycle, and possibly travel patterns.

EFF's Panopticlicck found enough distinctive information within Web browser characteristics to uniquely identify the vast majority of people submitting data to the project.

If you want to duck most casual observation ... then yes, standard precautions can be effective, though it's quite likely you'll slip and leak information at some point. Those clues can wait years, or decades, to be unraveled. Against law enforcement or state-level actors, you'll probably need to try considerably harder, though it's helpful to realise that what such entities have is typically far more data and the motivation to look through it for patterns and correlations, rather than superhuman cracking skills.

An area that's been of interest to me for some time has been the question of just how many investigations might be possible under various security or investigative services. My suspicion is that capabilities are constrained --- that is, there are fewer investigations than one might think --- but that the resources which can be brought to bear are considerable.

As an example, the US Federal Bureau of Investigation had a 2019 budget of $9.6 billion, with 13,412 special agents and 20,420 support professionals, as of 2009.

By news stories, the January 6, 2021 investigation has been the largest in the Bureau's history, with 350--400 arrests and 1,300--1,500 grand jury subpoenas.

I haven't seen data on how many investigations the FBI conducts annually, or how many cases are submitted for prosecution, but suspect it's on the order of thousands. The Bureau no longer seems to produce blunt gun-in-your-face reports typical of the Hoover era as with the 1969 annual report showing a chart of convictions by fiscal year (over 13,150 for 1969, here: https://archive.org/details/FBIAnnualReport1969/page/n5/mode...), though I suspect levels are at least roughly similar. That was an average of three arrests per agent, and the 1969 report states 2.8 million name searches were conducted that year, along with 2.6 million pieces of mail and 241,000 telephone and telegraph communications.

Post reply on HN