Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be anonymous

kg.dev

Post reply on HN
Print view View original

221–230 of 260 posts

Re: Be anonymous

#221

Post by xurukefi »

cellis wrote: post #38

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could e…

Are there reported incidents where somebody was caught with such sophisticated techniques? It seems like every time I read about how the FBI caught some big darknet criminal it was pretty much always some trivial mistake on the criminal's side.

Re: Be anonymous

#222

Post by wallacoloo »

xvector wrote: post #52
cellis wrote: post #38

As careful as some of the things he suggests are...if you're truly wanted by a state-level actor or sufficiently motivated attacker, you won't be able to hide by simply using VPN and Tor. Especially if you're running something with many transactions like AlphaBay. You would need to obfuscate quite a bit more: - if you're using VPN traffic but most people "around" you aren't, you're a suspicious node; your ISP could e…

> keyboard frequency on anonymized accounts can be de-anonymized Whonix uses Kloak to mitigate this [1], but unfortunately it isn't available in Qubes-Whonix. > Mixers and tumblers will eventually leak Don't use mixers and tumblers, use Monero and/or Monero atomic swaps. But, you are right that it is futile to maintain defense against a determined 3 letter agency. [1]: https://www.whonix.org/wiki/Keystroke_Deanonymiz…

> Don't use mixers and tumblers, use Monero and/or Monero atomic swaps.

Monero doesn’t make your transactions anonymous, it makes them ambiguous. your wallet might default to using an n=6 ring signature, meaning it picks 5 random addresses with balances and creates a transaction that could have plausibly originated from any of those 5 or your own. so you get plausible deniability, but also if your threat actor can unmask the other 5 addresses (which might not be so hard if those accounts are regularly interacting with exchanges) then you’re done.

zcash gets you actual transaction-level anonymity, not just ambiguity. fewer places accept it, but in theory you can still break the link by obtaining zcash and then exchanging it for the currency of your choice on any exchange that doesn’t ask for PII (e.g. a DEX)

Re: Be anonymous

#223

Post by Agentlien »

Riverheart wrote: post #219
Agentlien wrote: post #216

Earlier quoted context omitted.

Most "anonymous" surveys I've been asked to take through work require listing more than enough information for unique identity. One assured I would be anonymous, then asked me to fill in the name of my manager, my team, and job title.

Fortunately mine have not but at a certain point they're useless because no matter no low the scores go nobody in their right mind wants to provide long-form feedback to identity actionable fixes because product teams are usually small even if there are a lot of developers in the pool your pain points will be unique to what your working on.

Yes, this is usually my experience as well. What makes sense for you to bring up identifies who you are. Hardly anonymous. But sometimes I've also been asked to explicitly identify myself as mentioned yet it's still supposedly anonymous.

Re: Be anonymous

#224

Post by nisegami »

notsoanonynous wrote: post #167
Riverheart wrote: post #125

Earlier quoted context omitted.

Not nearly on the level as what is being suggested but my company has had several anonymous surveys and I started thinking about writing style when taking them. If you're prone to certain phrases, words, use of contractions or lack thereof, especially when the pool of people is small and you're providing critical (but needed) criticisms, you could potentially be identified by your immediate supervisor. Introducing ty…

I am open to ideas for how to mitigate this remaining vulnerability even further

One idea I've seen is running through translation services. IE, convert to spanish and then back to english. But unless we have good offline services, it defeats the point.

Re: Be anonymous

#225

Post by tharne »

ethbr0 wrote: post #109
cellis wrote: post #71

Earlier quoted context omitted.

I would say that if you're caught and ... somehow manage to delete all the evidence linking you ( you have device explosives or, idk, 2048 bit encryption ), you may be able to escape, but come on, who are we kidding: the FBI has like a 99.96% conviction rate and that's without even going to into the "parallel construction" or other conspiratorial lines of attack.

The FBI has "like a 99.96% conviction rate"?

I don't know if it's 99.96%, but the FBI is well-known for making sure everything is absolutely airtight before making an arrest. Once they make an arrest, you can be sure they have more than enough evidence to convict and then some. When people do avoid a conviction, it's usually by testifying against others in exchange for immunity or leniency.

Re: Be anonymous

#226

Post by missingrib »

cywick wrote: post #211
missingrib wrote: post #103

Earlier quoted context omitted.

From what I remember about that case, he was one of 8 people who were on the network at the time, but the authorities told him he was the only one, leading to his quick confession. Meaning that if he had stuck to his guns and denied it there wouldn't have been a good way to prove he was the one who did it.

No, it just means they couldn't have stopped digging at that point. Having dramatically reduced the search scope to a small number of people, they would have just needed to find one other small piece of evidence to narrow down the group suspects further.

What type of evidence could they have found?

Re: Be anonymous

#227

Post by BbzzbB »

sockbot wrote: post #195
BbzzbB wrote: post #158

Earlier quoted context omitted.

>Anonymity is not on a spectrum Is it not, for the non-criminal user? My HN, Reddit and Twitter accounts are "anonymous" (pseudonymous would be more accurate), and it matters to me to the extent I share thoughts I would not on Facebook or if Googling my name lead straight to it - not that I'm ashamed of them, I try to be decent (tho I slip at times and am more brash than I would IRL), it's just that they hold some pe…

Changing the definition of anonymous to include pseudonymous is not a compelling argument that anonymity is the same as pseudonomity.

So, you know who I am or how to reach me? Send me an e-mail (or, better yet, dox Satoshi) and I'll take your point. I don't see how pseudonymity can't be a flavor of anonymity, even cyber-criminals who have every reason to remain truly anonymous online - as in hidden from FBI and gang - can pick some form of pseudonym so people can address them, Dread Pirate Roberts would be an obvious example (tho he failed to be anonymous to govs).

Per Wikipedia:

>Anonymity describes situations where the acting person's identity is unknown. [...] The important idea here is that a person be non-identifiable, unreachable, or untrackable.

Re: Be anonymous

#228

Post by Loughla »

panta wrote: post #210
d0gsg0w00f wrote: post #141

Earlier quoted context omitted.

In that vein you have to also prosecute alcohol distilleries, tobacco companies, fast food companies, casinos, lotto companies, ice cream makers, and any other company that makes something that people struggle to control their own consumption. And we do, that's why we have government. At least you have a recourse when these companies operate within the law.

There are some important differences. Alcohol distilleries didn't label/market their products as beneficial ailments intended to cure diseases. Pharmaceutical companies should be bound, at least morally, by the same hippocratic oath that govern the medical profession. Clearly they are not.

>Alcohol distilleries didn't label/market their products as beneficial ailments intended to cure diseases.

But they did? They just did it 100+ years ago. Does that matter?

Re: Be anonymous

#229

Post by zxcvbn4038 »

missingrib wrote: post #103
3s wrote: post #58

Earlier quoted context omitted.

You're absolutely right. It is not enough to use anonymity tools, you also have to make sure everything else around you doesn't compromise your anonymity. Made me think of a Harvard bomb threat incident where the student posting a fake bomb threat (through Tor) to avoid final exams was the only person using Tor on campus at the time, which trivially identified him. https://theprivacyblog.com/blog/anonymity/why-tor-fa…

From what I remember about that case, he was one of 8 people who were on the network at the time, but the authorities told him he was the only one, leading to his quick confession. Meaning that if he had stuck to his guns and denied it there wouldn't have been a good way to prove he was the one who did it.

It was indeed his immediate and voluntary confession that did him in. If he had not snitched on himself he would have just been a person of interest. He was one of several people who happened to be using Tor on the campus at the time, but that doesn’t mean anything, the person making the threat could have been someone in LA or Moscow or Beijing just looking to cause mischief and having no connection to the school at all. If he had kept his cool he probably would have gotten away with it.

Re: Be anonymous

#230

Post by Pq2Vvv8MtzTCFWS »

notsoanonynous wrote: post #102
3s wrote: post #58

Earlier quoted context omitted.

You're absolutely right. It is not enough to use anonymity tools, you also have to make sure everything else around you doesn't compromise your anonymity. Made me think of a Harvard bomb threat incident where the student posting a fake bomb threat (through Tor) to avoid final exams was the only person using Tor on campus at the time, which trivially identified him. https://theprivacyblog.com/blog/anonymity/why-tor-fa…

Tor is amateur hour. The Feds can easily deanomymize things where a server is up 24/7 servicing requests. The author of this article is also very wrong: Anonymity is not on a spectrum. It’s all or nothing. Like a Mario game where any mistaken encounter makes you start over (and that’s if you don’t get in trouble for what you did). First step is to understand that any system could be bugged. Every IRL confidant could…

To comment on point 5. The three spelling errors I caught tell me you are using a phone with autocorrect turned off.
Post reply on HN