[I realize I’m a little late to the party, but I wanted to finish my series of posts about GenCon before posting thing… There’s been a flap lately over anonymity on the internet – inflamed most recently by Google+’s Real Names policy. This isn’t the first time this debate has erupted – Blizzard’s RealID policy was another instance of this argument. Since anonymity can be important in activist circles, feminism included, I wanted to post about this issue – but I figured that everyone else out there has pretty much said everything I’d say about the importance of being able to choose anonymity in social networking.
Enter my friend, Aaron, who made a comment on G+ about “some day” writing a primer on internet anonymity. Internet anonymity isn’t exactly in line with the focus of this blog, but it’s not completely tangential – so I challenged Aaron to write the primer so I could post it here. Thankfully, he was kind enough to do so.]
I told Wundergeek that I’d whip something like this up because, as she said in reply to a rant of mine RE: google+ and their Real Name policy, it might be of interest to people in activist/feminist circles. I’m a person of limited talents, but I think this can actually do some good for someone.
Intro
So you want to be anonymous and safe online or with your fancy computin’ machine? Well, I’m here to tell you that you can’t. Not 100%. It just isn’t possible for the average person.
*sadtrombone*
However, good news everyone!
You can, with a bit of forethought and some knowledge reduces your risks greatly. Really, when security experts (and leet haxxorz) talk about being anonymous, they’re talking about reducing the risk someone will be caught at thing X as much as possible by controlling and minimizing what tracks they leave and/or by making finding them or their data so ridiculously complicated and expensive no one will really bother.
Warning!
None of my proceeding suggestions are fool proof. Nor do you have to use all of them. I figured I’d give a bunch of topics because it’s all basically related and you can mix and match the suggestions for whatever your anonymity needs might be.
Also, for the other IT folks out there, I’m sure you’ll disagree with some of this. You may think I skip over things or don’t go in-depth enough. To that I say this little article isn’t for you. This is the “good enough guide” if you will. Feel free to disagree with me if you’d like. I don’t really care. I’ll only mea culpa up in here if I’m actually, factually wrong.
The Three Basics
For the average user with access to average user resources, there are three points of anonymity that most people need to concern themselves with:
- Internet Anonymity
- File/Data Anonymity
- Network Anonymity
Sure there are other points to touch on, but these are the big three I’m going to discuss.
Also, there is one BIG FAT CONCEPT that should be understood over ANYTHING ELSE:
IF SOMETHING YOU’RE DOING ONLINE REQUIRES ANONYMITY, ALWAYS TAKE ACTIONS KNOWING THAT NOTHING YOU DO IS 100% ANONYMOUS. I can’t stress this enough. Be paranoid. Always. Assume that you aren’t going to be 100% safe. Always weigh your risks for EVERYTHING. If you don’t feel comfortable doing something online that is sensitive, then don’t. None of the stuff I discuss will totally eliminate risk.
The same can be said about privacy. If things related to your real life need to stay private, don’t risk them online. BE PARANOID! It seems silly and over-blown, but it’s true. No one is going to watch out for you online but you. Period.
Internet Anonymity
When I say that, what I mean are things like; how likely are you to be tracked by your browsing habits? How much of your personal data is online and how easy is it to be discovered? I’ll bet you it’s more than you think. I’ll bet you leave bits and pieces of your personal life and browsing habits all over the place without knowing it. It’s easy to do without realizing it and the deck is stacked against you.
Not to fear. This is probably one of the easier things to deal with.
First and foremost, let’s get social networking out of the way. If you use any of the big social networking services, you’re already opening up a HUGE vector of anti-anonymity. It’s one thing to sign up for a wordpress blog under fake credentials, or start a twitter feed under an alias, it’s another thing to sign up for Facebook or Google+ account under the same. The whole point of Google or Facebook is to share your pictures and links and what not with your friends and family. This of course flies in the face of being anonymous. So, here’s my recommendation:
If you cannot, at all, afford to have your real identity online…don’t use Facebook or Google+ or any other similar social media site.
I know, it’s sucks, but you’ll have to deal with the morass that is social media privacy policy, or lack there-of, and risking a slip up that makes it easy to learn things about you; bad if you’re trying not to be stalked or harassed. Only you can make that choice, but if you simply cannot have your real life online, don’t use them. Even making up fake credentials doesn’t make things much better. Always remember that. ALWAYS BE PARANOID.
However, if you don’t need to go to that extreme and want to utilize social media, then there are some things you can do.
Don’t use your real identity for things like blogging or tweeting. Keep a separate, walled off identity. Don’t mix them up, ever. Only let trusted people in on your persona.
CAREFULLY think about who you “friend”. This is one of the big ones. If you don’t know the person 100%, don’t accept them as a friend flat out. Don’t put them on a lesser list, just ignore them.
READ all the privacy settings carefully. And not just the settings, the policies too. Show of hands, how many people know that Twitter has the right to allow third-party advertisers to use your tweets without your permission? Yah. That’s the kind of stuff you might not know about. There are some interesting things in privacy statements and user agreements. Be mindful of them. And by be mindful, I mean, be paranoid.
Use the concept of Least Privileges when figuring out what people can or cannot access. Only give out the VERY BARE MINIMUM access to people based on what you want them to see. For example, start with the concept that everyone has zero ability to see anything on your account/profile and only give the minimums to those you deem necessary as they need them. Revoke permissions/view options/whatevers when that person no longer needs them. REVIEW YOUR SETTINGS OFTEN.
Don’t trust the companies, but trust third-parties even less. I’m looking at you FARMVILLE and Facebook quizzes. “But Aaron!” you might say, “How will I water my crops and get my Farmville fix?!” My answer is: Don’t if you value your privacy. These types of things are paid for by mining your data and profiles.
ALWAYS, ALWAYS, ALWAYS (xINFINITY) be mindful of what you post and share. I can’t stress this enough. Srsly. Don’t be the person that makes a public post to their tweets that they’re going on vacation. Don’t put your address and phone number in your profile if you have a crazy ex that might try to track you down. It’s not worth it. You might think you’re being extra careful with your privacy settings, but all it takes is one of the famous Zuckerbeast’s changes to Facebook policy to show it all to the world without you realizing it.
Even if you don’t do the social networking thing, there are other things you should be mindful of while using and cruising the ‘Tubes. Things like Cookies and other internet tracking files or your browser history.
I won’t bore you with what cookies are or what their purpose is, nor will I drone on about browser history since most people are probably already familiar with them. I will say, that everyone should at least understand that your browsing history is pretty much slathered all over your computer like butter in a Paula Dean recipe.
“But Aaron!” you may say, “I’m not a durty pervert who searches for porn?! What do I care?”
True, but what if you’re, say, a transgendered teen living at home and your family is full of religious bigotry and you’re looking for support groups? What if you’re in an abusive relationship and are trying to find out information about local shelters? There are many good reasons one might want to clear out their browsing history.
IMPORTANT: I have to take an aside here for a sec. There is one REALLY, REALLY, REALLY important thing you have to know and that is, for all the cleaning of browser history you can do, if you’re online there are always way to see your traffic. The stuff I’m about to talk about will make it so it’s tough for someone AT YOUR COMPUTER to see where you’ve been. None of this will deal with the fact your network connection to your ISP can reveal other things about your internet usage. We’ll deal with that in Network Anonymity.
Anyway, you can manually clear your browser history yourself. Many people have written tools to automate this, but I’m a big fan of any job worth doing is worth doing yourself. That and I’m paranoid. Your call, your situation. I has links for how to do this manually. Let me show them to you:
Also, keep in mind that many of the modern browsers have “secure modes”. All of the latest versions of the browsers mentioned above, at the time of writing, have this. Some call it different things, Incognito (Chrome), InPrivate Browsing (Internet Explorer), whatever. What’s great is these modes make it so the browser doesn’t even collect history and cookies and things of that nature, so you don’t have to worry about clearing them when you’re done browsing, provided you had that mode enabled. Pretty slick!
We also need to have a talk about passwords. I could go on and on about passwords. Other people could go on and on about what makes good secure passwords. I won’t bore you with that argument. With I will say is:
YOU NEED TO USE DIFFERENT PASSWORDS FOR EVERY SITE.
Srsly. I had a good online friend who, many years ago, had his life turned upside down by an angry controlling ex. He left him and the ex figured out my friend’s email password…which was the same as his bank password, and his MySpace password, and the one he used at all the forums he went too, and the one he used at work; etc. etc.
Not a good thing. Make a different password for everything.
Lastly, if you’re doing the whole “persona separate from real life” thing, always be mindful of what you post under your persona. It’s really easy to get comfortable and slip up without realizing it and blowing your cover. Ask every teenage hacker who’s had the FBI come knocking at their door. Most aren’t caught because the FBI used super computer science; they were caught because the brat gave up info without thinking that tied them to their real life. The same is true if you want to separate your private life from your online life to foil trolls, stalkers, and harassers. Double check the profiles. Even things seemingly innocent like hobbies can be a giveaway to someone who’s dedicated time and effort into harassing someone.
File/Data Anonymity
Think your files are safe? Think your data is safe from prying eyes? Think again. You’d be amazed at the amount of data that files hold. Pictures, for example, store all kinds of juicy things as EXIF data, including in the case of some phones and cameras, geolocation. Office documents, pdfs, spreadsheets; all sorts of things can hold data that can identify you. This junk is called Metadata. Not a big deal (it can even be personally useful) until you’re posting information, say, about unethical practices about your boss on your anonymous blog and your employer uses metadata from a posted .docx file to find out it was you. Oops. Now you’re fired. Or worse.
Fortunately, most common file formats have pretty easy ways to remove their metadata. I won’t go into detail since every single format is different, but googling something like “removemetadata” will give you hundreds of results, utilities, and tools.
Metadata isn’t evil really, it’s there to help you organize your data in your OS amongst other neat things, but be mindful that it exists before you share your files online and make the decision if you need to strip the metadata out before sharing.
So, now you know how to strip out identifying information from your data, what about the actual data on your computer? How do you make the stuff you want to keep safe? There are a few things you can do here too.
First is the idea that your data needs to be hidden or otherwise stored in a way that others can’t (easily) get to it. To do that, there’s no better way than file encryption. File encryption is simply the scrambling of data in such a way that without the proper credentials, the data is nothing but gobbledy-gook. Very handy if you have files to store that you need people to not be able to access.
The simplest and easiest way to use file encryption (I’ve found) is TrueCrypt It’s free and it allows you to set up encrypted areas of your drive as a virtual drive on your computer for Windows, MacOS, and Linux. When you store things in these areas, the data is encrypted and safe and untouchable unless the proper password is given. How to do that is located here:
BAM (ok, so I nipped that link from Western Washington University…)
Setting up a secure area on your computer for safe storage takes some careful reading of the above link, but it’s nothing difficult. Keep in mind, that the above is for Windows, but beyond the “how to install” sections, the actual setting up of an encrypted space is pretty much the same for, say, OSx.
Alternatively, you can also find little USB sticks that have encryption built straight in. These are nice if you need to travel and use your drive on other computers. Best part is that even if it’s lost or stolen, your data is still ok! Kingston makes the DataTraveler Locker+ series which is very affordable. They’re nice if you’re not comfortable setting up something like TrueCrypt.
Yet again, you may ask, “why is this needed?!” and I’d respond that if you’re doing any sort of activism, there’s always a potential need to have your data confidential. Or if you need to hide information for a good reason; see the person leaving an abusive relationship. Everyone has the right to privacy of their own data so it’s worth having things like encryption, especially when you have the specter of reprisal hanging over your head.
The opposite end of this topic is data destruction. Deleting a file in pretty much all operating systems only deletes the “pointers” the OS uses to show where the file is and just leaves the file in the free space of the drive. Eventually it’ll be over written enough that the file is no longer recoverable, but that takes a long time. A very, very long time. It’s trivially easy to recover newly deleted files and there are tons of utilities out there that do just that, for free.
While it can be argued that nothing short of chucking a drive into a volcano will truly destroy data, you can destroy data enough that recovery will be a pain in the ass and so expensive, there’s no point unless you’re a huge government agency that can toss millions of dollars and years of computer time at the job.
Enter Eraser.
Eraser is a Windows program that will keep over writing files, multiple times, until they’re neigh recoverable without huge amounts of time and money. You can use it on specific files you wish to get rid of, you can use it on the Recycle Bin when you empty that, or you can even use it to wipe all the “free space” on your drive. It’s a powerful tool, but a useful one if you have data you need destroyed.
There are similar programs for Mac, but I’ll be honest that I don’t know much about them. I’ve heard tell that newer versions of OSX have a “Secure Erase” feature for the Trash and that Disk Utility has the ability to wipe free space, but I’m not a Mac anymore, so…
Beyond those things, and I’m sure you’re tired of me saying this; the biggest thing to remember is to BE PARANOID. You’re the only one that can make your data secure. Don’t share it with people you don’t know. Be sure people you share with are who they say they are. DON’T take anything for granted.
Network Anonymity
Finally, we get to the toughest of all; Network Anonymity. By the very act of connecting to the internet, you’re making yourself potentially trackable. Your ISP assigns your computer (or your cable/dsl modem) an IP address. This address can be logged. This log can be read. See where I’m going with this? By connecting, you are leaving a big marker saying, “I was online from this time to this time with this specific IP address!” and anyone that looks can see where you’ve gone.
Now, that seems scary (and it kind of is), but keep in mind that for the most part, the ISP is the only entity that has this data and under normal circumstances, no one else has access to these logs. However, different ISPs have different policies, so you have to make sure you read and understand them. Some ISPs don’t log at all, most do. Some don’t match account information with their logs, some do. Some keep the logs for only a short time, some retain them longer. The point is, they’re all different, and if you’re worried about your ISP tracking your internet usage, you’ll need to bust out the magnifying glass and read the policy for your ISP.
For most of us in the US, Canada, and a lot of Europe, this isn’t a huge deal. ISPs usually don’t freely give up their logs without a legal fight from the authorities, but it’s something to keep in mind. If you live somewhere with a more totalitarian government, they might feed the logs directly to the authorities all the time. Point is, be aware. Do some digging and research.
And it’s not just the ISPs that can hold on to your network data. Right now, I’d wager over half the people reading this are using some sort of network gear on their home network to deliver wifi to their wireless devices. These routers, switches, and hubs can log traffic as well and allow someone to see what and where you’re going online.
“Ok” I hear you say, “I get someone living in a dictatorship, and I was with you on the other stuff, but srsly, this is over the top paranoia! I don’t do anything illegal to warrant this!”
What about a neighbor who’s trying to sniff your wifi network in hopes of breaking into your computer and taking over your webcam to spy on you? Funny? It happens. A dude in California was doing just that so he could look at women in their dorm rooms by taking over their web cams and streaming the feed back to his computer.
What about an abuser who snoops on someone’s web usage using logs from a router? Or intercepts their communications? It happens and it’s not as rare or difficult as most people think it is. With dedication, Google, and a couple hours ANYONE can do this.
Unfortunately, masking your network connections is difficult. There are a couple good ways to go about it however. First, the easiest:
Use a different network.
Go to a coffee shop with free wifi. Go to a hotel. Sit outside a car dealership. Steal it from your neighbor’s unsecured wifi hotspot. There are hundreds of ways to get free wifi anymore in even the most backwoods of towns, many are wide open or can be used with a made up email address.
Granted, I don’t suggest you do this constantly for various ethical concerns, but if you need easy access to the internet that’s not obviously coming from you, it’s an option. Keep in mind, what you do on the internet while connected can still potentially identify you, but you’ll have to weigh your risk vs. your needs.
If you need more than that or just need to straight up hide your internet use in a mostly secure way, then you need TOR. TOR, in a nutshell, is a large network of servers that work in conjunction with a TOR client on your computer. Once installed and configured, when you turn TOR on all your internet traffic flows through the TOR network, over your internet connection. It’s fairly complicated how it works, but the gist is that your data and your locations are pretty well hidden, so it’s pretty freaking hard for anyone to figure out what your traffic is and where you’re going/what you’re doing on line. It’s not 100% perfect, but someone would need a lot of time, money, and dedication (and real compsci know-how) to bust through TOR. For the average person, it’s about as safe as you can get.
TOR can be had here.
Setup instructions and use is here.
The TOR bundle is the easiest and fastest way to use TOR. It’s literally just a browser with TOR preconfigured. I’d go with that if you need TOR but don’t have the patience to fiddle with settings. TOR is very powerful (though slow sometimes) but it’s a way to keep your online activities private and your traffic safe from snooping eyes.
Keep in mind, that in order for TOR to work you need to change some habits/understand a few things. This link explains them. VERY IMPORTANT!
Outro
So, there you go a crash course in basic anonymity. I didn’t touch on email, because frankly, most people know how to set up fake email accounts or use an anonymous mailer to send things (keeping in mind that their browser habits and network connections might still be tracked and act accordingly using this new found knowledge, of course).
These subjects have whole PH.d programs dedicated to them, so there’s no possible way I could be that detailed! However, I hope that the links and the basic concepts will not only help, but provide a direction to more detailed information should people want or need it. Sometimes, just knowing some very basic concepts gives someone enough to now know what to punch into Google.
Anyways, I don’t know how Wundergeek will share this info. I’m assuming on her blog, so I’ll monitor comments. Feel free to ask me anything. I’m an open book.
Also, I do declare all my personal type-y words here-in public domain *poof*
Oh, hey look. It’s a scantily clad nubile young woman who will kill lots of stuff while wearing next to nothing. A thinly veiled platform for a combination of fanservice and violence – how original! Unsurprisingly, some people have taken exception to such a ridiculous character and pointed out that this game concept just might be a little sexist. Which is where gamer entitlement comes in.
Charming.
These are character class designs from the upcoming Namco/Bandai title – Dark Souls. And I feel like I literally cannot express how much I love these designs and want this game to be a good game. I mean, holy shit, people! The women are wearing exactly the same outfits as the men. THE SAME. When does that happen? Never. Or almost never. I’m over the moon.
Go Make Me a Sandwich 