Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently I have thought more and more about how to make my Internet traffic anonymous. Not for illegal reasons, but just to stop leaving information about me. The methods I know of to anonymize my browsing are services like proxies and VPNs.

I have thought about going the VPN way with services like CyberGhost VPN or vpntunnel.se. As far as I know the problem with proxies is that only http and https traffic will be hidden, but as soon as I use another program than my browser the traffic is not anonymous.

I thought about installing VirtualBox on my Windows 7 system, then running an Ubuntu Linux VM. I would then install the VPN client on the VM. Does that make sense? I am primarily concerned about the risk of virus infection on Windows.

The service vpntunnel.se advertises that it doesn’t store any user data besides the username and email address, but since they are in the EU I don’t know if they actually have to store anything extra because of the data retention laws.

Does anyone have more experience about this? Any ideas on how to make this scenario even more secure?

share|improve this question
1  
You're asking multiple questions at once here: How best to anonymize traffic? Should I sandbox my browser in a VM? Can VPN providers provide anonimity? How can I make VPN browsing more secure? StackExchange works best with one question at a time, so you might want to consider simplifying. (And maybe opening more questions as needed.) –  Graham Hill Apr 3 '12 at 8:31
4  
Of course, as D.W. points out, the answer to all these questions is the same: "Hello, I'm The Doctor. Basically, Tor." :-) –  Graham Hill Apr 3 '12 at 13:17
    
Just don't forget to test your setup with stayinvisible.com or similar. –  user9105 Apr 13 '12 at 10:32
1  
TorrentFreak asked several VPN providers how they protected their user's privacy. torrentfreak.com/… –  S.L. Barth Jul 6 '12 at 17:07
    
And all it takes is one small, insignificant slip-up or omission in detail to completely bypass all attempts at anonymizing your internet access. –  Fiasco Labs Nov 20 '12 at 21:36
add comment

8 Answers

Boot to a live CD containing Tor bundle, for the activities you want to be anonymous. Or, boot to a live CD and use a VPN.

See also:

share|improve this answer
1  
LiveCDs are not a great idea because they receive no security updates. Your system may become vulnerable in a few days. –  Shnatsel Nov 27 '12 at 11:41
2  
@Shnatsel: you can create updatable LiveUSB installations though. –  naught101 Dec 14 '12 at 3:19
add comment

As far as hiding IP address goes:

Tor does provide a decent level of anonymity but creates its own set of problems, in particular Tor users are a frequent target for traffic sniffing and man-in-the-middle attacks due to compromised exit nodes (see How much can I trust Tor?), so I don't recommend it.

Instead of Tor you can use I2P, which does not suffer this vulnerability because it uses a predefined exit node (or the one you manually choose), and the exit nodes are usually well-maintained servers, so they're way less likely to be malicious or compromised.

VPN is easily tracked down by traffic analysis - tracking packet sizes, network lag and timings, etc. Tor is more resilient to that, and I2P is supposed to be even more resilient but it was not yet investigated as thoroughly as Tor was. Cryptohippie VPN also takes traffic analysis into account and adds additional layers of protection against it.

However, obscuring traffic origin is just a part of the problem.

A web browser is ridiculously easy to track using browser fingerprints, even you've disabled cookies, JavaScript, and everything else you can disable. Panopticlick explains what browser fingerprints are and demonstrates just how easy is, and it's not nearly complete - BrowserSpy.dk lists much more ways of tracking.

VPNs and anonymity networks do not (and usually can not) do anything about your browser fingerprint. You can reduce tracking, but not defeat tracking.

Here's one simple scenario to consider. Every time you browse the web without an anonymity network, the browser fingerprint is sent out there from your real IP. The fingerprint-IP pair can be recorded. If you browse the web with an anonymity network later, your browser fingerprint stays the same - others can still recognize you. Moreover, they may have your real IP address recorded. You're no longer anonymous.

It's enough to go online without an anonymity network just once to blow your cover, both in the past and future, forever (until you significantly change your software setup).

So remember you're being tracked, and NEVER EVER use the same web browser with and without an anonymity network.

In fact, this is not limited to web browsers. Other applications may have a fingerprint too (e.g. BitTorrent clients do), but they are not researched as thoroughly as web browsers were. If you're going to use an application via an anonymity network, be cautious about its setup and make sure it goes into the anonymity network right away, without contacting with the "non-anonymous" Internet even once. Otherwise your attempts at anonymity are in vain.

To avoid disclosing your IP by fingerprinting and not bother remembering which app should be anonymous and which should not (while every mistake is grave), I recommend running anonymity-oriented Linux distros, like Tails or Liberté. This way you'll be sure which programs are anonymous and which are not, and they won't be able to leak their fingerprints into the "non-anonymous" Internet because these distros explicitly prohibit any non-anonymous communications. It's possible to run them in a VM, but better do on a dedicated machine to avoid hardware-based fingerpriting and use better random number generators.

Finally, tracking may be not application- or instance-specific; user accounts on websites uniquely identify you (duh). If you want to stay anonymous, you have to access your user accounts via an anonymity network either always or never. The easiest way to do this is to establish a different identity for anonymous browsing.

Control your data online

Remember, you are tracked. You can reduce tracking, but not defeat tracking. And you leave a lot of info about yourself as you browse, from what your interests are to what places you visit to where you live. For example, search engine history tells a lot about you and sometimes can uniquely identify you. Some other websites collect A LOT of info about you or force you to disclose it, and what's worse, they often disclose it to third parties.

For a start, use an anonymous search engine: ixquick, startpage.com (anonymous Google with slightly outdated data), DuckDuckGo or run a local seeks instance to be sure. There are some search engines available inside I2P network too.

Social networks are evil. You can either not use them altogether or own your data by using Diaspora.

Online map services are not necessarily evil, but they get important info about you. I'm not aware of any anonymous map services, but of course I recommend avoiding Google Maps. Perhaps OpenStreetMap tracks less or doesn't track, but I haven't checked.

Same goes for email, IM, etc. Communicate via SSL'd and non-logged email and IM or use end-to-end encryption via a web of trust.

Finally, try to reduce tracking. Use a browser that supports DoNotTrack HTTP header and enable DoNotTrack headers in settings. Use some tracking-blocker browser extension. Use Mozilla Collusion to analyze and disable tracking. Use DNSCrypt if you don't want your ISP to know which websites you visit, or at least don't forget to check for DNS leaks if you're trying to use a custom DNS server without encryption. Remember you're being tracked at all times, no matter what you do to get rid of it. Read privacy policies. Be paranoid.

share|improve this answer
    
You have links for everything but the 'browser fingerprint' concept. Can you expand on that? Would a 'browser on a stick' defeat that problem? –  schroeder Nov 20 '12 at 20:38
1  
panopticlick.eff.org provides a good explanation and a demo. I've updated the answer with a clarification on browser fingerprints. –  Shnatsel Nov 20 '12 at 20:44
add comment

OK, if you want to anonymize then use the TOR network, but you'd have to make sure you aren't signed into anything, you've cleared your cookies beforehand, and you don't sign into anything while on the TOR network... that's how you allow yourself to stay anonymous.

If you use a VPN it will mainly help by just taking any of your accounts and data and "you" as a computer user somewhere else on the planet. But it doesn't keep moving like the TOR network does.

If you use either method, ALL traffic from your network card is routed fhs TOR or the VPN.. not just the browser.

Hope this helps.

share|improve this answer
    
This will not help because of browser fingerprinting, see panopticlick.eff.org and security.stackexchange.com/questions/13416/… –  Shnatsel Nov 20 '12 at 22:27
add comment

I like to run an instance of Microsoft Windows Server 2003 or 2008 on Amazon AWS. You can remote desktop into an running instance and surf the web anonymously. Your IP address will change every-time you start your instance.

share|improve this answer
add comment

Ok, there is a downside to VPNs. For example, the VPN Service HideMyAss is alleged to have provided log information to law enforcement.

The justification HideMyAss gave was:

As stated in our terms of service and privacy policy our service is not to be used for illegal activity, and as a legitimate company we will cooperate with law enforcement if we receive a court order (equivalent of a subpoena in the US).

So a VPN will work for most legal use, but might not stand up against an investigation by the authorities. It is not just "talking about vpns" that might lead authorities to know who you rent a VPN from, but also paper trails such as payments to the company.

share|improve this answer
add comment

I have not used it, but there is a project called Tails that distributes a secure live CD that is "boot and use" easy.

It is essentially a collection of preconfigured tools (Tor, HTTPSeverywhere, OpenPGP), most of which have already been mentioned here.

Remember though, that you can easily leave traces even with all these precautions. It's all useless if you then proceed to post your name and address on a message board.

share|improve this answer
add comment

I use encrypted SSH tunnel connections with http://pirateray.com/proxy , I just run small application and change proxy settings in my browser, works good so far.

share|improve this answer
1  
He specifically asked for solutions that aren't just for browsers - what you describe would only give you (some) privacy in your browser –  Andy Smith Oct 4 '12 at 14:22
add comment

You may try to use Incognito Chrome while surfing the Internet with web browser.

share|improve this answer
2  
See this post: security.stackexchange.com/a/875/33. Incognito mode only anonymizes it on your end - it doesnt save history etc. This does not help solve the question at all. –  AviD Nov 21 '12 at 11:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.