Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I am using VPN service to protect my identity, can my traffic be used to identify all my traffic?

For example, if I am accessing two services:

  1. Some service A, where I do not leave any identifying information.
  2. My personal E-Mail account.

Can someone find a relation between (1) and (2), such that he will be able to tell that both are accessed by the same person.

Naively I would think that it is impossible and someone would at most be able to tell that I am using VPN provider to access my E-Mails, without knowing about (1).

But perhaps my computer, browser or something else leaves some kind of signature in the data, which would enable someone to find a relation?

share|improve this question
    
It's difficult to answer this question with 100% certainty... without knowing additional details about the type of VPN. In the most common VPN technologies, (ipsec+l2tp, pptp, openvpn, etc...) the default behavior is that ALL traffic is routed through your VPN gateway... meaning that ALL traffic generated by your workstation appears to come from the remote network. So, accessing your email or accessing work-related stuff is all the same thing. Some VPN technologies only route connections to a very specific application (sslvpn) to the remote network. Some config options can change all. –  TheCompWiz Jul 30 '12 at 21:32
    
While not directly VPN related, encrypted traffic can be statistically analysed to identify the type. Theoretically, you could link traffic patterns and behaviours in this way (adjusted for encryption overhead) This link: caia.swin.edu.au/reports/090914A/CAIA-TR-090914A.pdf is from a uni lecturer who specialized in telecom interception. Interesting read. –  NULLZ Mar 5 '13 at 5:13
    
use prepaid debit card with no name - you can find them any where, pay for VPN with that. use 3g internet sticks with prepaid internet SIM inside, charge it with cash at designated stores That's max anonymity - even if they trace your IP - it doesn’t give them any name or address. after a while throw the SIM and buy a new one, does anyone see any setback with that? –  preston Oct 13 '13 at 12:03

8 Answers 8

up vote 11 down vote accepted

This depends on whether you are worried about being convicted, or dealing with probable cause (in the U.S.).

Let's assume that you are at home. You start up your VPN and connect to your offsite VPN provider. If I am monitoring outgoing traffic (from your house), I know that you just connected to a certain IP address, and that the IP address is a VPN provider. Everything inside the payload of the packet is encrypted.

You then decide while at home, to check your email. I happen to be monitoring outgoing traffic from the VPN provider (which is not encrypted). I record it all using snort, and run Wireshark against the output. I see a connection to your email address and an email written. This may be protected by SSL if it's webmail. If it's regular email, it's likely plain text. If it's not plain text, I can try to intercept it at the receiver. The email is of no legal significance (i.e. you aren't using it to plan something unlawful). However, I make note of the fact that you confuse the use of their, there, and they're. I'll also notice a few idioms you like to use.

Over the course of monitoring outgoing traffic I see your account write several emails. I note patterns of misspellings, and more figures of speech. I collect these over a period of a month or two.

I then put the items that I notice into Wireshark. I add several things that you are known to say. Every time a misspelling occurs, or the use of an idiom (that you use) is found in the content of ANY packet that is outgoing from the VPN service you use, I view it.

Given another month or two I have a lot of data points. Some are sites you went to, others are not. The first thing I do is eliminate all of the data points that exited the VPN service provider while you were NOT on line (i.e. I didn't see you online from home, remember I started by monitoring that connection).

Then I look at the remaining traffic and see if I have any cluster points. Lots of recurring themes. Same subject matter over an over. I compare that to your unencrypted traffic, and your email.

I haven't applied enough filters to isolate you from the noise (people that use the same idioms/spelling errors you do), but I would have a good case for probable cause. If I have enough points of reference, it is just like a fingerprint.

Essentially I'm applying a Bayesian analysis to a corpus of work, to state something about the likelihood that I believe an exemplar to be a member of the set constructed by my suspect. The collection of works that I would compare to comes from any work that the suspect has publicly acknowledged they are responsible for. That analysis is well-known (and there's a whole statistics StackExchange site, too).

I'll let you answer, what would I come up with at this point?

share|improve this answer
    
Excellent answer. Thought provoking, too. –  Polynomial Jul 30 '12 at 19:59

What about this scenario..1. connect go to an internet cafe starbucks whatever, connect through hopspot shield as vpn ... free version. 2. bring up the tor browser from inside your true crypted partition. Now engage your bittorent client download to your encrypted true crypt partition.

But main problem as I see it with paid vpn and companies like webroot anonymizer is that all they will have your name and address when you pay them through your credit card. So how is that ever going to be anonymous? Obviously they will submit to any federal subpoena your info and any logs.

Clearly free vpns like hotspot free won’t know who you are if you’ve downloaded from a internet café and gone to another café to set it up and use.

As long as you’re paying in cash then how would they know? ….after all if it could be traced it would be the internet café isp and ip that would come up.

share|improve this answer
    
Would you please care to proofread your answer and edit for grammar, spelling and formatting? In it's current state, it is rather painful to read, and looks like some quality ingredients kitchen disaster. Thanks! –  TildalWave Jun 2 '13 at 12:35
    
Pay cash for a reloadable credit card. Set the address to a legitimate one anywhere in your country. Don't use the credit card to order goods shipped to your house. Don't give your real name. Just a thought? –  Everett Sep 20 '13 at 21:09

It really depends on your VPN provider.

For example, the vast majority keep logs of what IP's are assigned to what user - so really it's no different from connecting to your ISP apart from the fact that the computer to VPN providers traffic path is encrypted. If for example IP aaa.bbb.ccc.ddd was responsible for illegal actions a court order could retrieve the logs from the VPN, see it was registered to you, along with whatever other information they are logging about your traffic habits.

Now some claim they don't hold logs, and perhaps use features such as shared IPs to make this harder, and give each user on the shared IP plausible deniability that they were the party responsible for the traffic at the time of the incident. This makes it a lot harder to trace your traffic, and then it falls back on secondary analysis such as what was provided by Everett.

So in a world where VPN providers don't lie about their logging, it's possible to remain relatively anonymous (don't forget Everett's method only really picks up things unique to you, if I simply browsed a site and didn't interact it's not identifiable via this method). Saying that I certainly wouldn't trust it to the point of doing anything naughty. For example - http://www.informationweek.com/security/privacy/lulzsec-suspect-learns-even-hidemyasscom/231602248

share|improve this answer

Well this is very possible with datamining, I worked on a project related to the MIT Reality mining project.

In the reality mining project people were trying to find relations in behavior of people. Once you have a baseline of recurring or typical behavior of a user you can identify him with a certain certainty and this without looking to who the device belongs or what number he's using.

We were able, by just looking at a number of factors (I can't disclose which in particular, but we at least used the ones present in the reality mining project), with a certainty of 95% that person X is probably John Doe.

Now this principle can be applied to any type of information where you can analyze people's behavior. This means we can probably apply it as well when you are connecting from a VPN.

Datamining is used more than you think.

You also make say stuff about using a certain browser. Now there was a project as well (https://panopticlick.eff.org/) where analysis was done on what the browser discloses about itself. This was also a rather unique per person. (plugins, user agent data, ...) Behavior analysis is big business these days and probably something of the most scariest things out there :)

share|improve this answer

Yes, it is very possible.

A VPN can hide your "real" IP address, so e.g. someone monitoring a bittorrent swarm would have to send a notice to your VPN provider, instead of your real ISP.

You still have an IP address at the VPN end. If you visit service A, and your personal email provider, they will see the same IP address. If they share data (or a third party such as the government obtains data from both), service A can associate the visits from this IP address with your email address. This works the same with and without the VPN.

Unless they do NAT. But that would tend to break bittorrent. So they won't.

If you use TOR instead, you'll get something equivalent to NAT - because multiple TOR clients use the same exit node. It's supposed to change exit nodes every ten minutes. And they're serious about the browser-side privacy problem as well; there's a convenient TorButton extension for Firefox (and a downloadable bundle of the two).

share|improve this answer
    
So that your aware, TOR has been hacked: zdnet.com/blog/security/… –  Everett Dec 6 '12 at 7:29
    
Hmm, yes, that's a general caveat to TOR that I didn't mention. It's securable for online banking, webmail (you use https, right? - and facebook may prompt you to do the same nowadays)... "mixed" (unencrypted) content, not so much. So not really suitable for Windows users, hmm. (E.g. the standard way of installing Firefox is from http...) –  sourcejedi Dec 7 '12 at 16:38
    
The problem is, that the solution of using HTTPS does NOT fix what has been broken. TOR was an anonymizer. No one could prove you were accessing a location from a location. Even with HTTPS enabled, you can still see source and destination. All TOR will do is slow down your connection while not providing any security whatsoever. You may as well run HTTPS in a standard VPN tunnel provided by any VPN service out there... It'll be faster. –  Everett Dec 7 '12 at 21:06
    
"inject a little extra HTML code into the response going back to the Web browser". HTTPS. One of us is missing something here. (Note that I conceded "securable" not "secure", and that this meant Tor was probably unsuitable for most users, and hence the OP). –  sourcejedi Dec 9 '12 at 10:14

I really question how secure the VPNs are. Even if your VPN provider won't log you, your DNS, ISP providers can still track you. I would certainly not use Hidemyass. Sep 2001,FBI arrested Cody Kretsinger, a core member of LulzSec for hacking into the Sony Pictures website. London based VPN provider Hide My Ass (HMA) appears to have played a vital role in Kretsinger’s arrest. It doesn’t take too much imagination to see that VPNs can also be used for outright illegal activities, copyright violations and hacking for example. All VPN providers know this and, while their terms and conditions always state that their services are not to be used for illegal activities, they derive a portion of their revenue from users who signed up for just that purpose, something all VPN providers are aware of. If a provider does not log your IP address and does not log your activity while using their system, how would they be able to investigate anything? Even if they tell you that they won't keep logs, can you really trust them? I just don't think using VPN service to protect your identity is going to work.

share|improve this answer

Chances are they may not find the connection between this 2 accounts, if you really do not leave any trailing mark using the 1st method.

However, the website may know that you are behind the proxy. It is also very subjective, and very much depend on the VPN configuration and also if the VPN's IP was already being spotted and flagged. This could be easily being determined by check it via a few proxy detection list, such as, https://www.fraudlabs.com/demoip2proxy.aspx, and so on. Check a few to get the accurate result, as different providers have different data list.

Furthermore, try not to use email to communicate, as it can be easily trace back using the email header.

share|improve this answer

Sure. There are many ways that someone might be able to draw such a connection between your two accounts.

One simple way: they send you an HTML email with a link or inline image, that's hosted on the same domain hosting service A. When you click the link or load the inline image, your browser connects to domain A. If you've visited service A recently, your browser may still have a session cookie for your session with service A. So now service A learns the connection between your email address and your account on service A. Read about "web bugs" for more.

Preventing these kinds of identity linkages is challenging. Depending upon the level of anonymity required, the simplest way may be the following: when you want to use service A, boot into a LiveCD running Tor and access service A. While running Tor, use only service A, nothing else. While booted into your normal OS, never access service A. This keeps your "secret life" and your "public life" separate.

share|improve this answer

protected by Community Oct 13 '13 at 19:25

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.