Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say I connect to a specific proxy that I know will not keep information/data about who connected to it, and I go to a website and do something deliberately illegal. If the "middle-server" doesn't have any linkbacks or possible ways to determine who connected to it, can law enforcement still find out who did the illegal activity? How so?

share

4 Answers 4

It is technically possible in some cases, it depends on what exactly you are doing.

Some packets you send out, and this is more common on some protocols than others, contain identifying information in the packet itself. If you are using HTTPS (as one example) and you don't log in or out or significantly use cookies, it is very unlikely you can be traced. Same goes for all other protocols designed with privacy in mind. However, if you are using, say, an email server (SMTP) over the connection, your email address will be in quite a few packets, and it is very hard to encrypt the actual address and still get the mail to where it is meant to go, for obvious reasons.

share

In most scenarios it would be very difficult to trace you. As felixphew said, many protocols contain identifying information. I don't know how advanced your cryptography is, but basically when we send out requests ("packets") to the server, we include certain things about our computer (in the "packet layers"). Most, if not all of this information could be used to track your computer. Some if it can be changed (like your IP) and some of it cannot (like your hardware/MAC address). Your computer can be traced back to you via its MAC address if whatever store you bought it from saved that info. At the least one could easily trace you to within about 30 miles of wherever it is you live. Note also that if they act quickly and get the appropriate warrants they can dump your proxy's RAM and get your packets (and therefore your IP/MAC). Of course, they would have to be very fast (depending on how often the proxy is used). Just a couple of thoughts.

EDIT: I made a mistake and said "within 30 miles of where you live." First of all, I am mot totally sure of the distance, it depends on where you are. Second, I meant the access point, not where you live, so if you connected from an internet cafe 2 states out they might think you lived near there.

ANOTHER EDIT: I forgot, a bit more pressingly, that by using the ActiveX, JScript, and/or Flash Player plugins on your computer any site can get your IP by just asking for it - and because it is your computer that is running the program, it is your IP hat is sent to them (somewhat ironically through the proxy).

share
    
Generally speaking, your MAC address doesn't survive the first layer 3 hop as information that gets transmitted. –  YLearn Dec 15 '13 at 5:13
    
You also need to be sure your Proxy doesn't add the "X-Forwarded-For" HTTP header, which leaks your IP address. –  Matrix Dec 15 '13 at 9:14
    
Also make sure you're using proxy's DNS servers, otherwise you have a DNS leak. Check leaks with dnsleaktest.com –  Matrix Dec 15 '13 at 9:16
    
@YLearn Yes, but your your packet layers are stored in the RAM of the proxy so your information can be transmitted back to you. The servers the proxy connects to get only the proxy's layers. –  KnightOfNi Dec 16 '13 at 0:21
    
@user2945577, if the proxy is not on the local subnet in some way (not physically or tunnelled such as VPN), as the context of the OP's question would indicate, then the proxy does not see your original MAC address at all. The L2 headers get rewritten at every L3 hop. –  YLearn Dec 16 '13 at 2:46

If the network traffic is tapped on both sides of the proxy, it would be pretty easy for a government with a lot of resources to connect your traffic to you. By looking at things like data sent / received and timing of packets, it would probably be trivial to determine which user is making which request through the proxy. The more users a proxy has, the more difficult an attack like this gets, but may well still be possible.

That being said, most attackers won't be able to tap the network on both sides of a proxy, but if you are trying to hide from a government, all bets are off.

Consider the following example: I want to deliver an anonymous letter to a friend of mine so I drop it off in a post office box without a return address. Even if my friend was watching the post box all day, he still wouldn't know if I had sent the letter since many people use the box. However, if I am the only one that uses that post box on that day, my friend will have no trouble narrowing down who mailed the letter. The post box can be viewed as the proxy. If many people request information at the same second that you do, you are probably fine. However, if you are the only one (or one of 10) to request information during a given 3 second period, it would be easy to guess who generated the traffic on the other side of the proxy.

share

That protects you against remote tracking but not local tracking.

Someone who can see your traffic after the proxy cannot trace back to you. This means the site you are (theoretically) hacking can't trace you. This is assuming you don't do something stupid, like typing in your real email address, or presenting a tracking cookie that is linked to your real identity. It's prudent to use a separate browser for your anonymous browsing.

However, someone local who is monitoring your traffic can see exactly what you're doing. If the site uses HTTPS that helps, but even then they can see that you are connecting to the site in question. The fix for this is to use encryption between you and the proxy. This is why VPNs are better for privacy than proxies. And ToR does this automatically.

share

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .