Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a person uses VPN and authenticates herself to some social network through the VPN, doesn't she lose her anonymity for as long as the VPN session is used ? By losing her anonymity, I mean that her real name may be linked to the IP of the VPN and subsequently the IP of the VPN to torrent downloading (for instance).

Is this possible in principle? If yes, are there any workarounds or suggestions ?

EDIT: The title was somewhat deliberately sensational. Of course VPN have other uses besides anonymity, that can't be hurt in the above scenario.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

As noted, VPN tunnels permit secure and private communication through untrusted networks. VPN "anonymity" services, fundamentally proxies on sticks, can also provide limited anonymity.

However, using a particular VPN service for authenticated social-network activity irrevocably destroys whatever anonymity it had provided for the user. All usage of that VPN service from the user's ISP-assigned IP address is affected. Getting a new account doesn't help, given linkage via IP address and payment method. To the extent that the VPN provider retains logs, metadata for all prior usage is also deanonymized (even if content is protected via PFS).

If OP wants both "anonymous" and true-name authenticated activity protected by VPNs, she needs to use two different VPN services, and should carefully compartmentalize her activity between them.

share|improve this answer
    
Like having 2 independent VPN servers, one for example to socialize through online networks and another to e.g. do torrent downloading. –  Zet Feb 1 at 13:20
add comment

Indeed, anonymity disappears if you authenticate... using a VPN is like wearing a mask; people don't see your face and cannot guess your true identity. But if, wearing a mask, you shout your own name and proceed to demonstrate that you are really the person you claim, then your anonymity no longer exists.

When you use your VPN, you make it so that outsiders cannot see "who" you are beyond "someone who uses that specific VPN server presently". If, under this context, you authenticate on Facebook as "Bob the Supreme Warlord" then outsiders can say: well, there seems to be at least one user of that specific VPN server who is also the individual known by Facebook as "Bob the Supreme Warlord" (maybe Facebook knows more about the true identity of Bob). If Bob the Supreme Warlord used Facebook to publish photos of himself doing war supremely, then now the outsiders know Bob's face.

An interesting point, though, is that without the collaboration of the VPN server maintainer, outsiders can only see that "one user of the VPN server downloads this and that" and "one user of the VPN server connects to Facebook as Bob the Supreme Warlord", but they don't really know whether this is the same user -- but they can make guesses. For instance, if someone repeatedly uses the VPN server to engage into intellectual property theft, and another user repeatedly uses the VPN to connect to Facebook as Bob the Supreme Warlord, and these two seem to always be active at the same time, then outsiders (say, police forces) may use their brain cells and infer that Bob the Supreme Warlord might be Bob the Supreme Movie Downloader.

And, of course, any anonymity offered by a VPN server tends to evaporate like morning dew when the FBI knocks on the VPN sysadmin's door at 06:00 AM, and courteously but firmly suggests that flourishing connection logs might be a capital idea at that juncture.

share|improve this answer
    
There are VPN providers who, according to them, they don't log anything. I was more concerned about the scenario that Facebook, and not the VPN provider, discloses to some authority the information: 'Bob the Supreme Warlord' was online from that IP during that time period. If true, they can identify Bob in other activities, like torrent downloading. –  Zet Feb 1 at 13:11
    
Regardless of what providers say, it's prudent to assume that they all log everything that they can. –  mirimir Feb 3 at 3:00
add comment

It is worth pointing out that anonymity is not the only point of a VPN. It also serves to provide secrecy across an untrusted network. Even if you authenticate with a social network or otherwise identify yourself as the client on the endpoint of the VPN, it can only be accessed between the VPN end point and the services you are talking with.

It does leak your identity to anyone monitoring the end point, but doesn't make the VPN connection useless for other purposes.

share|improve this answer
1  
to just emphasize again: to use a VPN is NOT anonymity, no matter how much one wants or believe that VPNs provide it. –  akira Feb 1 at 13:24
    
Yes, VPN services provide "anonymity" to a very limited degree. Even if your provider is telling the truth about not retaining logs, perhaps its hosting provider is logging everything. That's what happened last year for an EarthVPN user. Even so, one can combine VPNs in nested chains, and so distribute trust over multiple providers. –  mirimir Feb 3 at 3:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.