Will hiding behind proxies protect you?
Using a browser-based VPN plugin can betray you if you have Flash, Java, or even other plugins installed. Anything that can get read/write access to your file system will betray your presence.
There has also been a recently-discovered exploit that affected users of private internet access, a VPN provider.
It's also not that difficult to track you online, even if you're behind a bunch of proxies. Why?
- Surfing with Flash Enabled
- Become a victim of Java exploits, or even legitimate Java programs.
- There are multiple tricks to reveal your network interface / computer hardware information. Unique serial numbers on devices are a thing, and this is one of the ways Microsoft attempted to thwart piracy, only to affect legitimate users the most.
- Signing into services/accounts that you normally use, while surfing anonymously.
- For example, keeping iCloud, Steam, Skype, or something else running, or even having Windows check for updates! These leave a huge crumb-trail.
- Using browser plugins with read/write access.
- Analyzing connection logs for recent activity. Metadata owns you.
User A connected to
Proxy A at
Proxy A connected to
Proxy B close to
X time at
Proxy B connected to
Proxy C close to
Y time at
- Your VPN disconnected you at an inopportune time, and you reestablished connection to normal services under your real IP.
- You are the only person in your neighborhood connected to TOR at that time.
- SSH Fingerprinting. It appears that if you're using a mac and your SSH connection reveals your serial number, you can be tracked this way. My theory on Device ID correlation can be better explained here, but I believe this is a perfect example of it in action.
Browser plugins in general will only re-route traffic to and from the browser's requests. That's it. If you're playing a browser-based game, then sure, I don't see why not.
Desktop games will not be redirected unless the browser plugin does some weird tomfoolery that manages to install an application on your desktop which does this.
some websites Trace your router's Mac Address and therefore identify your computer.
Now if I wipe my computer and install a new OS, browser etc and even get a new IP are websites still able to identify my machine? Like a unique Hardware ID or something?
Yes, Flash can enumerate your device information, and easily help track you this way.
And I figured that using Chrome will make it even easier for Google to identify that I'm using the same computer right?
Of course. Google Chrome Incognito used to phone home. I am unsure if it still does, but I don't trust Chrome.
So how can I avoid being tracked?
You can't 100% avoid it (exploits come and go) without going to absolutely extreme lengths, but you can make it a lot more difficult.
- VPN that kills the
Host OS connection if disconnected.
- Virtual Machine (
- No plugins, except essential privacy plugins.
- You'd probably have to disable images for good measure. From time to time, image libraries are exploited.
- For better results, use a VPN inside the VM, which is already VPN'd through your main system.
And this may not help much at all. Why? Because when you connect to Windows Update with a legitimate copy of windows, they know about your unique key / account, and Microsoft logs every single IP address for that particular key / account. This means you'll be associated with the first VPN connection, even if you're hiding behind multiple proxies and VMs.
But how does that help track? Every little breadcrumb counts, and anything that associates you with anything online can easily help the right people find you.
But what about Linux? Most distros phone home as part of an update process. Qubes is one of the few operating systems that I know of which won't do this.
There are so many different and creative ways to be tracked. Bottom line is, if someone really, really wants to find out what you're doing, there are so many different tools to do so.
So is there no way to remain anonymous online?
Take off your tinfoil hat. Reliably blocking yourself from advertisers is one thing, and not too difficult. 100% Blocking yourself from everyone and everything is only possible if the computer is powered off and unplugged.
If you're online, then eventually an exploit will get you. And if you're going to such lengths to protect your privacy, you'll attract the attention of those infinitely your greater.