I have imported and run Whonix - Anonymous Operating System appliance in my VirtualBox. I am seriously excited about anonymity that given by this OS. How can I trust and verify the anonymous state of this OS?
No, but it helps a lot.
Your usage habits themselves, what time you use a computer, common sites you visit, even the speed at which you type certain phrases, and the phrases you use all help to paint a digital fingerprint which can be used to identify you as a user.
This may not happen in real-time as some correlation is involved but if you frequent a site like Stack Exchange and always create new accounts at a certain time, post a three sentence question to security, then view tor.stackexchange.com, bricks.stackexchange.com, and then finally blender.stackexchange.com in a fairly repeatable pattern. An organization may be able to correlate your current activity with your past activity before you were using Whonix or even when you did the same pattern from your cell phone on vacation. These human patterns are not really as anonymous as you would think.
Similar things happen to different types of users. For an attacker, they may always do a specific type of recon first or check for new exploits before working. A journalist may read a news website or two before communicating with a whistle-blower. Basically, the things you do, even with Whonix and Tor eventually reveal some things about you. So no it's not perfect anonymity.
This said, the more you know about this tool the better you will be at using it. If you are just looking to avoid your local ISP from recording your traffic this will probably work great.
Anonymity is like security on one point: perfection exists in neither, except on a non connected system in a secure building. As soon as you exchange information, you give something and receive something other. So you should be aware of:
- what contains what you send outside, and what is the risk at that level
- what channel(s) you are using, and what is the risk at that level
- what do you get in return and how does it change your platform (cookies at first sight, but more importantly trojans or other malware)
- most importantly: what do you want to protect, and from whom
In short, if you cannot understand what a system adds to your privacy, you cannot trust it. Simply because you could inadvertantly break a rule and expose something you do not want.