1

I have imported and run Whonix - Anonymous Operating System appliance in my VirtualBox. I am seriously excited about anonymity that given by this OS. How can I trust and verify the anonymous state of this OS?

  • 1
    using it on a VM defeats some anonymity – schroeder Apr 26 '17 at 8:07
  • Please explain a bit. – Anuruddha Apr 26 '17 at 8:16
  • 2
    Nothing is 100% anonymous. – CodesInChaos Apr 26 '17 at 11:19
2

No, but it helps a lot.

Your usage habits themselves, what time you use a computer, common sites you visit, even the speed at which you type certain phrases, and the phrases you use all help to paint a digital fingerprint which can be used to identify you as a user.

This may not happen in real-time as some correlation is involved but if you frequent a site like Stack Exchange and always create new accounts at a certain time, post a three sentence question to security, then view tor.stackexchange.com, bricks.stackexchange.com, and then finally blender.stackexchange.com in a fairly repeatable pattern. An organization may be able to correlate your current activity with your past activity before you were using Whonix or even when you did the same pattern from your cell phone on vacation. These human patterns are not really as anonymous as you would think.

Similar things happen to different types of users. For an attacker, they may always do a specific type of recon first or check for new exploits before working. A journalist may read a news website or two before communicating with a whistle-blower. Basically, the things you do, even with Whonix and Tor eventually reveal some things about you. So no it's not perfect anonymity.

This said, the more you know about this tool the better you will be at using it. If you are just looking to avoid your local ISP from recording your traffic this will probably work great.

  • Thanks a lot. So, it is impossible to make someone's identity 100% anonymous. – Anuruddha Apr 26 '17 at 8:52
  • @Anuruddha your ISP can see to who you're connecting, it might be a VPN, but then the one holding the VPN can see, and so on – Walfrat Apr 26 '17 at 9:54
  • Got the point.Always there is someone, in the top, looking at connections coming from bottom. – Anuruddha Apr 26 '17 at 10:22
  • It is possible to have anonymous communications but it takes a lot of work and you really need to understand where and what is being recorded. In most cases, people don't need perfect anonymity so much as they need it to be good enough to accomplish a certain goal for a certain time period. If you understand what can be done in the context of your goals you can often come up with a solution that is good enough for your needs even if it is not "perfect". – Trey Blalock Apr 26 '17 at 18:41
1

Anonymity is like security on one point: perfection exists in neither, except on a non connected system in a secure building. As soon as you exchange information, you give something and receive something other. So you should be aware of:

  • what contains what you send outside, and what is the risk at that level
  • what channel(s) you are using, and what is the risk at that level
  • what do you get in return and how does it change your platform (cookies at first sight, but more importantly trojans or other malware)
  • most importantly: what do you want to protect, and from whom

In short, if you cannot understand what a system adds to your privacy, you cannot trust it. Simply because you could inadvertantly break a rule and expose something you do not want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.