So, I've been reading about anonymity recently and I'm interested in learning the next step on anonymity, I know the basics like what a VPN does and what not, but take this...

If I'm connected to a VPN and the VPN provider "doesn't log anything", they say they don't, some VPN companys claim a no-log policy, for this example lets take it as they don't log.

If the police want to trace you, they go to your ISP and ask what IP's I've connected too. They then go to the VPN provider and ask for my activity, what if they don't log anything? Where do the police end up going after that? Surely this has to be 100% anonymity?

Take into account that I also have no malware on my computer leaking information, no dns leaking, is this 100% anonymous?

I guess I'm asking, what does it take to be 100% anonymous?

  • 6
    In InfoSec, nothing is ever 100% – multithr3at3d Feb 12 '18 at 3:41

100% anonymity is probably impossible.

My explanation of how the anonymity works - which is probably very incomplete and vague - is the following: you put some technical - and non-technical - efforts into making it more difficult and more costly to track your actions online. There are many aspects here (for example if you search Google while logged in, you can be tracked by Google no matter which VPN you use), but since you only mentioned VPN I assume you mainly concern about being tracked by ISP or someone accessing your traffic.

VPN increases the difficulty to track you for this group. However this difficulty only translates into more effort for the adversary in order to track you. This is definitely not an "ultimate protection", just the matter of whether someone really needs to uncover you.

And whether it is the case, this typically comes down to how you use this anonymity. And thus how willing the state (i.e. police) would be to spend their limited resources on you. Are you running an international criminal drug syndicate? Good chance. Are you illegally downloading some Hollywood movie? Not likely.

If the police want to trace you, they go to your ISP and ask what IP's I've connected too.

Note that here you have already lost your anonymity at this point, so you are probably now talking about evidence.

They then go to the VPN provider and ask for my activity, what if they don't log anything? Where do the police end up going after that?

They can order/force/coerce/convince the VPN provider (depending on country) to spy on you. This could be a very minor effort operation. This would strip down the VPN level anonymity completely. Unless you stop using this provider right away, if you continue your usage, they will have the full record of it.

Finally in real life there is no need even for that. Read about the busts on people who purchase guns on dark markets. An undercover police officer takes over a seller account, sells a gun, which is delivered to one's house (apparently many purchases simply use their residential address for that). After the delivery the police searches the premises, finds a gun, arrests the buyer. In this case the police not only doesn't need to go to VPN provider, they don't even need to monitor the buyer's traffic.

| improve this answer | |

Anonymity goes as far as who what wants/can disclose about you.

A VPN server/provider may not retain user-specific data, but there will always be meta-data that they will legally have to disclose.

As a first step, if you want to use proxies and VPNs, use some from opposite political system countries. (i.e. If you are an US citizen, use a proxy/VPN from Iran and they won't disclose anything).

Now if you want 100% anonymity, make anonymous self-destruct proxies in a few points around the world and you're done. You control them, you have multiple redundant paths and any attempt at physical access to them destroys them. That's what it takes: your own VPN/proxy system without anyone knowing that it is you that set it up.

| improve this answer | |
  • This most definitely does not give you 100% privacy. There are cookies, browser fingerprinting, timing attacks, and more that can lead back to you. – Steve Feb 12 '18 at 15:22
  • I'm not talking about browsing. Browsing is one of many activities you can do. For browsing, there are special countermeasures like using a custom one with an universal browser ID and that prevents any information from being extracted. – Overmind Feb 13 '18 at 7:04
  • There have been many people who have been identified during criminal investigations even while using long chains of proxies. If you want anonymity, your best bet is with Tor, but there are still risks you must be aware of while using it. – Steve Feb 13 '18 at 7:10
  • 1
    This has nothing to do with Tor, anyone can intercept and read unencrypted data (your ISP, routers, VPNs, proxies, exit nodes, etc). I was assuming we were encrypting our requests since otherwise, trying to achieve anonymity is pointless anyways in this context. – Steve Feb 13 '18 at 8:11
  • 1
    I agree, but my point was that a long chain of proxies definitely does not provide anything close to 100% anonymity, and if you want something with some better anonymity guarantees, use Tor or something designed for increased anonymity. – Steve Feb 13 '18 at 8:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.