I created this fake Instagram account on my phone while using TunnelBear VPN without any links to my ‘real’ account. Now I’m wondering if the police are still able to trace my true location? If so, how can I prevent this? I’m no expert on the subject so I’d appreciate some simple answers.
Now I’m wondering if the police is still able to trace my true location?
It's clearly possible to track you down, even if you use a proxy which don't save any logs. There are various browser fingerprinting methods that can reveal your real location. Some of them are (mostly used together):
- Heigh and width of your browser window
- Canvas fingerprinting
- Evercookies like DNS entries or other methods
- General cookies
- Different locations where it's hard to find cookies (like Storing cookies in Web History, Storing cookies in HTTP ETags, Storing cookies in Web cache, ...)
- Items and messages your OS is sending
Take a look at this site which shows you if your browser is traceable or not. Maybe it helps you: https://amiunique.org/fp
If so, how can I prevent this?
If you want to stay undetected you can use Tails as an OS and try to combine TOR with an bridge and a VPN. Normally TOR blocks most tracking methods. But take care! If you are not a professional it can happen that you make some mistakes and can even be traced with this programs.
If you downloaded Instagram from the Playstore, there is a email account from google bound to the service, gmails accounts ask for a phone number to validate the account isn't a bot. And with your phone number you can be recognised and tracked.
- Instagrams logs
Law enforcers in most places can send a requeriment to Instagram and VPN Services to ask for logs of activity for an account or group of accounts. That means if there was a connection to that account without a VPN at any point, it could narrow down the location of the person using the account.
Using some VPN services only add a few extra days in searching the origin location of the connection.
- Social Engineering
In most cases the human part is the weakest link in most systems, the police could message this account and try to ask for information to find who and where are you. Is the most used method and works in people not used to this kind of searchs.