0

I want to be active on Twitter against our oppressive government. Can my government trace and detect me?

Twitter is banned here and we must use VPNs. I use Outline (Shadowsocks) mostly. Is there any way to trace users via information from the ISPs or something? If using Outline is not a good option, is using TOR a good solution?

The importance of this question is that I can be sentenced to death for just a Twitter post! I don't want to be traced. I remove metadata of Images I post and do some basic methods but I want to be sure there is not any problem with my activity on Twitter. What I have to do?

Improve this question
  • 7
    Posting questions like this on an account that you use for other things is probably not the smartest thing you've done. Use a new account... – schroeder♦ Jan 14 '20 at 10:54
  • 1
    All governments monitor twitter activity. You are no exception. If you use a VPN you should be fine, as your traffic should be encrypted. – Overmind Jan 14 '20 at 13:55
  • 3
    In cases like this you need to worry about OPSEC as much as technologies. As a silly example, using a perfect VPN won't help you if in your twitter account you invite all your fell cohorts to a meeting at your house and provide them with your home address. – Conor Mancone Jan 14 '20 at 14:57
  • 1
    vpn will do the job for you but dont type your country name on twitter profile . – dispos_Acc Jan 14 '20 at 17:36
5

While the communication between your browser and Twitter is encrypted with HTTPS and also additionally in case of Shadowsocks, the messages you publish can be seen by others - that's the point of Twitter. Depending on the content and time of these messages it might be possible to narrow down who might have send these messages. And the more messages you post and the more specific these are the better user profiling can be done.

Since the connections from within Iran to the outside can be monitored by the government they could in theory also align traffic behavior with selected new Twitter posts and from this get your IP address which can be associated with a specific ISP and this ISP knows the customer behind this IP. And again, the more you post the better profiling can be done.

Using Shadowsocks might protect you from some monitoring. But on the other hand using Shadowsocks or VPN can be detected too and can be considered suspicious behavior by its own. And while these technologies hide the endpoint of the connection (i.e. Twitter) they don't hide the sender and they don't hide traffic pattern. It is likely not impossible to use these information for profiling too.

Note that I'm not implying that everything which is possible will be actually done in practice. Even government agencies have only a limited amount of time and money so they will not be able to do everything which is possible in theory. And note that all of this is only about how digital traces you leave on the network can be used to detect too. But it might also be that you talk about your activity to friends and that these friends are not as trustworthy as you assumed. And there are also traces on your computer - see Serge's answer for more on this.

Improve this answer
  • would a VPN really hide the endpoint if man-in-the-middle is at the ISP level? – pcalkins Jan 14 '20 at 19:35
  • 1
    @pcalkins: A proper VPN would only make passive analysis possible, i.e. the ISP sees only that there is some encrypted tunnel between the customer and the VPN endpoint. Of course, don't just use an arbitrary VPN which claims to be secure since this might be actually your enemy which provides the VPN service. – Steffen Ullrich Jan 14 '20 at 20:56
  • can't they perform the handshake before the traffic reaches the VPN? And do that again on the return trip? (and also provide a spoofed web site cert) – pcalkins Jan 14 '20 at 21:05
  • btw, isn't it well known that the US guv'ment does this too? (MITM at the ISP-level) ...and they store all traffic un-encrypted on their own servers? – pcalkins Jan 15 '20 at 22:10
  • 1
    @pcalkins: Probably all major governments have these capabilities (and use these) and there are also standards for passive interception at communication providers. It it is also known from the Snowden papers that the NSA has the capabilities for specific packet injection for example to cause a redirect to another (infected) web site (effective only with plain HTTP, not HTTPS). Of course, all of this is only to to protect against severe crime and terror, while the meaning of these terms varies a lot between governments and also over time. – Steffen Ullrich Jan 16 '20 at 3:14
4

Steffen's answer is about how the activity of posting on twitter could be detected. Mine is how to change hints that something is suspect into evidences that a specific human being has posted messages.

Once an governmental agency thinks you could be suspected to illegaly (in their sense) use internet, the can revert to the good old methods. That means that a constable could come at your home and seize your phone and computer and begin to compare the local traces and the suspected traffic.

This is not only my thoughts, but it has already happenned: a university student (if I correctly remember) used to post offensive content against I cannot remember who. He correctly used privacy tools including proxies and relays to hide where the messages were actually posted from. But in the end he was suspected (no true evidences to that point, only possibilities) and the police seized his computer and could find evidences that the messages were sent from there.

That means that an oppressive government can use means far beyond the simple network analyses and you should (at least) ensure that no local traces remain...

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.