348

This is actually an interesting new field in infosec - reputation management. Employers, Law Enforcement and other government agencies, legal professionals, the press, criminals and others with an interest in your reputation will be observing all online activity associated with your real name. These "interested parties" (snoops) are usually terrible at ...


186

The problem is heuristics. All mentioned tools are built on heuristics and the only way to avoid them is to change how you live completely. You can be fingerprinted by the modules installed in your browser. By the programs you use and the frequency you use them. These days you're going further than just online behavior. Shops know what you buy in what ...


163

A private key corresponds to a single "identity" for a given user, whatever that means to you. If, to you, an "identity" is a single person, or a single person on a single machine, or perhaps a single instance of an application running on a single machine. The level of granularity is up to you. As far as security is concerned, you don't compromise your key ...


136

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; This tells the browser to disable scripts, frames, connections and any other objects/...


108

So, yes, they appear to have a deal with the Telecommunication Providers in different Countries. Well that's ONE explanation. Another one that I like better is simply that they have all their users' contact lists, thanks to their mobile application which no doubt reads everything and sends it back to their headquarters. All they have to do after you ...


106

As a very long time Tor user, the most surprising part of the NSA documents for me was how little progress they have made against Tor. Despite its known weaknesses, it's still the best thing we have, provided it's used properly and you make no mistakes. Since you want security of "the greatest degree technically feasible", I'm going to assume that your ...


98

Think of it like an underground fight club. Encrypting the traffic means nobody on the outside can see you enter or leave, but once you're inside, everybody there knows who you are and can monitor your participation. This feature is really only useful if you have an ISP that blocks torrent traffic. Encrypting it means it doesn't appear to be torrent traffic,...


93

Twitter doesn't know the user If you have ever used that browser to connect to Twitter outside of the VPN then it is possible that twitter have used cookies or (even in the case of a complete browser data wipe) browser fingerprinting to identify you. Even if they haven't you should assume their ad providers have. no one can know who is the user, except ...


83

Update/Note: This is not to discourage VPN usage. I personally use one of the providers mentioned below, and I'm very happy with it. The important point is not to have an illusion of being 100% protected by the VPN provider. If you do something bad enough that state actors are after you, the VPN provider aren't going to risk themselves for you. If those ...


72

Using your real name does not cause any harm to you. You do't have to pay for bad deeds done by an impostor. So, using your real name online is not a bad practise, it depends on your wish. But the information you share is the real key. Let us say that you have a blog or social network account with your real name. And you'd share information like the places ...


70

You cannot enforce forgetfulness. The Web is like a big memory, and you cannot force it to forget everything about you(*). The only way, thus, is to change your identity so that everything the Web knows about you becomes stale. From a cryptographic point of view, this is the same case as with a secret value shared by members of a group: to evict a group ...


65

One real world example - when you are naked in your shower, not doing anything wrong, would you like it if everyone came by and took pictures? Or televised your shower for the world? Probably not. Another example - if I send a love letter, or write a will dividing up my savings, should that be published on the front page of the national papers? Again - no. ...


62

Using your real name is not only safe, it's important for you to do so. Just bear in mind that you don't want to simply attach your name to all your activities, you want to build and cultivate your online identity. Take the sad case of hapless, hopeless Rick Santorum. He was (and possibly still is) a politician with hopes for fame and power and sights on ...


62

Publishing scans without being identified is a tough proposition. There are multiple risks of information leak, and mitigation is technically complex. However, anyone determined to do so can learn the appropriate techniques, and there is free software to accomplish the task. Disclaimer: Although I consider myself technically knowledgeable about the ...


60

To protect your privacy and avoid tracking, nothing beats cash. There are various services that let you purchase credits in cash at a brick and mortar store, which you can then later use to purchase goods and services online. One example is paysafecard (I haven't tried it, but you should also be able to buy bitcoin with cash). There are a number of VPN ...


57

As Steffen points out, you are perhaps more anonymous that you would be without the VPN, however you are far from 100% anonymous. Your web browser itself can reveal a tremendous amount of information about your computer, browser and other services you might be connected to. JavaScript has been used to de-anonymize people on Tor. Things you post, and ...


53

TL;DR Tor provides anonymous web browsing but does not provide security. VPN Services provides security (sort of) and anonymity, but the anonymity might be more in question depending on the service. Since you're depending on them not logging pieces of information that may or may not be able to be traced back to you. VPNs Traditional A traditional ...


47

They might do it already, there is a known technique to dedicate malicious and powerful nodes to the network to be able to take control of some of the traffic. Tor does not advertise itself to be able to protect against adversaries that have control over a fair part of the internet. While there are techniques to check the validity of the nodes if you have ...


46

I agree with one of the comments that one could write a book on this (I have an idea!) because this could get broad, but consider that these data mining tools (and I build them!) make some major assumptions. For instance, consider search history. One could easily build a program or a tool that would do "random" searches on topics where a person lacks ...


43

Sadly, whether or not to use your real name online may depend on your gender: One study found "that chat room participants with female usernames received 25 times more threatening and/or sexually explicit private messages than those with male or ambiguous usernames". There have been numerous cases of prominent female bloggers being harassed and threatened,...


43

First, authentication is not really “proving that someone is who they say they are”, but linking an action, message or situation with an identity. If I show my passport to prove who I am, what I am really doing is linking my physical presence with the identity conferred to me by the state of which I am a national. A person may well have multiple identities. ...


42

Yes, if an attacker has physical access to your computer it is no longer your computer. While it's theoretically possible to implement spying directly in silicon on a modern CPU, a modern x86-based CPU is extremely complicated. An attacker would be better off using a peripheral device that uses something like USB which exposes certain interrupts in an easily-...


42

The article you link says that the FBI obtained "the MAC address" for the user computers. MAC addresses are specific to each ethernet hardware, and they don't travel beyond the first hop -- meaning that they are visible to your home router, possibly the one provided by the ISP, but not beyond. If that specific piece of information is true, then this means ...


41

2013 calling I think this question deserves a new answer after what we know now. Given the financial sources of the Tor project and what we learned about the NSA inserting backdoors (e.g. see here) casts a shadow on the trustworthiness of the project. From the annual report for last year (linked above): However, keep in mind that the US government claims ...


39

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the ...


38

If you are in a crowd and you wear a mask, but nobody else in the crowd does, then you tend to attract attention... If you want to remain anonymous, then you must use only tools which do not single you out as a potential miscreant, i.e. tools that everybody uses. A good example is when you pay in cash: this is a mostly traceless payment system, and yet ...


38

Burner phone numbers as an OTP 'equivalent' You can think of the "identities" of those phones (phone number, SIM, phone itself/IMEI) as an equivalent of one-time pad encryption - you exchange the phone numbers (multiple) over a secure channel - e.g., when meeting in person; and then they're secure and provide no useful information (for network/metadata ...


37

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures -- is this line: "If you aren't doing anything wrong, what do you have to hide?" Some clever answers: "If I'm ...


36

There are a great many tweets, blog posts, articles, papers and books on this topic. Here are summaries of three of them in order of accessibility. First some quips in response to the classic question (from Schneier, see below for why these aren't the right answer though). "If I'm not doing anything wrong, then you have no cause to watch me." "Because the ...


36

It is absolutely possible. Traffic analysis attacks Even if a VPN is honest about their claim that they do not log, their upstream ISP certainly logs. It would be unheard of for them not to. For a VPN (as opposed to Tor), the ingress and egress go through the same ISP, allowing trivial traffic analysis attacks. I explained a bit of this in this answer. ...


Only top voted, non community-wiki answers of a minimum length are eligible