94

A simple pitch change is insufficient to mask a voice, as an adversary could simply pitch the audio back to recover the original audio. Most voice modulators use a vocoder, not a simple pitch change. The term "vocoder" is unfortunately rather heavily overloaded these days, so to clarify I mean the type that is most generally used in music, rather than a ...


10

The trick is that it's the payload of the packet that's encapsulated, not the whole TCP packet. Therefore, when the packet leaves the tor exit node unencrypted, it is sent with the return address of the tor exit node. So a service will know that a packet came from a tor exit node and is being anonymized, but unless there's information in the packet payload ...


8

Tl;DR Time is on your side. Note: leave your own phone at home and preferably own a car without GPS. Drive 100 miles from home and buy a cheap used laptop/Android device with functioning Wi-Fi in cash from any source with bad/non-existent record-keeping If laptop then make sure it has the most common OS such as Windows 10 Make sure to park your car about ...


8

Canvas Fingerprinting The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without cookies. The reason for this, of course, is because cookies can be cleared, or even "tricked" by things as simple as switching to a private (aka incognito) window. ...


8

No. Just installing Tor and a VPN does not make you safe. Even if Tor was resilient against attack and VPN was secure and trustworthy, they would only mask your IP. Many people using Tor were caught, not because Tor was defeated, but because they made a mistake. They logged in to a social network or used it on a school computer or had cookies in their ...


7

How Tor protects anonymity The anonymity happens because while the Tor exit node knows the final packet and its destination, it doesn't know where the packet originated from. Similarly, the entry node knows where the packet originated from, but it doesn't know the packet contents or where it is destined for. As a result (theoretically), none of the nodes ...


6

This is a long explanation, for a TL:DR, read my first answer here. What a VPN does is create an encrypted tunnel between you and a VPN server. When you want to send data to a server on the internet (let's call it website for simplicity but it can be anything and everything on the internet), you first send it to the VPN server through the encrypted tunnel ...


6

tl;dr– It's not generally reversible, but it might still be reversed in practice. Analogy: Reversibility of reducing a name to its length. Consider a reduction method that takes in a person's first name and gives the number of letters in it. For example, "Alice" is transformed into 5. This is a lossful process, so it can't be generally reversed. ...


6

Can a PDF contain something that tracks you? If you mean in the PDF file itself, and part of the PDF standard, and which does not require the user to click on something (like a link annotation), it would just be javascript. Which means in general, especially if javascript interpretation is off, then no a PDF can't track you. Generally PDF DRM/tracking is ...


4

If you're serious about it, you could look into installing Qubes as your main OS, and running Whonix in one of the Qubes. Qubes was a project started by Joanna Rutkowska (who developed the idea of the Blue Pill virtualisation rootkit). Qubes takes an approach called security by compartmentalization, which allows you to compartmentalize the various parts ...


4

This is an extremely broad question and it depends on many factors. You'll need to adopt a pen name. This name must have no relationship to your name or your interests. If you like video games, you must not use a Mario reference, for example. Do not interact with your pen name either. That is, do not even mention that you (the real and public you) know that ...


4

I think you've misunderstood what the canvas hash is. The "canvas" is a JS component that allows the browser to draw graphics. The hash input is only a single thing, the binary data that makes up the image drawn by your graphics card. Obviously, a number of things go into the generation of that image. There are multiple JS engines used by different ...


4

I don't think that the development itself is so much of a problem if done alone, offline and with proper disc encryption and if the software never gets distributed. But, if you need help in development you need to communicate with others or at least get information from the internet. It might for example be that the developer forums you visit are ...


4

You can get away with it at least once. The keyword here is plausible deniability. If it is plausible that you can deny that you are the source of the information, and that there's no way the adversaries can prove that, then you're successful. What you can do is that you should run a large, busy Tor node, without any logging. As a relay, users of the ...


3

The website admin certainly knows your IP Address. If they didn't they couldn't send you the website you requested. Whether or not they record your address or try to track you is entirely up to them. The same applies for the hosting provider as well as everyone between them and you, starting with your ISP. The domain name registrar doesn't know anything ...


3

Complete fingerprint elimination is impossible for a wide variety of technical reasons -- in short, a lot of fingerprintable data is required for correct website operation, so you can't deny it to websites, or can be figured out through side channels that would require a big performance hit to eliminate. The original version of this answer had a massive list ...


3

"co-workers, employers, and neighbors" I agree with all the advice given so far in comments and answers, but felt this deserved some more specific advice around your stated adversaries. Establishing an alter ego For your purpose, you don't need an entire false identity, just some anonymity. I would suggest using a free, privacy-focused email service (...


3

Yes, you can mask the source IP Nothing stops you from writing a false source IP address, just like nothing stops you from changing the "From" field on a letter. In fact, IP packets and letters are remarkably similar. What happens if I change the source address? The answer is quite simple: You will not get a response. The IP address in the source ...


3

No it's certainly not secure. If I were to do it, I would use speech to text then dictate using a common voice like Stephen Hawking's. That completely eliminates any actual voice information. The only thing left would be to anonymise your style of dialect by formalising/normalising your vocab/sentences. Honestly that latter stage is extremely difficult. ...


3

The phone company will receive the IMEI of the mobile phone, which is the device connecting to them. You might have one, zero or dozens of laptops behind that phone. Not to mention, laptops don't have IMEI codes (the equivalent would be the MAC of the Wifi card)


2

As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's name, email address, or any other such data. Just make sure that the systems limiting requests are separate from those handling logging in and user data, and ...


2

Using an asymmetric encryption. Create a public/private key pair. Share the public key in chat Now someone can send data to chat encrypted with your public key. Data can only be decrypted with your private key no body but you can read it.


2

A browser based VPN is not actually a virtual private network but instead an encrypted tunnel to a proxy server. Since it is integrated in the browser it is unlikely to cause DNS leaks. All DNS will instead be resolved by the proxy at the end of the encrypted tunnel. Such a browser based "VPN" will only cover traffic originating in the browser. What you ...


2

Now I am traveling to Russia and intend to use there the same laptop I used to make my posts I am going to write the answer assuming your laptop hasn't already been compromised with a rootkit/malware.If it has either nuke it or format HDD and preferably use linux live. Now to your question My question is this: What should I do to meet these needs? ...


2

Keep in mind that TOR provides anonymity, but not necessarily security. For example, say that the government where you live has banned parsnips for being too vulgar, and anyone caught even looking at them online is thrown into jail. But you still like reading about parsnips, but you don't want the government to know that you're a deviant for fear of being ...


1

It is difficult to answer your questions because they are broad and all over the place. Nonetheless: I just set up Algo VPN on Amazon EC2. I'm wondering if this will be vulnerable to attacks if the Amazon EC2 instance is compromised. If the EC2 instance itself is compromised, then you should assume that everything on it is compromised as well. or ...


1

Notifications are just code run on the browser sent by the server. You are already running the site's code in your browser when you initially visit the site. So, enabling notifications does not expose your identifying information any more than visiting the site initially does. As a side note, a VPN has no bearing on the blocking of identifying ...


1

The security of notifications is about the same as popups. This means that they can be useful but they can also be misused to be annoying and they can be misused to trick the user, i.e. for phishing. This risk does not change in any way if a VPN is used. This means, if you did not like it before or found it too risky you should keep it off by default also ...


1

Cellular location without GPS can vary dramatically depending upon many factors. The general working guideline is 1000 feet. High density areas with micro cells can go much smaller, and low density areas can be miles.


1

You have a system, X, where you want a user A to access X and never access it again. You can't know who A is, and A belongs to the set E with Everyone. Even if you have the user act as a trustworthy user who will only attempt using their current system, as soon as they interact with your system they are no longer anonymous, as they belong to the previously ...


Only top voted, non community-wiki answers of a minimum length are eligible