94

A simple pitch change is insufficient to mask a voice, as an adversary could simply pitch the audio back to recover the original audio. Most voice modulators use a vocoder, not a simple pitch change. The term "vocoder" is unfortunately rather heavily overloaded these days, so to clarify I mean the type that is most generally used in music, rather than a ...


6

tl;dr– It's not generally reversible, but it might still be reversed in practice. Analogy: Reversibility of reducing a name to its length. Consider a reduction method that takes in a person's first name and gives the number of letters in it. For example, "Alice" is transformed into 5. This is a lossful process, so it can't be generally reversed....


5

You are right that Tails only enforces conection over Tor circuit. Even if there's a malware running with application privileges, its traffic has to be routed through Tor. User-level applications cannot enforce their own network configuration in Tails. As facebook refused to disclose the vulnerability, this is what might have happenned. Media file carries ...


4

Yes, this is a common practice. There are many ways to identify a user. Here's a few. user agent string in the request browser fingerprinting (pantoclick IP address (country, region, ISP, known VPN ranges, blacklists, etc.) referrer header cookies previous history (look through your own logs to ID return traffic) URL history harvesting css fingerprinting ...


4

Can DeepCorr's correlation technique de-anonymize all Tor users? No, it cannot de-anonymize ALL Tor users. (however it drastically narrows down the scope to proceed with successful de-anonymization) Why, and what is flow correlation attack Flow correlation attack is an attack where adversary intercepts network flows at various network locations "...


3

No it's certainly not secure. If I were to do it, I would use speech to text then dictate using a common voice like Stephen Hawking's. That completely eliminates any actual voice information. The only thing left would be to anonymise your style of dialect by formalising/normalising your vocab/sentences. Honestly that latter stage is extremely difficult. ...


3

This is nearly a dupe of How do organizations check what has been hacked? While that question deals with unraveling what, you're asking about unraveling how and by whom. What other possibilities are there to identify an attacker, when he knows his business and is hiding his IP/Info and not making stupid mistakes? There are a lot of possibilities. ...


3

I run honeypots, and I once caught a hacker because he used his full legal name as a password, and he used the same username he used for an online dating profile. With those two pieces of data, I was able to go so far as to get his phone number at his place of work. Sometimes, technology doesn't unmask you, but the way you attack does.


2

According to this, when you connect to a hidden service using tor you go through 6 nodes instead of 3... why? To hide the hidden service IP address in case the rendezvous point is under adversary control. The hidden service communicates with Tor client through a chosen node, which is called rendezvous point (RP). Normally they both build a standard Tor ...


2

whois on an IP address shows whom this IP address (range) is assigned to. If you get that the address is assigned to some company doing anonymous proxies then this is exactly that, i.e. there is no way to look behind since there is nothing behind. What you would need to look further is the original IP of the user which an anonymous proxy hides by design. ...


2

As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's name, email address, or any other such data. Just make sure that the systems limiting requests are separate from those handling logging in and user data, and ...


2

“So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks.” Actually we know nothing of the kind. Tor was originally TOR (The Onion Network) and was developed by U.S. Naval Research Labs (NRL) specifically to provide a mechanism that was both secure and anonymous against nation state level threats. Since then it has ...


2

TL;DR: correlation attacks are a possibility but there is always a gap between theory and practice. The other limitation is scalability. An excerpt from that 2013 study shows that the technique is not that trivial: Our analysis shows that 80% of all types of users may be de-anonymized by a relatively moderate Tor-relay adversary within six months. Our ...


2

From a pure security standpoint, I see 3 possible improvements to your system: Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, but it will take weeks for a motivated attacker to bruteforce every possible IP, instead of a fraction of second. Change the salt regularly. The attacker will ...


2

No, there isn't any log on the satellite - it's just broadcasting a time signal and an identifier. Anyone can pick it up - think of it as being like a radio broadcast. Phone location, as in how police track a specific phone, doesn't work using GPS directly. A limited amount of location data can be obtained by looking at which cell tower the phone is ...


1

There's no such thing as "complete anonymity". Cookies aren't the only way to track a web user. Browsers can be uniquely fingerprinted, and they offer other persistent storage locations besides cookies. Allowing 3rd party cookies at all allows your activities to be tracked across different websites during your browsing session (usually by advertising ...


1

First, you don't get complete anonymity just by using a VPN in the first place. A VPN will only reduce the tracking surface but not remove it. Similar removing cookies will only reduce the tracking surface further but not remove it too. There are still enough cached information in the browser outside of cookies and these can be used to track you. Removing ...


1

GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and since the use case you have only needs short term storage and you can (and should) delete these hashes afterwards I see no real problem here. Even when the ...


1

Is this technique used? I can't speak specifically to mobile phones, but in general, it's a regularly used technique usually referred to as de-anonymization or re-identification. One common legal application is in web advertising. Advertisers aren't allowed to have access to your personally identifiable information, but they may have access to your ...


1

You are missing a part of the equation. Using HTTPS, the traffic between you and the destination server is protected from snooping and alteration, but you know the identity of the server, and the server knows yours. If you post something the government considers a crime, the server may be compelled to give them your identity. On the other hand, if the ...


1

For one, you may care about the attacker (government?) knowing about which sites you access. Sure it may not be such an issue in the US right now but there are countries where just visiting western news/info sites to get real information instead of propaganda could get you into trouble (not that news can be trusted these days but that is another issue). The ...


1

You could do something like that (other solutions could be possible): Step 1: The user fills the consent form. Step 2: The server validates the consent form then generates a unique link to the questionnaire, not tied to the consent form. This link that can only be used to validate one questionnaire. The server flags (in its database) the session cookie as ...


1

No! This is exactly what Tor hidden services are designed to accomplish. Nothing is absolutely safe and given enough worldwide oversight and resources, Tor is vulnerable in theory. In practice the vulnerability bar is very very very high. If you are the only user of your hidden service, you may want to make it a "Stealth Hidden Service". This requires an ...


1

... it compares the size of incoming traffic and the outgoing one and see which one matches? Once you understand what inbound traffic is, you can get the IP of the affected client, right? To do this kind of correlation an attacker would need to have access not only to the endpoint of the VPN but also need to sniff near the entry points, i.e. at the ISP ...


1

Is it a bad idea to access over the same VPN both sites that know your real identity and those that don't? From a hyperparanoid perspective yes. You will likely have the same visible IP for both sites. Whilst usually you would expect other users to be present at the VPN IP it still makes pairing up your requests easier. What kinds of attacks could expose ...


1

While strict anonymity can be seen as a preference to a user attempting to conceal all aspects of their identity, it is infeasible and impossible to say the least. Tor, Blockchain, and other anonymizing technologies designed for a specific purpose can never be made to be infallible. After all, people do make mistakes and those are the elements that lend to ...


1

There is nothing you can "install" to deanonymize an attacker. Once you get the data from Kippo about the IP and connection type, you have as much as you can get unless the attacker reveals more about themselves from their actions. There are tools that you can use to enhance the data a little, but that does not break anonymity. Most of the investigations ...


1

To add to the answer above: If b. is true, then the client and hidden service hoster don't communicate outside of the rendezvous point, becuase it's unsafe... So how do they find out which rendezvous point they will both be communicating at? The rendezvous point is chosen by a client, randomly, from a list of Tor relay nodes (they don't have to be ...


1

Another way I have interpreted this is that the client, nor Tor, needs to know the real IP address of the hidden service hoster, since they only communicate through a rendezvous point, and they both go through 3 encrypted hops just like normal to the rendezvous point, providing them both anonymity.  Yes, this is correct. It's helpful to think of the hidden ...


1

For question 1, Matthew answer is perfect, with nothing to add. For question 2, the answer is no, but only if the phone is in the airline more (not just SIM card is out). Please note that the phone can still connect to cell towers even without a SIM card, because the Emergency number could be dialed without a valid SIM card. Of course GPS and Wi-Fi should ...


Only top voted, non community-wiki answers of a minimum length are eligible