95
votes
Accepted
Is changing pitch enough for anonymizing a person's voice?
A simple pitch change is insufficient to mask a voice, as an adversary could simply pitch the audio back to recover the original audio.
Most voice modulators use a vocoder, not a simple pitch change. ...
- 135k
21
votes
Accepted
What is this potential identity leak that NoScript warns about?
So after some digging into NoScript's settings, I found some settings for something called "Cross-tab identity leak protection". Googling this led to a tor project issue Targeted ...
- 11.5k
6
votes
Is changing pitch enough for anonymizing a person's voice?
tl;dr– It's not generally reversible, but it might still be reversed in practice.
Analogy: Reversibility of reducing a name to its length.
Consider a reduction method that takes in a person's first ...
- 1,441
5
votes
Accepted
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
From a pure security standpoint, I see 3 possible improvements to your system:
Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, ...
- 14.7k
5
votes
Accepted
How can malware discover the real IP of a TAILS user?
You are right that Tails only enforces conection over Tor circuit. Even if there's a malware running with application privileges, its traffic has to be routed through Tor. User-level applications ...
- 6,751
5
votes
Feasability of deanonymizing commercially available advertiser data
Apps like Grindr use third-party advertising companies to serve ads in their apps. According to a 2020 report by the Electronic Frontier Foundation, Grindr uses a company called MoPub (which is owned ...
- 22.7k
4
votes
Can you serve up special content to an end-user based on IP or other identifiable data?
Yes, this is a common practice. There are many ways to identify a user. Here's a few.
user agent string in the request
browser fingerprinting (pantoclick
IP address (country, region, ISP, known VPN ...
- 5,100
3
votes
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and ...
- 198k
3
votes
Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?
As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's ...
- 49
3
votes
Accepted
Attacks on decentralised networks by running a fleet of nodes with modified software
It would be possible in theory using remote attestation for network access controls. This could reduce the TCB (Trusted Computing Base) to only the CPU. Unfortunately, this would require all Tor ...
- 66.5k
3
votes
Accepted
How can intelligence services be so sure that Russia is the culprit?
This is nearly a dupe of How do organizations check what has been hacked? While that question deals with unraveling what, you're asking about unraveling how and by whom.
What other possibilities ...
- 72.7k
3
votes
How does tracking work?
I run honeypots, and I once caught a hacker because he used his full legal name as a password, and he used the same username he used for an online dating profile. With those two pieces of data, I was ...
- 128k
3
votes
Accepted
Can DeepCorr's correlation technique de-anonymize all Tor users?
Can DeepCorr's correlation technique de-anonymize all Tor users?
No, it cannot de-anonymize ALL Tor users.
(however it drastically narrows down the scope to proceed with successful de-anonymization)
...
- 1,264
3
votes
Feasability of deanonymizing commercially available advertiser data
The article at Ars Technica is more informative:
The Pillar says it obtained 24 months' worth of “commercially
available records of app signal data” covering portions of 2018, 2019,
and 2020, which ...
- 8,118
2
votes
Accepted
Few Questions About Tor Hidden Services
According to this, when you connect to a hidden service using tor you
go through 6 nodes instead of 3... why?
To hide the hidden service IP address in case the rendezvous point is under adversary ...
- 3,524
2
votes
Accepted
Why it bothers if someone can de-anonymize anonymous network (like Tor)?
“So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks.”
Actually we know nothing of the kind. Tor was originally TOR (The Onion Network) and was developed ...
- 8,118
2
votes
GPS working and anonymity
No, there isn't any log on the satellite - it's just broadcasting a time signal and an identifier. Anyone can pick it up - think of it as being like a radio broadcast.
Phone location, as in how ...
- 27.4k
2
votes
are some IP whois capable of going beyond proxies?
whois on an IP address shows whom this IP address (range) is assigned to. If you get that the address is assigned to some company doing anonymous proxies then this is exactly that, i.e. there is no ...
- 198k
2
votes
Is changing pitch enough for anonymizing a person's voice?
No it's certainly not secure.
If I were to do it, I would use speech to text then dictate using a common voice like Stephen Hawking's. That completely eliminates any actual voice information.
The ...
- 129
2
votes
Accepted
Can global adversaries 'de-anonymize' any Tor user in a day?
TL;DR: correlation attacks are a possibility but there is always a gap between theory and practice. The other limitation is scalability.
An excerpt from that 2013 study shows that the technique is ...
- 7,847
2
votes
Accepted
Does Apple’s Hide my Email feature really work?
Hide my Email is basically creating a mail alias. As long as you choose this alias as sender in E-mail communication with the site it will hide your original address.
But if you deliberately or ...
- 198k
1
vote
What is the relationship between cookies and anonymity?
There's no such thing as "complete anonymity". Cookies aren't the only way to track a web user. Browsers can be uniquely fingerprinted, and they offer other persistent storage locations besides ...
- 12.7k
1
vote
What is the relationship between cookies and anonymity?
First, you don't get complete anonymity just by using a VPN in the first place. A VPN will only reduce the tracking surface but not remove it. Similar removing cookies will only reduce the tracking ...
- 198k
1
vote
Identify anonymous mobile phone user by network participants
Is this technique used? I can't speak specifically to mobile phones, but in general, it's a regularly used technique usually referred to as de-anonymization or re-identification.
One common legal ...
- 664
1
vote
Accessing over a VPN both sites that know your real identity and sites you want to stay private from
Is it a bad idea to access over the same VPN both sites that know your real identity and those that don't?
From a hyperparanoid perspective yes. You will likely have the same visible IP for both ...
- 10.9k
1
vote
What category of anonymity do onion routing and blockchains afford?
While strict anonymity can be seen as a preference to a user attempting to conceal all aspects of their identity, it is infeasible and impossible to say the least. Tor, Blockchain, and other ...
1
vote
Break anonymity in a Kippo honeypot
There is nothing you can "install" to deanonymize an attacker. Once you get the data from Kippo about the IP and connection type, you have as much as you can get unless the attacker reveals more about ...
- 128k
1
vote
Why it bothers if someone can de-anonymize anonymous network (like Tor)?
You are missing a part of the equation.
Using HTTPS, the traffic between you and the destination server is protected from snooping and alteration, but you know the identity of the server, and the ...
- 53.5k
1
vote
Why it bothers if someone can de-anonymize anonymous network (like Tor)?
For one, you may care about the attacker (government?) knowing about which sites you access. Sure it may not be such an issue in the US right now but there are countries where just visiting western ...
- 7,858
1
vote
GDPR data minimisation session cookies
You could do something like that (other solutions could be possible):
Step 1: The user fills the consent form.
Step 2: The server validates the consent form then generates a unique link to the ...
- 10.5k
Only top scored, non community-wiki answers of a minimum length are eligible