Skip to main content
Share Your Experience: Take the 2024 Developer Survey
95 votes
Accepted

Is changing pitch enough for anonymizing a person's voice?

A simple pitch change is insufficient to mask a voice, as an adversary could simply pitch the audio back to recover the original audio. Most voice modulators use a vocoder, not a simple pitch change. ...
Polynomial's user avatar
  • 135k
21 votes
Accepted

What is this potential identity leak that NoScript warns about?

So after some digging into NoScript's settings, I found some settings for something called "Cross-tab identity leak protection". Googling this led to a tor project issue Targeted ...
nobody's user avatar
  • 11.6k
6 votes

Is changing pitch enough for anonymizing a person's voice?

tl;dr– It's not generally reversible, but it might still be reversed in practice. Analogy: Reversibility of reducing a name to its length. Consider a reduction method that takes in a person's first ...
Nat's user avatar
  • 1,441
5 votes
Accepted

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

From a pure security standpoint, I see 3 possible improvements to your system: Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, ...
Benoit Esnard's user avatar
5 votes
Accepted

How can malware discover the real IP of a TAILS user?

You are right that Tails only enforces conection over Tor circuit. Even if there's a malware running with application privileges, its traffic has to be routed through Tor. User-level applications ...
defalt's user avatar
  • 6,861
5 votes

Feasability of deanonymizing commercially available advertiser data

Apps like Grindr use third-party advertising companies to serve ads in their apps. According to a 2020 report by the Electronic Frontier Foundation, Grindr uses a company called MoPub (which is owned ...
mti2935's user avatar
  • 23.6k
4 votes

Can you serve up special content to an end-user based on IP or other identifiable data?

Yes, this is a common practice. There are many ways to identify a user. Here's a few. user agent string in the request browser fingerprinting (pantoclick IP address (country, region, ISP, known VPN ...
Daisetsu's user avatar
  • 5,130
3 votes

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and ...
Steffen Ullrich's user avatar
3 votes

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's ...
James's user avatar
  • 49
3 votes
Accepted

Attacks on decentralised networks by running a fleet of nodes with modified software

It would be possible in theory using remote attestation for network access controls. This could reduce the TCB (Trusted Computing Base) to only the CPU. Unfortunately, this would require all Tor ...
forest's user avatar
  • 66.8k
3 votes
Accepted

How can intelligence services be so sure that Russia is the culprit?

This is nearly a dupe of How do organizations check what has been hacked? While that question deals with unraveling what, you're asking about unraveling how and by whom. What other possibilities ...
gowenfawr's user avatar
  • 72.9k
3 votes

How does tracking work?

I run honeypots, and I once caught a hacker because he used his full legal name as a password, and he used the same username he used for an online dating profile. With those two pieces of data, I was ...
schroeder's user avatar
  • 131k
3 votes
Accepted

Can DeepCorr's correlation technique de-anonymize all Tor users?

Can DeepCorr's correlation technique de-anonymize all Tor users? No, it cannot de-anonymize ALL Tor users. (however it drastically narrows down the scope to proceed with successful de-anonymization) ...
Alexander Fadeev's user avatar
3 votes

Feasability of deanonymizing commercially available advertiser data

The article at Ars Technica is more informative: The Pillar says it obtained 24 months' worth of “commercially available records of app signal data” covering portions of 2018, 2019, and 2020, which ...
user10216038's user avatar
  • 8,133
2 votes
Accepted

Few Questions About Tor Hidden Services

According to this, when you connect to a hidden service using tor you go through 6 nodes instead of 3... why? To hide the hidden service IP address in case the rendezvous point is under adversary ...
George Y.'s user avatar
  • 3,534
2 votes
Accepted

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

“So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks.” Actually we know nothing of the kind. Tor was originally TOR (The Onion Network) and was developed ...
user10216038's user avatar
  • 8,133
2 votes

Identify anonymous mobile phone user by network participants

Is this technique used? I can't speak specifically to mobile phones, but in general, it's a regularly used technique usually referred to as de-anonymization or re-identification. One common legal ...
Mr. Llama's user avatar
  • 674
2 votes

are some IP whois capable of going beyond proxies?

whois on an IP address shows whom this IP address (range) is assigned to. If you get that the address is assigned to some company doing anonymous proxies then this is exactly that, i.e. there is no ...
Steffen Ullrich's user avatar
2 votes

GPS working and anonymity

No, there isn't any log on the satellite - it's just broadcasting a time signal and an identifier. Anyone can pick it up - think of it as being like a radio broadcast. Phone location, as in how ...
Matthew's user avatar
  • 27.3k
2 votes

Is changing pitch enough for anonymizing a person's voice?

No it's certainly not secure. If I were to do it, I would use speech to text then dictate using a common voice like Stephen Hawking's. That completely eliminates any actual voice information. The ...
Shiv's user avatar
  • 129
2 votes
Accepted

Can global adversaries 'de-anonymize' any Tor user in a day?

TL;DR: correlation attacks are a possibility but there is always a gap between theory and practice. The other limitation is scalability. An excerpt from that 2013 study shows that the technique is ...
Kate's user avatar
  • 8,345
2 votes
Accepted

Does Apple’s Hide my Email feature really work?

Hide my Email is basically creating a mail alias. As long as you choose this alias as sender in E-mail communication with the site it will hide your original address. But if you deliberately or ...
Steffen Ullrich's user avatar
1 vote

What is the relationship between cookies and anonymity?

There's no such thing as "complete anonymity". Cookies aren't the only way to track a web user. Browsers can be uniquely fingerprinted, and they offer other persistent storage locations besides ...
multithr3at3d's user avatar
1 vote

What is the relationship between cookies and anonymity?

First, you don't get complete anonymity just by using a VPN in the first place. A VPN will only reduce the tracking surface but not remove it. Similar removing cookies will only reduce the tracking ...
Steffen Ullrich's user avatar
1 vote

Accessing over a VPN both sites that know your real identity and sites you want to stay private from

Is it a bad idea to access over the same VPN both sites that know your real identity and those that don't? From a hyperparanoid perspective yes. You will likely have the same visible IP for both ...
Hector's user avatar
  • 10.9k
1 vote

What category of anonymity do onion routing and blockchains afford?

While strict anonymity can be seen as a preference to a user attempting to conceal all aspects of their identity, it is infeasible and impossible to say the least. Tor, Blockchain, and other ...
Paradox Inferno's user avatar
1 vote

Break anonymity in a Kippo honeypot

There is nothing you can "install" to deanonymize an attacker. Once you get the data from Kippo about the IP and connection type, you have as much as you can get unless the attacker reveals more about ...
schroeder's user avatar
  • 131k
1 vote

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

You are missing a part of the equation. Using HTTPS, the traffic between you and the destination server is protected from snooping and alteration, but you know the identity of the server, and the ...
ThoriumBR's user avatar
  • 54.4k
1 vote

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

For one, you may care about the attacker (government?) knowing about which sites you access. Sure it may not be such an issue in the US right now but there are countries where just visiting western ...
Peter Harmann's user avatar
1 vote

GDPR data minimisation session cookies

You could do something like that (other solutions could be possible): Step 1: The user fills the consent form. Step 2: The server validates the consent form then generates a unique link to the ...
A. Hersean's user avatar
  • 10.5k

Only top scored, non community-wiki answers of a minimum length are eligible