In the post on Criminal Activity and Your IP address, I outlined how people use TOR (The Onion Router) in order to conceal their IP address in order to maintain a certain level of anonymity online. But a bare bones use of the TOR system is not actually as secure as it should be.
There are a number of steps one can take to ensure that your origin IP address is as concealed as possible. I’ll teach you a few extra steps to further conceal your digital wake (the bits of information you leave behind that are stored and retained by other computers as you go about the internet).
Note, all of the below information is based on using the web browser Firefox. If you’re using Internet Explorer to do anything on the internet, God help you.
Contents
TOR
The first step is to use the TOR system described in last week’s post. The TOR addon for Firefox can be downloaded here.
Or, you can choose to download a TOR specific package of Firefox here. This page has video and detailed written instructions for how to install and use the TOR browser.
VPN
A virtual private network, also known as a VPN, is a private network that extends across a public network or internet. It enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Many companies force their users to use these services when working remotely.
A benefit to using a VPN is that your computer essentially becomes “shielded” from the larger internet. All requests for information first pass through the VPN which means that your computer’s identifying information (IP address, etc) is concealed. Further, many public VPN services go a step further and keep no logs of your activity while connected to the VPN.
The VPN I use is Private Internet Access.
Encryption
While TOR makes it difficult to track your IP origin address, it does not actually conceal the actual packets of information you are sending/receiving from your computer.
On TOR, Exit nodes (see the previous post for details on Exit nodes) can see exactly what the server, and any eavesdropper on an unencrypted (un-anonymous) connection, can see. If you’re transmitting sensitive or identifying data unencrypted, you’re explicitly choosing to be not anonymous. If you do it over TOR, you’re being not anonymous over an anonymizing network – defeating the point of the entire system.
The solution is to switch from Hypertext Transfer Protocol (http://) to Hypertext Transfer Protocol Secure (https://). More than likely, you use https on a regular basis already. Any online banking or commercial transactions (Amazon, etc.) are secured via https. Gmail and many other email services force https connections as well. It doesn’t require anything extra on the users’ part when the destination site requests a https connection.
However, enabling https does require extra action on the part of the use if they want to force https connections to regular websites. Fortunately, most sites allow https connections for routine browsing, not just transactional services. The easiest way to enable https on thousands of sites is to install the HTTPS Everywhere add-on, courtesy of The Tor Project and the Electronic Frontier Foundation. Once installed, when you go to any of the whitelisted sites that come with the package (Facebook, Twitter, WordPress, etc), a https connection will automatically established instead of a regular http connection. Simple as that.
Ad/Tracker Blocking
Another absolute must is the blocking of active scripting on websites. These are small executables that run within a webpage and are often used by malicious hackers to install malware and obtain identity information on a target machine. Again, this can be easily thwarted by installing an add-on for Firefox.
- Ghostery is a tracker blocking plugin that lets you control which tracking beacons you allow when you visit individual websites.
- No Script is a free, open source add-on that blocks JavaScript, Java and Flash and other plugins. Instead, an icon is shown that allows the user to execute scripts only on trusted web sites (e.g. your online bank, youtube, etc.), and provides the most powerful Anti-XSS protection available in a browser.
- UBlock Origin (not regular Ublock which has fallen into disrepair) is currently the king of the hill for ad blocking services.
True Anonymity (TAILS)
The above steps will provide a user with fairly robust security and anonymity while browsing from one of their home networks (work, school, residence). But browsing from a home network in inherently insecure. It is possible, though difficult and unlikely, that someone could be watching both the Entry and Exit nodes of the TOR network that you use.
Encryption (especially low level 128-bit) can be broken. Detailed logs of the information you access will be retained on your computer. Deleting your temporary internet files won’t suffice; latent information can be retrieved from your hard disks by ediscovery experts.
True anonymity requires:
- using a free, public internet connection (Starbuck’s, your local library, etc.)
- TAILS.
A free, public internet connection (preferably wi-fi in order to spot and avoid cctv cameras) is a given to ensure that there is no way to track your activity back to a connection that has your personally identifying information tied to it in anyway.
The second step is to use The Amnesiac Incognito Live System (Tails). Tails is a live system: a complete operating-system (Debian GNU/Linux) designed to be used from a CD or a USB flash drive independently of the computer’s original operating system. Tails comes with the Tor Browser pre-installed for anonymized browsing. What else does Tails do?
Tails is configured with a special care to not use the computer’s hard-disks, even if there is some swap space on it. The only storage space used by Tails is the RAM memory, which is automatically erased when the computer shuts down. So you won’t leave any trace neither of the Tails system nor of what you did on the computer. That’s why we call it “amnesic”.
This allows you to work on sensitive documents on any computer and protect you from data recovery after shutdown. Of course, you can still explicitly save some documents to another USB or external hard-disk and take them away for future use.
Once placed on a USB flash drive, a user can: shutdown a computer, insert the flash drive, and then boot up the computer via the operating system on the flash drive instead of the one that is installed on the computer’s hard drive. As no activity is written to the hard disks, it is virtually impossible for an ediscovery technician to retrieve any activity data that took place while the user was booted into Tails.
TL;DR
To sum up, the best way to conceal your digital wake is:
- Free, public internet access (out of view of CCTV cameras)
- Browse using Tails
Caveat: More than likely, nothing is completely secure or anonymous. Given enough time, money, processing power, etc. you can be tracked down. Don’t do anything to get yourself in trouble.
If you really want someone to track the hell out of you, consider buying my book from Amazon. They have ridiculous amounts of information on you. You could try subpoenaing Amazon for the information, but I hope you want a headache.
