The Internet is not anonymous

[rand]

There is a common misconception of the Internet being anonymous and that simply is not the case. Everything that is done has a data trail. Every aspect of computer operation leaves a traceable digital trail. Lets start by connecting to the Internet, every system has a signature and can be viewed as a browser header. Want to view your systems specs? Follow this link: https://www.grc.com/x/ne.dll?rh1dkyd2

It will show your browser type and version / your os / and if your connection is secure or not.

This raises the issue of browser fingerprinting: http://crunchbang.org/forums/viewtopic.php?id=24722

Prevent Browser Fingerprinting [still in about:config]

For all Firefox Versions after 17.0 [you should be using current versions and update them regularly anyway - to do this go to "preferences"->"advanced"->"update" select: "automatically install updates" & "warn me if this will disable any of my addons"] [not required for iceweasel]

For the following changes right-click in about:config and select "new"->"string" and enter in this order:

Variable:                 
             Value:

general.useragent.override
  Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0 

general.appname.override  
 Netscape

general.appversion.override
 5.0 (Windows)

general.oscpu.override    
     Windows NT 6.1

general.platform.override 
    Win32

general.productSub.override
 20100101

general.buildID.override  
  0

general.useragent.vendor  
  [enter variable - but leave value blank]

general.useragent.vendorSub
 [enter variable - but leave value blank]

intl.accept_languages     
 en-us,en;q=0.5

network.http.accept.default
 text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

network.http.accept-encoding
 gzip, deflate

---disable browser cache:

browser.cache.disk.enable:false

browser.cache.disk_cache_ssl:false

browser.cache.offline.enable:false

browser.cache.memory.enable:false

browser.cache.disk.capacity:0

browser.cache.disk.smart_size.enabled:false

browser.cache.disk.smart_size.first_run:false

browser.cache.offline.capacity:0

dom.storage.default_quota:0

dom.storage.enabled:false

dom.indexedDB.enabled:false

dom.battery.enabled:false

---disable history &
localization

browser.search.suggest.enabled:false

browser.sessionstore.resume_from_crash:false

geo.enabled:false

---misc other tweaks:

keyword.enabled:false

network.dns.disablePrefetch:true
-> very important when using TOR

network.dns.disablePrefetchFromHTTPS
-> very important when using TOR

dom.disable_window_open_feature.menubar:true

dom.disable_window_open_feature.personalbar:true

dom.disable_window_open_feature.scrollbars:true

dom.disable_window_open_feature.toolbar:true

browser.identity.ssl_domain_display:1

browser.urlbar.autocomplete.enabled:false

browser.urlbar.trimURL:false

privacy.sanitize.sanitizeOnShutdown:true

network.http.sendSecureXSiteReferrer:false

network.http.spdy.enabled:false
---> use http instead of google's spdy

plugins.click_to_play:true
---> also check each drop-down-menu under "preferences"->"content"

security.enable_tls_session_tickets:false
---> disable https-tracking

security.ssl.enable_false_start:true
---> disable https-tracking

extensions.blocklist.enabled:false
---> disble Mozilla's option to block/disable your addons remotely

webgl.disabled:true --->
disable WebGL
([url]http://security.stackexchange.com/questions/13799/is-webgl-a-security-concern[/url])

network.websocket.enabled:false
---> ***Tor Users: This is extremely important as it could blow
your cover! See: [url]http://pastebin.com/xajsbiyh***[/url]

---make your browsing
faster:

network.http.pipelining:true

network.http.pipelining.ssl:true

network.http.proxy.pipelining:true

network.http.max-persistent-connections-per-proxy:10

network.http.max-persistent-connections-per-server:10

network.http.max-connections-per-server:15

network.http.pipelining.maxrequests:15

network.http.redirection-limit:5

network.dns.disableIPv6:true

network.http.fast-fallback-to-IPv4:false

dom.popup_maximum Mine:10

network.prefetch-next:false

browser.backspace_action:0

browser.sessionstore.max_tabs_undo:5

browser.sessionhistory.max_entries:5

browser.sessionstore.max_windows_undo:1

browser.sessionstore.max_resumed_crashes:0

browser.sessionhistory.max_total_viewers:0

browser.tabs.animate:0

This creates a fake-profile of your browser via the readable HTTP-headers it sends.

Check out if your browser is profilable.

With all the above settings I get 8.1 bits of identifying information at Panopticlick for my browser - which is really good.

Considering:

"In particular, a fingerprint that carries no more than 15-20 bits of identifying information will in almost all cases be sufficient to uniquely identify a particular browser, given its IP address, its subnet, or even just its Autonomous System Number."

Source: EFF's "Browser Uniqueness" [page 3]

Also check your settings on ip-check.info - but don't rely on it. Apparently they are quite busy promoting their JonDonym-Browser and services - which quite frankly I don't think anyone needs. I would rather warn you to use it since according to this defcon-talk JAP/JonDonym has implemented tracking-features which are disabled by default but can be activated anytime. So don't use it.

Now, after having configured your host-based security and your web-browser we can start connecting to the web. But there are different options:

Now lets look at our plugins: addblock, https everywhere , noscript, dissconnect, and disable flash + java

 

Lets secure our connection with openvpn and find a service that does not keep logs and is located outside of usa. Then when connecting launch openvpn then load up tor with flash disabled via noscript and security slider at max.

 

Lets hit on data retention, most isps keep logs for 6 months (comcast usa) all the way to 1 year in other counties (Italy). While google/youtube saves searches are 9 months from day/time/ip/isp of search string + user data before being obfuscated.

 

Lets hit on deep packet inspection:

Dpi is everywhere and most people have no idea what it is. Isp's used dpi at first for network protection and to detect denial of service attacks and buffer over flow attacks and redirect network data packets for packet by packet analysis. This technology provides incredible network surveillance when analysing a users data stream. Every file has a md5 checksum, if you download a picture/application/file it goes threw your isp and is logged and compared vs a running blacklist of checksums. So how do you bypass dpi? The answer is end to end encryption of your data. Tor is a easy option / openvpn / non logging proxys located outside of usa and using https as much as possible.  So in short connect to a safe proxy then launch tor with safe settings and your good to go.  If the average computer user knew the levels of snooping the government does on its citizens everyone would be using more encryption.  But when it comes to encryption if it takes 1 click to encrypt something that one click is too much for 99% of people using a computer.

 

 

browsing tracking signatures:

This comes to a shock to most people but you dont have to be logged into any websites (youtube/facebook/myspace) to be completely tracked on the internet. For this example your running on non openvpn connection but at a library on a open public terminal. We all have favourite websites we like to check on a daily basis. That order/frequency of websites that you open can be used to track you but its effectiveness is minimal.

 

Outside of internet tracking:

Do you own a cellphone? What about a tablet? Do you wear cloths? Ever walk around in public? Drive a vehicle? Ever travel? Have you ever stepped outside on a cloudless day?

 

 

Back in the day (1950s-1990s) in order to place a “bug” or wiretap on a data stream (phone line / undersea cable – operation ivy bells / house) it required a physical device to be installed on a tap point. Now that is quite different. Most people have a small embedded computer running in there pocket called a cellphone. Everyday we are leaking HUGE amounts of data just by our cellphone, this includes our location, applications that have access to gps, applications that have access to call / txt logs and passive tracking via cell tower triangulation. In the navy we were taught how to triangulate radio transmissions and it can be done by software and your postion could be reported to who ever. And it accuracy can be increased if you have wifi on your phone that is active and trying to gain access to every network access point. Tablets can be tracked in a similar manner via wifi.  People have services on tablets / phones to tweet if they enter a location to there livestream and it makes the ability to track people very easy.  I don't understand the need for such transparency and lack of privacy.  To me that is a huge exploitable risk that is not worth taking.

 

Most people dont think about rfid tags but they are everywhere including cloths. Check yourself right now on the tag of the cloths and cut it off and take it apart. Odds are there’s a small rfid tag inside. The purpose is largely unknown but it can be used to track customers in a store so the business can know what products they were standing next to and for how long to gauge interest. Just walking around anywhere now that has camera you will run into facial recognition software on a daily basis. If you drive a car there is licence plate readers mounted just about everywhere on freeways and rfid tollbooth so you can automatically send a payment from your account.  You can also remotely disable a car now via its engine computer.

 

Because of 9/11 and the “never again” statement by the fbi and cia to prevent terrorism everywhere you go is logged. Its next to impossible to travel now with out a visa or passport and not get checked at the boarder believe me I have tried.

 

Anyone can be tracked by satellites by pointing very high power lenses at earth with the ability to even read a watch from orbit and that was back in the 1970's. With the advent of low cost drones it makes on-demand surveillance fast and cheap and all you have to do is walk outside.

 

 

In short we live in the software age and this allows for very easy tracking of online activities as well as offline. There is nothing new about this problem. The internet was not built to be anonymous there is an alarming amount of people that don't know this and treat it as such.  This post was generated in response to: 

On other forums if i brought back a dead aka ancient thread from 2011 it would have been locked and mibz would have yelled at me.  This thread was made in an effort to provide new content instead of just beating old dead threads to death.

Edited June 4, 2016 by rand
syntax errors and other english problems fml