How I stay reasonably anonymous online (2022)

https://tmp.bearblog.dev/how-i-stay-reasonably-anonymous-online/

by randomint64 • 3 years ago

137 129 3 years ago

tmp.bearblog.dev

CollinEMac• 3 years ago

I usually delete comments, threads, or other content I put up on the internet after it has served its purpose. That means for example deleting my Reddit comments after a month or two, keeping my email inbox near empty (in case it gets hacked), deleting old accounts, and similar things.

This seems a bit extreme to me.

SamuelAdams• 3 years ago

Why keep things around that serve no purpose? Companies have retention policies for this reason - anything that is retained is a potential liability, so unless it’s legally required it’s better to delete and destroy as soon as it is not needed.

mortureb2• 3 years ago

They serve a purpose. You may never have as many eyes on it besides the few days after it was posted but it breaks a lot of historical conversation, especially on sites with useful information/solutions.

beaviskhan• 3 years ago

Deleting comments, ugh, please don't do this :( If you must, make a throwaway account instead. It sucks to find a thread that promises to solve a problem you have, but when you go there critical context is missing due to deleted comments.

notfed3• 3 years ago

Looking at you, Reddit...

whimsicalism3• 3 years ago

stylometry is far too strong

caminante2• 3 years ago

Deleting protects you against stylometry (and further identity detection)?

Ha! Wishful thinking with all of the auto-archivers. If you post on reddit, it's likely already crawled and archived somewhere.

lelandfe2• 3 years ago

launder your style through ChatGPT

I wonder if one could hook up a browser extension to do this

remram• 3 years ago

Stylometry can link long-lived identities, but can't do much if every throwaway only posts a couple of comments. There needs to be enough content to analyze. Especially if the overall community is large, like Reddit.

matheusmoreira• 3 years ago

Is there no automated way to defeat stylometry? Software that rewords and restructures writing so that it becomes unattributable? AI should be able to do it.

eur0pa• 3 years ago

[deleted]

psychlops• 3 years ago

I can't overstate how much this reflects my thoughts. Perhaps a bit wordy in your response, but the points are spot on. The internet stops here!

nativeit2• 3 years ago

[deleted while explicitly holding all other thread participants with perpetual contempt]

izzydata2• 3 years ago

Users should own their comments and should be able to delete them as they see fit. Sites like Reddit should not be used as a permanent or reliable source of information.

ihattendorf• 3 years ago

The person you're replying to didn't say they aren't allowed to, they asked them to please not because the comment might be useful to others.

giantrobot• 3 years ago

Despite the hubris and stupidity of Reddit's management, it's still a longer lived repository of information than most people's blogs or web forums. It's also more accessible than mailing lists, Discord, or other social media sites. It's far from perfect but at least it exists.

10000truths• 3 years ago

A lofty ideal, but unpragmatic if you actually care about privacy. You have no control over how information disseminates once you publish it. You must assume it'll remain on the Internet forever. Even if you assume the existence of first-party deletion tools, third parties like Internet Archive or (in Reddit's case) PushShift can choose to preserve it.

If you want to retain your online anonymity, you have to be thoughtful about what you share online.

macinjosh• 3 years ago

Welcome to HN where you can't delete your comments after a very short grace period.

mihaic• 3 years ago

I can't imagine Voltaire claiming any right to be able to delete a pamflet. I think we need to have forgiveness baked into our social layer more, so that forgetting isn't the default.

leptons5• 3 years ago

I delete my comments on reddit because it's such a toxic place. Trolls will read through past comments and twist them to harass even more. I purge all my comments that have low upvotes and leave the ones other people find useful. But a lot of the time downvotes don't mean you are wrong or said something mean, it's the just stupidity of the masses or other people being mean. It's a love/hate relationship with that site.

biogene6• 3 years ago

Somehow, I can't imagine how HN is any better. Reasonable comments are mass-downvoted when people disagree with you on seemingly hot button topics - blm, vaccines, musk, trump, immigration, lgbtq etc. I know many people who had to create new accounts because of this.

tayo42• 3 years ago

In alot of reddit you're can't post with a throwaway

yomlica83• 3 years ago

Really? Only thing I've noticed is you appear to be auto-shadow banned when using a VPN.

randomdata• 3 years ago

The valuable lifetime of a comment to me is short. If someone else sees value in it, then surely they would pay me to keep it around longer?

catchupwifurs11• 3 years ago

sounds like your note-taking & web-clipping need an update. spend some time figuring it out.

pdlozano• 3 years ago

I'm sorry but those things will not help when you discover a thread after the person deleted it

SirMaster• 3 years ago

Just use a name and username of someone else that's well known enough. Not like famous, but someone that shows up in enough search results.

So that if someone tries to search about you, they are buried in all the noise and data of the other person.

lagniappe2• 3 years ago

Or take it one step further and use a PURDAH

https://www.reddit.com/r/nealstephenson/comments/czw5og/fall...

WithinReason2• 3 years ago

You mean the pre-election period in the United Kingdom between the announcement of an election and the formation of the new elected government? Or a religious and social practice of female seclusion prevalent among some Muslim and Hindu communities?

ghaff4• 3 years ago

That's sort of security by obscurity though. As soon as someone gets a few IRL data points, anonymity can break down pretty quickly.

Personally I mostly don't bother and will use a throwaway if I really feel compelled to post some comment I wouldn't want to be linked to me. (I know even that isn't foolproof but the threat model is mostly not wanting a statement attributed to me professionally--not hiding a crime.)

notfed3• 3 years ago

Another tip: for online purchases, use privacy.com virtual credit cards.

(Did you know when you use PayPal, sites can see your email, name and address?)

brewdad2• 3 years ago

I kind of want the site to have my name and address so they know where to send my goods.

Of course, for digital purchases, your point is completely valid.

yomlica83• 3 years ago

Are you saying that privacy.com also creates fake names and addresses for the purpose of charging? I always assumed it was just another number in your name. (never used this service, but it does seem useful)

notfed3• 3 years ago

You can type any name or address and privacy.com will accept the transaction.

Security rests more on pausing/resuming cards, locking them to vendors, or setting price limits.

mmh00002• 3 years ago

Well, yes. How else will they mail the <useless junk> you ordered to you?

It does annoy me that paypay doesn't let me enter custom email addresses to give the merchant. I've had to change my paypal email address several times now due to stores selling it to spammers.

ranger_danger5• 3 years ago

I haven't seen spam in decades. What are you doing wrong?

mandeepj• 3 years ago

Besides that, make sure - your systems are not hackable (at least not easily). Use firewall, proxy server, vpn, or something like that.

Is your phone trackable with something like Pegasus? Although, an average Steve does not have to worry about that.

AlbertCory5• 3 years ago

Temporary credit cards With privacy.com, Revolut, Klarna, and similar services one can generate virtual credit cards. This is mostly for when you don't trust the website owner or the payment provider.

There are other reasons, unless you construe "trust" very broadly. Services that make it unreasonably difficult to cancel your account: you just cancel their credit card (and of course stop using the service).

You can also force an annual renewal, to prevent them from automatically renewing you.

And lastly, you can set a dollar limit on it, to avoid mistakes and "automatic" increases.

jonahx• 3 years ago

you just cancel their credit card (and of course stop using the service).

IANAL, but I have always heard that when you do this you have not broken the legal contract obligating your payment. In practice, especially for modestly priced services, the strategy will usually work. But in theory they could come after you legally for the money if you do this. It might be a real concern for very expensive services.

I would like to have this confirmed by a lawyer, though.

AlbertCory5• 3 years ago

This always comes up when I mention privacy.com. It's always a theoretical possibility. No one's ever shown a case where that actually happened (and it's never happened to me). People also say, "oh, but they'll ruin your credit rating."

You couple the card cancellation with a message to them demanding they cancel your account. Just imagine a credit card collection company agreeing to come after you, when you made a good faith attempt to close the account.

lazycouchpotato3• 3 years ago

Merchants can apparently do a "force post". Privacy.com's help page [1] says:

Broadly speaking, merchants only resort to force posts when they are faced with the potential for serious loss as a result of fraud. For instance, if you rent a car and don't return it, having a limit on a card or closing the card does not absolve you of the responsibility to return or pay for the car, and the merchant can force post the charge.

[1] https://support.privacy.com/hc/en-us/articles/360012288214-F...

PopAlongKid3• 3 years ago

Unless they can levy your income or put a lien on your assets, they can "come after you legally" all they want, but can't force you to pay. I think this is the general problem with small claims court as well -- you may win your case, still doesn't magically collect your money.

AlbertCory5• 3 years ago

Asking a lawyer if there's a risk is like asking a barber if you need a haircut.

AlbertCory5• 3 years ago

AFAICT, here's what actually happens if your credit card is declined. I'd love to have someone who works on that type of software correct me:

They send you an email saying, "please update your payment information." Because this happens every day. Hey, sometimes the restaurant tells you your credit card was declined, when it's perfectly good.

That email is followed by another, saying your account is suspended. At that point, they might give you an option to cancel, OR they might forward you to the same impenetrable UI that led you to do this in the first place.

In any case, you'll most likely be cancelled with no further repercussions. Yes, bad things could happen, but they don't. YMMV.

MichaelMoser123• 3 years ago

can they hit back with changing the credit score? (that's not just a Chinese concept) https://en.wikipedia.org/wiki/Credit_score

jkubicek3• 3 years ago

I do most of the same things. My "randomized emails" all use my personal domain, so it's trivial for people who have access to the email to know it's me, but probably not trivial for dumb ad networks to link my accounts back to me.

The one bit of leaked identity that really bugs me is my phone number. So many services require a phone number for text notifications and 2-factor auth and there's not good way (that I know of) to generate a random phone number that still works.

ZeWaka• 3 years ago

Google Voice?

lazycouchpotato3• 3 years ago

Most services can detect and block VOIP numbers like Google Voice.

ehaughee• 3 years ago

Firefox Relay offers "randomized" phone numbers along with its emails: https://relay.firefox.com

jkubicek3• 3 years ago

This is fantastic, thanks for sharing

cosentiyes• 3 years ago

I was under the impression that relay's phone number masking is voip (similarly to google voice). In my experience, many signups do not allow voip numbers.

KomoD• 3 years ago

"join the wait-list"

owenmarshall• 3 years ago

My "randomized emails" all use my personal domain, so it's trivial for people who have access to the email to know it's me, but probably not trivial for dumb ad networks to link my accounts back to me.

This bothered me as well, so I bought a completely unrelated domain to create a new trust ring. I'm sure you could link that domain back to me if you are buying information from a data aggregator, but at least that way I have the satisfaction of knowing people had to pay for the privilege ;)

The one bit of leaked identity that really bugs me is my phone number. So many services require a phone number for text notifications and 2-factor auth and there's not good way (that I know of) to generate a random phone number that still works.

Ugh, yes. I had an old phone number that I moved to Twilio & set up SMS forwarding that used to work, but everyone seems to use phone verification APIs to block VOIP numbers.

404mm• 3 years ago

Mandatory phone number has become the latest plague. Not only the phone number is mandatory but many sites now pretend to 2FA without user enabling the setting - or even worse, don’t use password and only send codes via SMS.

jkubicek3• 3 years ago

Most services that require a phone number don't use it for anything. Unless I know they're going to be texting me about something, I just type random digits.

ta8645• 3 years ago

It's amazing how quickly 4chan often doxes someone who believes they are operating online anonymously. I think most of us remain anonymous online, only because nobody cares enough to figure out who we are.

mortureb2• 3 years ago

They way 4chan normally doxes are pretty much thwarted by the basic methods mentioned here. 99% of the time it’s to trace the same username/email address across sites and link that to a person aggregator or Facebook/LinkedIn.

hn_throwaway_99• 3 years ago

I think this can lull people into a false sense of security, and I don't think the author realizes how easy and powerful stylometrics is. E.g. the author says this:

Spelling/grammar/phrasing If there are words you often misspell, people can Google it to find other sources where you make the same error (if it's uncommon enough) and potentially identify your other accounts. Use spell checking and maybe Grammarly or similar to minimize this risk, but I tend not to worry about this too much.

It's not just about misspellings, it's that we all basically leave fingerprints in the way we write.

ghaff4• 3 years ago

You're not wrong and I assume it will become even more powerful--but it's almost certainly way more effective if you have reason to believe that throwawayxyz is so and so IRL.

bruce343434• 3 years ago

Relevant (the site has since been deleted)

Show HN: Using stylometry to find HN users with alternate accounts

https://news.ycombinator.com/item?id=33755016 (676 points by costco 9 months ago | 519 comments)

bluefirebrand• 3 years ago

Time to start laundering all of our online posts through GPT I guess.

bee_rider• 3 years ago

I wonder if privacy conscious people will eventually start feeding their posts into locally-run LLMs or something, and posting the output.

Or better yet, replace social media with LLM’s, instead of reading individual posts you discuss topics with a sort of artificial gestalt average user. Maybe let people “join” a gestalt by tagging their discussions.

Then we can let the gestalts argue amongst themselves!

brantonb• 3 years ago

I assume any anonymous surveys at work that roll up through my management chain aren’t anonymous at all. My manager will get responses from only ~10 people and my writing style will be unique within that small sample size.

gumby2• 3 years ago

Password managers help a lot. Site asks for a birthdate? Whatever I choose to enter goes in the password manager. My mother's maiden name? I guess I can reveal publicly: it's fgjlh%ngf9, so into the password manager it goes.

My password manager offers to generate a password for me; I wish it would offer to generate those other fields as well.

Turns out you can fuzz your address too when validating a credit card. Autofill should handle that.

PopAlongKid3• 3 years ago

Turns out you can fuzz your address too when validating a credit card.

My experience is that only your ZIP code is used, not your street address or city.

gabereiser• 3 years ago

There are levels. To authorize usually only billing zip is required. For a full ACH or a “full authorization”, you need the full billing address and name to match name on card. PCI-DSS.

ranger_danger5• 3 years ago

It depends entirely on the merchant and what checks they have enabled. Some people like authorize.net may even lower your fees/bills if you require stricter address verification for example.

camgunz• 3 years ago

My mother's maiden name? I guess I can reveal publicly: it's fgjlh%ngf9, so into the password manager it goes.

Echoing: never actually answer security questions. Always treat them as additional (super annoying) passwords.

jstarfish3• 3 years ago

If you do, at least give them a misleading but coherent response (my first pet: grandma).

I've bypassed my own bank's security questions by telling them "the answer to 'my favorite ___' is a bunch of gibberish letters and numbers."

jdjdjdjdjduuuu• 3 years ago

KeepassDX allows you to create and copy/paste custom fields which could be used for security questions (on Android).... It doesnt generate random strings for them thought

tennisflyi• 3 years ago

A password manger helps with keeping up with which fake names/DOBs you used if you need to reset the password/recover the account or whatnot.

jacobwilliamroy• 3 years ago

The one thing I don't see mentioned in this article is using encrypted DNS. Right now I use firefox on my PC and Opera on my phone because both browsers have a setting to use encrypted DNS. I just turn it on and forget about it. I tend to use a lot of networks other people own and I like making sure my DNS queries are encrypted.

PopAlongKid3• 3 years ago

Getting a commercial mailbox (e.g. UPS Store) in the same zip code as your primary residence can be helpful. I've had one long enough that on my credit report it is listed as an alternate residence address. Whenever I'm asked for an address online, that is usually the one I provide.

867-5309• 3 years ago

that serves no purpose in anonymity whatsoever

jstarfish3• 3 years ago

Yes it does. It muddies the waters with false positives.

PrimeMcFly• 3 years ago

Throwaway accounts and fake names for everything as much as possible, as well as a fake address or a paid PO Box if a real one is needed.

Not using the same accounts between services, and distorting real details like city.

Seems to work pretty well. I'm pretty invisible based on my own research.

ella-hashir• 3 years ago

1. do not use any extension, believe me they acquire all your browsing history from all tabs, no extension no worry, only use those that have higher users but review their permission 2. use enhances protection this will save you from most of the time. makes sure do not store password on google , write them on paper no social media login from same computer. do not click on any ad and website, especially in email do not use your email to sign up on different sites, use disposable

biogene6• 3 years ago

I don't know to what extent this person goes to hide their legal name, but with public records, its fairly easy to find your residence if you own a home or some other property.

ilamont• 3 years ago

Tor, Tails, surfing from an open WiFi, VPN, encrypted emails, etc These things are usually outside my threat model.

Can anyone break this down? If a person were concerned enough to follow all of the steps listed in the article to stay anonymous, why not also use a VPN or Tor as an additional layer that can thwart many types of tracking and provide additional risk mitigation?

ranger_danger5• 3 years ago

tor/vpn/proxy by itself does not provide adequate anonymity. creepjs proves that ALL browsers are unique (even TBB) if someone just probes the right bits.

Bu9818• 3 years ago

I don't disagree with you, except browsing creepjs from Tor Browser it says there have been hundreds of visits with my fingerprint since June (when the 12.5 series was released).

ranger_danger5• 3 years ago

creepjs proves it is absolutely impossible to be anonymous when visiting more than one site from the same browser, regardless of your IP/network/VPN/proxy/etc.

Even the Tor Browser doesn't fully mask your OS (javascript functions still return the real thing), making anything but Windows (what the majority uses) impossible to use for any real privacy if you're trying to blend in.

iteratethis• 3 years ago

This entire list will soon be obsolete as AI will link all your accounts by just giving it some of your text input.

I believe I saw an experiment of somebody doing this for HN content with a pretty high accuracy? Project that idea into the future.

How I stay reasonably anonymous online (2022)

Related Stories