What’s more remarkable to me is how people don’t see how easy it is to set up a clean surface identity and discrete secondary identities, and hide in plain sight.
> Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? [...] Privacy will be [...] the effective capacity to misrepresent yourself.
> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. Your fused identity is not a question unless you work to make it be. Lest you think that this is a problem statement for the random paranoid individual alone, let me tell you that in the big-I Intelligence trade, crafting good cover is getting harder and harder and for the exact same reasons: misrepresentation is getting harder and harder. If I was running field operations I would not try to fabricate a complete digital identity, I'd "borrow" the identity of someone who had the characteristics that I needed for the case at hand.
OPSEC is hard. You leak incredible amounts of data, and modern analysis techniques reveal a lot more than most people realize.
Re: your secondary identity - how do you plan on obfuscating the changeover events so the usage times (and/or network entry/exit times) of your secondary identity are not the inverse of when you use your primary identity? I recommend ZOZ's talk "Don't fuck it up!"[2] for a better sense of just how hard is to do proper OPSEC in the modern age of surveillance.
We reveal so much more about ourselves than we could ever imagine. If you use, or used Reddit, Snoopsnoo [1] is a site that uses incredibly primitive language parsing to build a profile on users based on what they've voluntarily submitted. And again I have to emphasize that is using very primitive parsing. It's disconcerting how much we reveal when an algorithm is able to rapidly and effectively piece it together.
Now when enter the government that data can be cross matched against other meta-data to nail down your identity to a very small segment, if not outright match it. And then we get into things like language analysis. I make some token effort to anonymity, but my wife has mentioned she often knows its me posting before seeing the username. And I can do the same for other people I know well. No idea what we're picking up on, but it's a task that machine learning would be phenomenally well suited to do - and do better than we do. And then there are things like more explicit dialect issues. This [2] is a quiz based on American dialects. Again it is phenomenal how much your vocabulary, which undoubtedly you view as 'proper', actually reveals your location. Our very language is not only a finger print but also a geo-tracker.
[1] - https://www.snoopsnoo.com/ [2] - http://www.nytimes.com/interactive/2013/12/20/sunday-review/...
Anyway I'm not that impressed it had me down as either coming from Providence (because I pronounce mary, marry and merry different), or Santa Rosa or San Jose (because I'd never heard of a drive through liquor store which actually seems a mental idea, from a UK perspective). I know it's not supposed to work on me but there's a massive distance between the first and last two places based solely on one data point.
Makes me wonder how this would fare in a smaller country like the England or Scotland, etc.
As someone who doesn't know much about American dialogue, do people over there really use similar wording? Or is the quiz just coming up with random answers because it has no clue what to suggest?
Friends and family might have a hard time tracking your discrete secondary identities, but your ISP or facebook might see it very transparently.
It of course won't work well against police, who can look up the VPN provider, ask who's paying for it, and it's mostly enough to find you.
Forums: often the need for a separate identity arises from the need to join a particular forum frowned upon by your peers or superiors. Same for audience. That is, if you want a different persona and not a sock puppet to support your "main" persona.
Timing: this is also solvable if you want to.
For example, "okay, so you have one account exclusively post hard core right-wing arguments in the early morning, and then your second account posts left-wing arguments in the mid-afternoon."
At that point, what's the point? :-)
All these three personalities need not be connected in any way, nor need they contradict each other in what they say. They are just for different and unrelated facets of one's life.
Possible? Maybe. Easy? No.
And about style. Mirimir only writes in English. I draw on my experience working with Americans, including many from the South. My meatspace identity never uses English online.
I suppose someday they might implement features to try to detect and filter out that kind of thing, but then it will time to abandon the platform totally.
(Also, creating secondary identities is easy on paper, but IME segregating myself like that and presenting a fake persona takes a psychological toll. Perhaps others are more adept at it.)
Me, I enjoy having multiple personas :) I also enjoy writing about this stuff: https://www.ivpn.net/privacy-guides/online-privacy-through-o...
Mirimir is a rather unique name, Google turns up a lot of results which seem to be you, so it’s not hard to see what mirimir is interested in. I’d assume ad networks also have a pretty good profile on mirimir too.
I’m sure there’s more to you than just mirimir, but it’s probably a big part of who you are so what does this really gain? Your real name isn’t revealed, but that’s just another persona. Potential employers won’t find you are interested in opsec through Google, but I’d assume you work in that field anyway. I’d guess having the choice of what to reveal is an advantage, but it’s very easy then to reveal too much so that personas could be put together (e.g. Steve who is the friend of another persona on Facebook, comments on mirimirs article).
Maybe people aren’t going to come across your non-work interests in (e.g.) steampunk or painting dragon pictures, but so what? For most people that is part of who they are, and they don’t care to hide it. Maybe if you have something to hide this is a good idea, but I’d say most people don’t (given how many post private details of their life online).
Personally I use my real name online. I’ve considered switching to pseudonyms to make it harder for casual people to stalk me, but at the end of the day I’ve already revealed so much that it’s not going to help much, and there isn’t anything I feel the need to hide.
Yes, Mirimir is rather unique. There's that South American woman, and a travel agency in Iran. But still, yes. I picked it because "мир и мир". And name recognition is intentional.
Indeed, Mirimir is a big part of my online presence. I've worked hard on that persona, for some years. And it occasionally gets me into interesting stuff, even some consulting work.
My meatspace identity is distinguished from Mirimir in three important ways. First, I rarely use English. Second, I don't work on OPSEC, or display any interest in anything related to that. Third, I don't have much of a public online presence. All of my professional work is private, as required by clients. And my social life stays just about totally in meatspace.
The rest of my online activity goes through nested VPN chains, routed through the main VPN. So it's only the final VPNs in those chains that see anything except throughput patterns.
I routinely have several workstation VMs running, each connecting through its own VPN chain. So, while I'm drafting posts for HN or whatever, I'm typically doing stuff in other VMs. It's pretty much like most people do with apps in multiple windows, or SSH logins, or whatever.
And Tor. I've never connected directly to Tor. I only connect through nested VPN chains, at least three deep. So yes, I consider Tor use to be a serious risk.
In this regard, you might well be one of the very few 0.000000001% for whom that statement might be true.