How to hide your IP address
educatedguesswork.org
educatedguesswork.org
However, I think that worrying about your IP address and encouraging the same as a major "Security Thing" is missing way more important aspects of IT security. For many people who follow your line of thinking via your blog and say the ads for VPNs and the like, they might feel they have achieved "security" by obfuscating or hiding one small aspect of their on-line life.
Online profiling is generally way more detailed than an IP and will include browser finger printing (agent string) and fonts loading, and much much more with some pretty impressive Javascript tricks.
I live at 1 Eldonthingie Road, BendInARiverTown, Summersetshire - I have obfuscated that lot quite a bit but not too much that a determined person could work it out and see where I live. Back in the day it would be published in the phone book for all to see.
There are way more important security enhancements that you can deploy before you worry about VPNs and that. I only use a VPN when off site and need to get back to the office or home.
Today, I was working on a customer site and they have a TLS man in the middle box which buggered up my VPN (OpenVPN on 443/tcp) That costed them an additional four hours of my time at my rate!
Getting real anonymity online is way more complicated than I think most people realize. Then again maybe that’s fine, it depends on your threat model.
Firefox drove me nuts with this. This article helped:
https://support.mozilla.org/en-US/kb/how-stop-firefox-making...
That won't stop the OS or a bunch of other apps from making a bunch of connections, but at least you can beat firefox into submission
You can disable all of the built-in LS rules for macOS services and never make/use an Apple ID (so, no App Store, no iCloud, no FaceTime, no iMessage, no Apple Music, etc) and your mac will still work to launch local apps just like it did in 1999. This is how I use mine.
Note well that you must install LS on a fresh boot offline, before you connect the mac to the network, otherwise APNS will phone home from your IP with client certs that are linked to your hardware serial number.
I give friends cash to order the new/fast BTO macs to their addresses on their payment cards, then go pick them up from them; you can't usually get the max-spec apple stuff for cash at the store.
Like the 16" M1 Max with 64GB & 4TB SSD is the 'ultimate' retail config for that model for example.
Really a must have, for me.
I had an application that was phoning home and after some digging I found that it was doing so through DNS. It would lookup something like $KEY.some.domain.com and the response would decode to the value.
My data isn’t up for grabs for profiteering/aggregating/snooping on, sorry.
EDIT: Your comment made me curious so I will do more due diligence and return with an update.
EDIT2: So after not that much investigation--mostly just rereading what's shown on their project page (https://github.com/henrypp/simplewall) -- it confirms my belief that this adequately shields me from any and all networks without my knowledge or consent. In my opinion, it's kind of dystopian that The Industry basically operates on the assumption that most people will in fact just not care, but maybe more would care if it was presented as more of a choice than a concession.
Like, I don't mind sharing for the purpose of analytics. I read through privacy policies (is this being an adult?) kind of frequently these days, and as much as I hate to say it, Apple is still probably what I consider the poster child for big tech data privacy, they are doing the absolute bare minimum by clearly and plainly disclosing what data is used for what and how, and it allows my mind some rest.
EDIT3: Proof shown here https://github.com/henrypp/simplewall/issues/980
You can't use iMessage if you want privacy from Apple; trying to block phone-home to Apple while still using their hardware-serial-number-linked-services is silly. You have to give up iMessage, FaceTime, Handoff, iCloud, App Store, Apple Music, all of it if you want privacy from Apple (obviously).
The reality of our tangled mess that is data privacy issues is really almost grotesque at this point.
But the OP doesn't state anything to the contrary.
You are what-abouting a completely sound, thoughtful, and helpful article about one small piece of the privacy puzzle.
The culture of internet celebrities is growing significantly with twitch/YouTube streaming. People are dangerous, and will harass and stalk.
Swatting is also still very real, it's a common occurrence for major content creators.
Yes you should do more, a good VPN is essential if you interact with other people online.
What do you mean with "back in the day"? Is this not common practice anymore? In my country all this data is public information, including your social security number and tax records. The only way to obfuscate it is to get a "protected identity" court order but even then I think it will only hide a small fraction of your PII.
Multi hop makes it more difficult. You could chain a bunch of proxies together to make trivial correlation attacks much harder, just like Tor does.
As for Apple's private relay: it's a cute idea, but Apple has other telemetry endpoints it can use to see what you're doing on a device. Whilst private relay does the job, you are surveilled in other ways by Apple, so it's really a marketing ploy and 'privacy washing' on the part of Apple.
Then there's extreme steps you can take like booting a Whonix workstation coupled with a gateway if your threat model requires it and you really don't want to be decloaked.
Most are happy buying a few SOCKS5 proxies and calling it a day. You can mess with AD tech by regularly changing your IP and surfing in isolated sessions to stop cookies correlating your old IP with your new IP.
For Apple, it is a privacy breach only if its 3p services tracking users on iDevices. 1p is perfectly fine. 2p is kind of okay.
That's fine if you don't mind sites either not loading, loading reallly slow, or tons of captchas and loss of functionality.
Virtual desktops with AWS via disposable credit card is pretty good, imho.
there's zero chance that you can create an AWS account with disposable credit cards, presumably for fraud/spam related reasons. Even many VPS providers will reject prepaid cards for the same reason.
1. you can't create aws accounts with prepaid cards
2. the reason why is that aws doesn't accept prepaid cards, because people use them for fraud/spam and they want to stop them.
if you think, that vpn protects you from anything, i have a bridge to sell you. Oh and lets not get started about a lot of propriary software that does exactly the same. Or how apps that you use once a month need background updates.
I have a customer that uses a 10 year old inventory system, that came to me with the problems that it "sometimes freezes" for a couple of seconds. It does that when their "tracking server" takes a couple of seconds to process the request and once that is done, he has peace for 15 minutes. Guess what the software is not doing in those 15 minutes?
Also please dont get me started on IP Cams, im conviced that if there is a a tech i like to use, someone alreday installed some redicoulus metrics system into it and calls that "customer insight".
What is the thing with the "I have a bridge to sell you" meme going on? Is that a new synonym for "you're wrong but I don't feel like explaining why"?
Team Cymru are collecting flow records from backbone routers worldwide, with the permission of the ISPs. They claim to be able to trace through VPNs by simply looking at the timing of flows. https://www.team-cymru.com/pure-signal-recon-threat-hunting-...
Perhaps we should try experimenting with satellite or radio data broadcasting? Just send highly compressed text to make it low bandwidth? Then anyone can receive the stream without intelligence agencies from finding out. Ever. Assuming it's a receiver that cannot physically be connected to a network. Bye bye NSA and GCHQ surveillance... For good this time.
By the way, here's an example of a satellite data broadcasting system that's actually in operation: https://blocksat-reader.herokuapp.com/
I also dont believe that there is really an incetive for corporations to keep the web "free" (as in freedom) and while - A LOT - of people are hyping the crypto scene or TOR as solutions, I have come to think, that we soon simply have identiy tokens (on cards or phones or usb sticks) and that identity will be provided not requested.
Its what the movie studios wanted since the 90s, its actually what your government wants too!
I finish with the thought that blocking the api for adblockers on chrome is only the beginning. And yeah, firefox also sends home a lot of data. We as programmers need to find solutions to this. It would be organized open source, but without proper funding, noone is going to be organized
I also feel like ""you're wrong but I don't feel like explaining why"" is a bit harsh, because what i mean is that your ip address is not even used in most high end tracking softwares anymore. There are much more elaborate ways to track you and everything you use.
So what you are suggesting is to host software on my private ip (which changes) in order to have the trackers interpret this as "ohh this is hurrudurrs webserver making requests and therfore not an individual!"?
I can see how this helps when someone is actively profiling me, like listening in to my connection, but does it help me further´?
Someone knowing your IP address does not matter. It is not private information.
I mean sure, not everybody needs and AKS supercluster, but so far im still seeing the advantage of self hosting besides the point that "my users made those requests to the illicit servers your honor" which at least in phase two means strict logging for you.
I did the math recently and abandoned the "bare metal k8s at home" theorem simply because the energy cost at 30 Eurocents and hour are already more that the vm im renting with limitless traffic.
Im also not a tor end node, because, at least in europe, you are responsible for the traffic that leaves your home connection too.
The electrical cost is extremely marginal. But I guess I was just assuming if you're going to host your website from home you're a geek and you already have computers running.
Of course High availability matters to me because i can be proud of what i build. No Its 2022 its not enough to just make public your /var/html/ folder and call it a day. While creating my rootles container builds i learn about the software that i am putting into my servers.
No its not okay for my site to be down for a couple of days because if i would not assume someone would be using it, why do i bother to create content in the first place?
Finally talking about electrical costs: 3 pies with k3s is about as much power as some people put into their IDLING graphics card.
sure come to my site learn about all the awesome stuff I did as a resume, that's totally not what my blog is about :D
My Blog literally headlines that i want to give back to the people that taught me tech over the last 20 years, nothing more and nothing less. there is also no cargo cult, because i have not told a single soul besides you how this runs and is hosted :D
Stupid technologies, and cargo cult stuff, you seem bitter my friend. I come from a time where you didnt have websites but shared folders, that worked too! Just as going to the library did.
Please dont get me wrong, I can setup a nice http server from bash scripts that runs on an egg timer for you too, I just dont believe that it is appropriate and usually iam actually hired to get rid of the stuff that "has worked for the last 15 years, we dont need no updates" ;)
DO NOT do this if anything on your website might make other people want to kill you while you sleep, or if you anticipate becoming prominent enough to be read by the criminally insane percentage of the general human population.
Your home IP address (along with a timestamp) is a single cash bribe away from the physical location where you and your family sleep unguarded at night.
If you wouldn't put your home address on the website, don't host it on your home IP. It's the same thing in the hands of a motivated attacker.
My wife is a massive FB user (int al). She and I (I have one too but I don't use it much) have been sold on many, many times. Our data will have sifted down into all sorts of places, Nothing personal - it's just data.
We have Android phones - Samsung, UK: O2. Oh, so now Microsoft (preloaded and enforced), O2, Google and who knows else are in scope and wanking over our data.
Now, I'm an IT bod and I know that I've allowed things to work instead of breaking the cycle completely. I'm not quite sure what is a healthy data grab yet. Do we go all in or not?
I do know that you don't fiddle with third party VPNs if you are worried about privacy - that's just daft. If you VPN - then you should do your own VPN.
If you’re worried about committing crimes than a VPN is relatively pointless - it slows down the law a bit and some may be difficult to penetrate but if you keep using it they can be.
And if you have a nation state you will want to layer things and almost certainly use tor.
This is my whole point. Most VPN customers aren't trying to commit high crimes, they're doing things like getting around region blocks (e.g. Netflix doesn't allow viewers in the USA to watch show X, but it is available for viewers in Canada for some stupid reason), torrenting (much safer legally if your traffic is going through a different country), or trying to obscure their IP address and/or location for some reason. Offhand, I'd say the region block thing is probably the #1 reason these days.
Generally speaking, when push comes to shove, their “no logs“ policy lets them turn over whatever information $law_enforcement_agency asks for.
I have a super-cheap VPS which I setup wireguard on but that’s 100% to get around whatever safety filters the random free Wi-Fi networks I connect to throw up. One of them blocks YouTubes videos, not YouTube itself but just the videos — which actually makes it pretty speedy since I don’t have to compete with other YouTube watchers.
Not really, no. No company is required to cooperate with law enforcement from foreign countries.
So if you're trying to hide activity from government X, and you use a VPN in country Y, you don't have much to worry about. A US-based VPN, for instance, is going to laugh at demands from the Chinese police for their logs. Similarly, a Hong Kong-based VPN is going to laugh at demands from American police.
You're treating this as a "black and white" scenario, which is wrong in my opinion. There are also a few trustworthy VPN services which don't log, and do respect privacy.
However, obviously they can be forced to log your connection, in case a government wants to solve some crime/threat. But this is just the same for VPS providers, so there's no advantage there.
I wonder if a tl;dr with concrete advice in non-technical language would reach a much wider audience. I know the technology professionally, I already understand almost everything in the article (that I read), and I'm not sure what you are recommending - Tor? Apple's proxy service (whatever they call it)? I think Brave offers something now? Firefox VPN?
Also, another reason "even the best system provides only limited protection" is that there are many other ways to track people. I know the article is about IP addresses, but a non-technical reader might not grasp that IPs are only one piece of a larger puzzle.
I see you touched on Private Relay and QUIC but chose to not discuss IETF MASQUE working group standardization of it. In general, as oblivious HTTP, IP over QUIC, Private Proxies over QUIC etc continues to gather pace (surprisingly, it is Google alongside Cloudflare and Apple leading the charge), do you think browsers bundling in tech (relays, proxies based on blind tokens etc) to mask IPs would be the default and free going forward? How do you see trackers adopt to this new reality, in that case?
Thanks.
It seems to me that the main obstacle to having really widespread proxying is financial: there are substantial incremental costs to proxying the traffic, someone needs to bear that. I expect this is why Private Relay is part of a iCloud+ rather than free for everyone. So, I'm not sure how that's going to shake out.
Which gets at the problem- anonymity. Your physical mail habits are not completely collected and retained. And your electronic footprint has FAR surpassed your snail mail equivalent in the 50 years since the invention of IP. Your electronic footprint can reveal at your minute-by-minute location (maps), your buying habits, interests (searches, reddit subs), and a whole lot more (especially over time).
IP addresses are used for routing, which requires them to be structured.
The basic idea here is that your ISP advertises a route that consists of a "prefix", i.e., a block of addresses it controls. So, for instance it might advertise 192.0.2/24 which means "Every address which starts with 192.0.2". That means it can only give its customers addresses in that block. So, it could randomize which customers have which addresses, but it can't give them anything in 192.0.3 because that's in some other block.
The question of why it doesn't shuffle the addresses is more complicated, but the TL;DR is that it's a pain for the ISP to do.
I'm using IPv4 addresses as an example here, but similar concepts apply to longer IPv6 addresses, except that customers are given a block of addresses themselves that they can allocate internally. They can randomize the low order bits but the customer's block (prefix) is routed the same way as I described earlier, and so that can be used for tracking if you just ignore those bits.
https://en.wikipedia.org/wiki/Carrier-grade_NAT for the main example, although even in cases where IPv4 exhaustion is not as imminent, you might be assigned a dynamic IP address. (Whether that dynamic IP address rotates on a regular basis is another question... but it's really just the ISP reserving the right to do so.)
In general, you need some stable identifier for a connection. Traditionally (namely with TCP) that's been the "5-tuple" (source IP address, dest IP address, protocol, source port, dest port). This provides network routability and dispatch to the appropriate application within a host. Your ISP can't just rotate your IP address without breaking all of your existing TCP connections.
With QUIC, that identifier is now the QUIC connection ID (although you still have the 5-tuple). Connection migration (if supported by the application) could allow you to persist a connection across lower-level protocol events (even something as drastic as switching from WiFi to 4G, where you might not even have the same ISP).
TOR isn't adequate too, far too many state actors maintain the nodes.
Only option is to use a public WiFi. There are still issues with public WiFi usage but it is still far better than other options listed.
That being said, Multi-Hop VPN is more secure than single hop as the article claims.
Personally, I run a public DoH resolver behind Cloudflare for a similar purpose. "IP-fronting" as I like to call it.
Not that I need it but it sounds like an interesting way to spend an afternoon.