Hacker News Reader

Comment by mikece | Hacker News Reader

Anonymity is impossible, especially online. About the best one can do is to engage in clever obfuscation though there's a benefit to creating multiple personas for online activity: it makes it easier to keep your silos of interest separated. It's not for everyone but it can be handy.

View on HN

Absolute anonymity may be impossible (it's not, actually, but it is prohibitively difficult and you have to be highly motivated to have it), but useful anonymity is absolutely attainable.

The key thing is -- who do you want to be anonymous with?

I'm not convinced that a plausible pseudonym is more privacy preserving than something that's obviously just made up. But it's not bad advice in general to post personal stuff on social media and blogs under a pseudonym if you want to be controversial.

> I'm not convinced that a plausible pseudonym is more privacy preserving than something that's obviously just made up.

I think that's true, but vibe I got from this was more about wanting anonymity and to avoid certain social frictions (and maybe not incur a trust penalty). An obvious pseudonym comes with certain costs.

Everything I post online, controversial or not, is using a persona. I have several, each for certain areas. I've been doing this for decades.

The thing is that a lot of what I post online is either directly or indirectly related to my day job. So I've always figured if I was going to have a moderately high profile public presence anyway, it wasn't worth maintaining a separate identity.

That makes a lot of sense.

My case is different. When I've run my own companies, I'd post stuff online related to that. But even then, it's under a persona -- I feel it's even more important then, actually (I also use personas in real life in that circumstance. It's very useful to be able to identify as the secretary, the sales guy, whoever, in order to dodge time-wasters such as salesmen.)

But if I'm working for someone else, I'm not posting anything directly related to my work.

>But if I'm working for someone else, I'm not posting anything directly related to my work.

Obviously depends on the company and role. I was hired in part because I had a pretty big online presence on tech topics. (In part, I was writing for CNET at the time when they still had some enterprise computing coverage.)

Indeed. In your sort of job, that's a whole different kettle of fish.

Why would it be impossible online? You can pay anonnymously for Mullvad VPN, or use Tor, or open wifi. It's online that anonymity is even attainable.

As always with a security discussion, it's about threat model.

Preventing a random internet person from tying a particular nym to you is easy. Fooling a bunch of people is harder, but doable. Being a top-tier youtuber would probably be effectively impossible.

And if your concern is nation states, well... good luck with anything.

https://en.wikipedia.org/wiki/Lonelygirl15

Worked for Satoshi Nakamoto :)

What about signing in to apps which often uses a phone # and email? Also, betting on Tor is like betting there there are no 0-day exploits in browsers or Tor's network. Not a bet I would make.

It all depends on your threat model at the end of the day. I could create a blog and social media accounts in a few hours and, unless I do something stupid, it's going to be pretty hard for Joe Random on the Internet to figure out who I am.

But if I start writing things that catch the attention of the FBI? They'll figure things out quick enough.

I am assuming you are talking about Tor. This is a sophisticated view of things and it's correct. Tor provides as good security and anonymity as a public VPN. But Onion Routers and therefore Tor were built with the intention of protecting against powerful adversaries that can perform MITM attacks. You could argue that the FBI is an even more powerful adversary I suppose but I think there is a mismatch in what Tor was intended to do in theory versus what it provides in practice and without knowing that you could be making a mistake. So I think it's unfortunate that people have to know how to do this analysis before making decisions.

Really more generally. If I create a blog on Blogger and a Twitter account--sure my identity is very discoverable by law enforcement, etc. But Joe Random isn't going to find it especially easily.

This. If you're trying to hide from governments, that's Next Level stuff. You have to be prepared to actually live underground, which involves sacrifices most people aren't willing to make.

You can set up a VOIP phone number that accepts SMS for about $2/mo + $0.01/minute.

And those carriers are blacklisted by many apps that require phone number verification.

e.g. https://www.twilio.com/docs/lookup/v2-api/line-type-intellig...

yes, I am not saying it's impossible. This is what I do. It's just a nuisance and it took me a long time to find a VOIP provider I actually wanted to use. But that said, I've seen SMS verifiers reject VOIP provider networks.

2FA mule:

https://kozubik.com/items/2famule/

You could use email aliases

And then connect to which accounts?

It's not impossible if you don't attract attention of law enforcement/intelligence agencies. If you use different usernames everywhere and don't reveal private information then a random civilian is unlikely to find out who you really are in real life.

The fact that you take any action to obfuscate your identity only makes you stand out more from the herd, not blend in.

It's like wearing a ski mask in a store. Your profile(s) are more noticeable even if you're not immediately identifiable.

Maybe to some actor that has sufficient data to correlate identities.

But if I introduce myself to someone with an alias or claim false traits, they will not immediately just know it’s fake unless they have additional contradicting information.

Most people do not casually wear ski masks, but they tend to not lie when asked for a name.

We're talking about fingerprinting here. Even a person wearing a ski mask could give a name, they still stand out because they have a ski mask on.

Deviations from the norm make you stand out, even if it's lying.

> We're talking about fingerprinting here.

I think the whole subthread is more mixed in terms of fingerprinting and social interactions. But if you only consider the the former then yes, one would probably only care about what I called "resourceful actors" to which you would end up standing out.

I was more referring to the social aspect, were if you give someone a name they will (usually) not immediately assume it is false. Thus giving a false name does not make you "stand out" unless there is already other information in play. But I'm just clarifying what I meant, considering your point was meant for a different context.

Reply on news.ycombinator.com