Skip to content

Instantly share code, notes, and snippets.

@allquixotic

allquixotic/in re closed question.md Secret

Last active August 29, 2015 13:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save allquixotic/f30666853189abee6c9d to your computer and use it in GitHub Desktop.
Save allquixotic/f30666853189abee6c9d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
in re closed question.md

Your question is unanswerable because the crux of your question is

Would this be enough?

For any set of actions A, the question of whether A counts as enough depends on how imaginative you are, in terms of what might happen that could conceivably cause the identities to be "merged" into one, in the eyes of a given individual.

Some things to consider:

  • Almost regardless of what you do, Advanced Persistent Threat (APT) organizations, such as the NSA, will be able to fairly easily merge two alternate identities into one, simply by using their privileged status to force VPN vendors or service providers to disclose information about who connected and when, under what IP and under what account.

  • On the other extreme of the spectrum, a typical person who is not well-versed in technology will be unable to tell that you are one person running two accounts, even if you use the same IP and web browser to access some website, and just create two accounts with different email addresses, and don't use a similar-enough writing style (same typos, etc) to be detectable as unique.

The problem is that the information (the core set of knowledge itself) surrounding your control of two "separate" online "personas" is not cryptographically secure. It is impossible, indeed, to make it cryptographically secure.

By "cryptographically secure", I mean that it is possible, in a reasonably small number of "steps", to define exactly how the personas merge into one, i.e., you the real-life person.

Take for example the situation that you described. Assuming that legal and company-private barriers are immaterial to the attacker, they can obtain a knowledge-chain like the following, which as you can clearly see is not cryptographically secure, because there are only a few steps:

  1. You transferred $X amount of money to VPN provider V1, using your home IP address to access their site. (even if you use Tor, know that many APTs are exit nodes for Tor and will very carefully inspect your traffic to glean exactly this kind of information; Tor is not nearly as anonymizing as it was once thought to be).
  2. You transferred $Y amount of money to VPN provider V2, using your home IP address to access their site.
  3. You connected to V1's VPN server.
  4. You used V1's VPN server to access forum foo and bar, and logged into them using accounts foo1 and bar1.
  5. You used V2's VPN server to access forum foo and bar, and logged into them using accounts foo2 and bar2.
  6. Therefore, foo1 and foo2 are the same person on forum foo, and bar1 and bar2 are the same person on forum bar.

This knowledge chain is so simple that it's like making your password for your banking site, "password". This is not information-theoretically challenging in any way; all that remains is for an organization with the correct skills and/or the correct authority, to obtain this extremely small number of facts, and they've got you.

There is no way that I know of to escape this simple fact. It all comes down to who you're hoping to conceal your true identity from, and how skilled you think they are (including, how skilled whoever they might hire to investigate you or your personas is).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment