Hiding IP Address

[svenr]

Originally Posted by monokakata

And a very high probability that her last name also begins with D.

Okay, when I see that picture and read Double-D, I draw different conclusions: (.Y.)
;-)

Back on topic, I'm surprised no one has mentioned Tor yet:
https://www.torproject.org/

Meets all her requirements: open-source, highly anonymous, nearly untraceable.

If you're really paranoid, then with all the other proxies, e.g. hidemyass from post #2, you'll have to worry about honeypots. That means the proxy operator itself might have an interest in tracking you or even be set up by malicious parties.

Tor involves chaining of and fast switching between hundreds of proxies, so even if one of them is compromised, it still maintains your anonymity.

As for "What kind of footprint is my MacBook leaving behind?", use Firefox and install extensions:

• FireGloves (if it shows up in Hungarian, note "english | magyar" language switch at top-right)
• RequestPolicy
• NoScript

[doubledee]

I'm back! (Had Internet issues yesterday afternoon, and lost my message.)

Originally Posted by monokakata

Well, we're not private investigators (at least I'm not).

But I don't doubt that somebody who knows that work, has (legal) access to various databases, and a few hours to spare could find you easily enough.

I've always thought it would be fascinating to learn to become a P.I. (Then I could finally get my own TV show!!)

I do have a question for you: do you like Carolina's Restaurant and are interested in Latin Dancing?

All this is beside the point, really.

Nope, never heard of that place, although I see your point.

If somebody wants to track you down, and has resources, it's all over for you -- without an IP address, although of course that would help localize you a bit, and probably would reveal your ISP.

That is what scares me, and why I am trying to learn how to better remain hidden/anonymous on and offline.

So if you're up against people like that, you'll probably want to encrypt your entire Macbook's disk with a very secure password, because that's probably the only thing that's going to keep it secure. Everything else they'll find out with ease.

Well, I'm more concerned about people being able to track me, my location, my activity, etc than getting into my computer. (I think I'm pretty careful with my information when it comes to my laptop in the physical world, but it is connecting to the Internet that has me feeling paranoid.)

But are you up against people like that? That's the issue.

Well, I have been stalked in the past, and by virtue of coming to online forums, I suspect I am placing a "bulls-eye" on my forehead in some regards.

Although I think my larger concern is just the whole "Big Brother is watching you" thing.

My goal is to make sure that when I connect to the Internet and surf the Internet, it is not like I'm leaving a trail of breadcrumbs so obvious that everyone and anyone can see my every move.

And it is my fear that if you don't do things like: Hiding your IP, Hiding your MAC Address, Maybe Surfing over Encrypted Connections, and so on, that you might as well be driving around with your Name, Address, and Social Security Number on the back of your shirt?!

But then I just don't know, because unfortunately, I am ignorant about Networking and Security in the scheme of things...

If you're not, then as other posters have said, ordinary precautions will do you fine. The ex-spouse or partner, the neighborhood snoop, somebody at work -- it's not hard to keep them at bay. Keep in mind that if anybody with any skills at all has physical access to your Macbook, that person owns it (unless you've got everything encrypted).

Well, I created a new thread dealing with that issue here... Two-Factor Authentication for Macs?

Keep your OS X firewall turned on (or get Little Snitch if you like), be very careful about social-engineering emails with malware payloads, and so on.

What is the difference between Snow Leopard's built-in Firewall, and Little Snitch?

Is your router as tight as it should be, or does it still have the default username and password?

Well, for this entire conversation, I don't have a router, because I'm using my MacBook while working away from home.

These are the normal things. Look after them and you'll be fine. If the big bad guys are after you, you're toast anyway.

That word scares me...

Well, isn't there anything I can do to avoid the Gov't or Corporate America from tracking my every move online?

What are your thoughts on this "Hide My Apples" program?

Sincerely,


Debbie

----------

Originally Posted by Multi-Mac

Some folks don't mind mindlessly splashing their lives over Facebook. Others are more reserved and want privacy. There should be options for both.

Why should people I don't know be able to find out about my life? Privacy should be the starting point, not something that requires extra work. And until corporations started selling us on social networking, "sharing", etc. privacy was a lively topic; now it's presented as something odd.

My life and my thoughts are none of your business unless I choose to make them public. Without privacy we cease to be individuals and become numbers in some marketers commission check.

To my mind Debbie is not only correct but isn't upset enough.

Multi-Mac, you just summarized exactly how I feel!!! *thumbs up*


Debbie

[doubledee]

Originally Posted by monokakata

I agree with everything you say, Multi-Mac, especially how it's seen as odd when people care about their online privacy.

I only jumped in because it seemed to me that (a) Debbie was tilting towards the nuclear option, which seemed like overkill to me, and (b) I wasn't the first person to point out that giving too much information in public profiles exposes a person more than an IP address or sites-visited log does.

And we don't know whether Debbie would prefer that nobody be able to locate her residence/work/etc. or that nobody be able to follow her tracks on the internet, or both.

Well, here is how I see it...

I don't mind that you know my Name (First), or Location (State), or my Profession (Business Analyst), because it helps make things more personal, when you at least know someone's First Name and some basic information about them.

More so, knowing just those things is pretty useless information for any other purpose.

However, the fact that others can log things like...

- When I access the Internet
- Where I access the Internet
- What equipment I use to access the Internet
- What I look at while on the Internet

...could totally impact my Privacy, Security, and Freedoms that I've come to expect as an American?!

It is probably due to my ignorance of Networking and Web Security, but I have this growing fear that people might be able to identify my particular computer, and once they do that, they could track me wherever I go online, just like there is a GPS unit sewn to my side?!


With each passing month, I read more and more in the news how in the U.S. and abroad, both "good" and "bad" Internet users are tracked and often persecuted and jailed because of their actions and affiliations. (Thank God I don't have to live as a female in a country like Pakistan...)

Again, I think my online activities are pretty tame, YET I don't like the idea someone, somewhere, is amassing this gigantic file on everything I've ever done online...

Think about it, just by looking at my browser's cache or my Internet activity, you could figure out...

- Where I work
- Where I shop
- Where I bank
- Groups I belong to

...and so much more?!


It seems to me that there ought to be lots of ways to not leave such an enormous bread-crumb trail of my daily activities, and that is the latest "kick" that I'm on...

Sincerely,


Debbie

[doubledee]

Originally Posted by scarred

I wrote a big long reply to your post, but deleted it.

Why did you delete it?

I would be very interested in hearing what you have to say. (This has turned into a fascinating thread!)

Sincerely,


Debbie

[flynz4]

Personally, I think there are a few simple things that just make sense to do... in priority order for me:

1) Use a VPN whenever at a public hotspot - Sidejacking is too trivial to accomplish. I use a commercial product (Witopia), but I am sure there are open source ones as well.
2) Encrypt your HDD. I turn on File Vault II right away
3) Turn on your firewall.

/Jim

[snberk103]

Originally Posted by doubledee

Well, as I see it, here is the distinction...

There are tens of thousands of Debbie's from and in Arizona. So that won't do you much good, nor will knowing my hobbies.
...

....
Sincerely,


Debbie

Debbie

I agree and disagree with some of what you are saying. I agree that we give away way too much information, as a matter of course, in our daily lives. But we disagree where to prioritize our efforts.

Do you read the privacy statements that your bank makes you sign? Recently my bank wanted me to agree to several paragraphs that gave them permission to give my information to their related (and unrelated) affiliates... when I was there to register as a signing officer for a non-profit group I belong to. Oh, they sputtered and fumed when I crossed out the whole page and initialed it (to make it legal). Told me I " ... couldn't do that!" I pointed out that I just had. And in end they accepted the paperwork. I do that kind of thing with just about every facet of my life ...I read the privacy statements and tick the 'no' box or cross off the paragraph. One time we were declined for a mortgage because we refused to the sign the contract with the marketing clauses intact.

I'm belabouring that point because these are examples of privacy intrusions that are truly dangerous. What you do on internet is too random, and it's too easy to block ads. Get a few Airport Expresses when you travel. Each one has a different MAC address. You plug them into the hotels ethernet port, and connect wirelessly with your laptop. It's also usually a faster connection. Your laptop's MAC address is now hidden from the hotel. On the internet I'm pretty sure all anyone will see is one of the hotel's routers MAC addresses.

If you are still worried, upgrade your laptop annually. New machine ID each year means all the previous info is useless.

Block cookies. That will do more to preserve your anonymity, and is easy to do.

Institutions you deal with have much more ability to track you. Mainly because we usually agree to it... even if we don't know it at the time. Credit and debit cards are very closely tied to a real identification, and since new cards are issued by the people with the file - getting new card doesn't clear the file (like getting a new laptop does).

Do you shop at Target? Do you have a loyalty card? Really scary story recently in the NY Times about how they track customers. They got so good at predicting when someone was pregnant (and started sending coupons for things that expecting moms might want) that people got scared. So - they still send the coupons (business is business, after all) but they bury the coupons in a random selection of other coupons that they know you don't really want - but they act a camouflage.

But - on line... it's too easy to fool the trackers. Sometimes I will spend an hour or two looking at stupid cat videos (actually, 'playing' while I do something else) just to mess with Youtube. You can set up several different identities to use in different places. Different browsers as well. Surf from different locations. Change your machine and even if they have been tracking the machine, it's in someone else's hands now.

----

By the way... by doing bit more sleuthing - and not much more .... I know a bit more about the persona you are using than what you have told us here. Did you know you can Google search on a specific photo? And that leads to other forums you are on, and if I wanted to register I could look at your profile there and read all of your posts and probably get more details to start putting together a more complete profile?

Of course, what we don't know is if your name really is 'Debbie' and whether you used a real photo of yourself.

--------

If you travel, encrypt your HDD. Read the latest MacWorld magazine on security. It has one of the best general round ups on computer security I've seen in a while.

------

Originally Posted by doubledee

With each passing month, I read more and more in the news how in the U.S. and abroad, both "good" and "bad" Internet users are tracked and often persecuted and jailed because of their actions and affiliations. (Thank God I don't have to live as a female in a country like Pakistan...)

If you think like that then you have already lost battle. You live in a democracy - get the laws changed. Get involved and ask candidates hard questions. One of biggest things that can be done is to change the law that allows, it sometimes appears, virtually anyone to demand your social security number for ID purposes. I live in Canada, where our Social Insurance Number is protected by law. With very few exceptions no one, except a bank and an employer, can demand your SIN. And you can say no to the bank under certain circumstances and no to the employer under certain conditions as well. Heck... you don't even have to tell the Federal Government - the entity that assigns it - your SIN unless you are dealing with certain matters.

---

I've gone on far too long... but really.... you are right to worried about your privacy... but you are probably barking up the wrong tree in the forest.

[monokakata]

Debbie, it isn't true that the information you gave in your profile is useless.

A few minutes ago I used that information (plus a guess about something I didn't think of yesterday) to get to a professional site where you have a major presence (2,657 posts).

I joined that site, which meant I could look at your postings, and if I were a bad guy, I'd be in a position to monitor what you're interested in, offer suggestions for solving problems that could reasonably lead to my asking you for contact information or a private meeting . . . and on from there. My guess is that because the site's the kind of site it is, I could get you to reveal information that you wouldn't reveal on a site like MacRumors.

I won't name the site on here, of course. But if you go to it -- you must know the one I mean -- you'll find a new user "monokakata."

Now I have to figure out how to resign from that site, because not only do I mean you no harm, I'm not involved in the matters taken up by the site.

My point is the same one I made yesterday -- even when we think that an online profile doesn't give enough identifying information to track a person, it certainly can. And I'm an amateur.

I'd guess that anybody who wanted to know my personal details could look through my postings for occupation clues, take my user profile and add that information to it, and find me quite easily.

Try it, Debbie. I won't make you endure all my postings looking for occupational clues, though. I'm an anthropologist. The rest you can get from my profile right here on the sidebar. If it takes you or anybody else more than a few minutes to find me, I'll be surprised. I'm not trying to hide from anybody, so I've taken no care to cover my tracks.

How about not putting my street addresses and phone numbers in any reply you make here, though.

[svenr]

That is of course assuming that the person calling her/himself Debbie, actually is a Debbie and not a Sara, Jack or Chen Ling. And that the picture hasn't simply been lifted from Facebook or any random website. It's so easy to lead anyone down a wrong track ...

[Designer Dale]

Originally Posted by svenr

That is of course assuming that the person calling her/himself Debbie, actually is a Debbie and not a Sara, Jack or Chen Ling. And that the picture hasn't simply been lifted from Facebook or any random website. It's so easy to lead anyone down a wrong track ...

Or a Google employee assigned to post into various forums to gather info on tactics Internet users use to conceal their identities. All for the purpose of deploying hacks to prevent them from being successful...

Dale@DEFCON 3

[doubledee]

Originally Posted by flynz4

Personally, I think there are a few simple things that just make sense to do... in priority order for me:

1) Use a VPN whenever at a public hotspot - Sidejacking is too trivial to accomplish. I use a commercial product (Witopia), but I am sure there are open source ones as well.

Wow!! That website just described about everything I am worried about, and more that I didn't know about?!

It all sounds very good, but to play devil's advocate...

1.) Why should I trust Witopia?

If you think about it, there is virtually no way of ever knowing if any of this Privacy and Security stuff really works. (Anyone here smart enough to review the code for PGP or an RSA key fab to know if it does what it says?! Certainly not me!!!)


2.) Are there any competitors (Proprietary or Open-Source) out there to compare against?


3.) Pardon the newbie question, but is it possible to create your own VPN, or does that require infrastructure equivalent to the cable company?


4.) How would I use a "Personal VPN" with respect to Free Wi-Fi at Starbucks, or my Hotel Room, or - if I get one - a Data Plan with Verizon?

Is Witopia something that sits on top of the actual "Internet Plumbing"?


5.) Related to #1...

Don't you ever freak out when it comes to trusting all of these IT Security companies and their Security Products?!

I think I'm smart enough to know when Microsoft (or Apple) is "pulling the wool over my eyes", but when it comes to Security stuff, I'm way over my head.

In some ways, that worries more than the Bad Guys themselves.

Why, because I am entrusting my personal data (and life) with some big, cold mega IT-Security corporation that is ultimately driven by PROFITS...

Millions of Americans trusted Goldman Sachs and Bank of America with their $$$, and look what happened...

I am learning SO MUCH in this thread, but pardon my increasing skepticism as the conversation evolves!!

2) Encrypt your HDD. I turn on File Vault II right away
3) Turn on your firewall.

/Jim

I am researching these too. (I have read articles saying that File Vault isn't so secure. PGP looks good, but ideally I'd like to find Hardware-based FDE versus Software-based pseudo-FDE like PGP?!)

Thanks for the tips, Jim!!! <--- I think this is how you say "Good job" on here?!

Sincerely,


Debbie

[snberk103]

Originally Posted by doubledee

...
It all sounds very good, but to play devil's advocate...
...

Sincerely,


Debbie

Let me play Devil's Advocate for a moment... and please bear with me when it sounds a bit paranoid... I'll make my point on a happier note.

How do you know that someone is not physically following you? Twenty yards behind you, and across the street? Maybe there is a tracking chip on your car? In your purse? Hidden cameras in your office? A drone with a camera following you from up high.

You don't ... but you also probably don't worry about these things (too much) either because rationally you know that you are not doing anything to justify that kind of effort. Probably.

So you get on with your life, enjoy the things that really matter. You make a reasonable assumption and balance the very low risk of being surveilled with the effort needed to thwart it. If you were in a business that could make you a target, then you would take actions that - on balance - mitigate the risks. Most of them. And get on with your life.

Heck, even the President of the USA does things (occasionally) that may be risky because he has decided that the activity is 'balanced' by the security.

Most of the actions and products you are considering are being hawked by people who make money by feeding on your fear. Or they just get their jollies making people afraid.

Block your Cookies. Encrypt your harddrive (File Vault II is much better than the FV I - which is probably the review you are reading) and stay away from people who are professionally scared....

Also, if you are that worried... don't sign up for loyalty programs, use cash where convenient. Don't use a cell phone. Start expunging your Social Security number from all of those places that you've used it as a form of ID. I mean, really... does the video store really need your SSN to prove who you are.

And get on with your life. Also... if the government to get to know you they'ed just get the records from your cell phone carrier, your bank, your credit card issuers.. Much much easier, and much more complete than trying to track your laptop and online activities. If an international hacking group wanted to get to know you they'd do the same, but without the warrants.... wait, does the US government need warrants anymore?

[doubledee]

snberk103, you sure know how to humble a girl?!

I'm not sure if I should be more paranoid and worried with all you have written, or if I should feel better, because I have new information to protect my privacy?!

Originally Posted by snberk103

Debbie

I agree and disagree with some of what you are saying. I agree that we give away way too much information, as a matter of course, in our daily lives. But we disagree where to prioritize our efforts.

Do you read the privacy statements that your bank makes you sign?

I have started to, but not to the degree that you have.

Recently my bank wanted me to agree to several paragraphs that gave them permission to give my information to their related (and unrelated) affiliates... when I was there to register as a signing officer for a non-profit group I belong to. Oh, they sputtered and fumed when I crossed out the whole page and initialed it (to make it legal). Told me I " ... couldn't do that!" I pointed out that I just had. And in end they accepted the paperwork. I do that kind of thing with just about every facet of my life ...I read the privacy statements and tick the 'no' box or cross off the paragraph. One time we were declined for a mortgage because we refused to the sign the contract with the marketing clauses intact.

I admire your tenacity with corporations!

I'm belabouring that point because these are examples of privacy intrusions that are truly dangerous. What you do on internet is too random, and it's too easy to block ads. Get a few Airport Expresses when you travel. Each one has a different MAC address. You plug them into the hotels ethernet port, and connect wirelessly with your laptop. It's also usually a faster connection. Your laptop's MAC address is now hidden from the hotel. On the internet I'm pretty sure all anyone will see is one of the hotel's routers MAC addresses.

I don't understand what you mean by "Airport Expresses"??

Also, one of my biggest fears is be tracked back to my physical computer. So, in my case, where I am away from home and using my MacBook, is there any way to ensure that I cannot be traced back to my physical machine/device?

(To say I logged in at Starbucks in Michigan doesn't mean much, but to say Computer #12345 access MacRumors.com on Feb 12, 2013 does seem pretty damning to me...)

If you are still worried, upgrade your laptop annually. New machine ID each year means all the previous info is useless.

What uniquely identifies a computer?

Is it the MAC address?

And where is that stored?

Is it on your Motherboard?

Or is it on the HDD?

Block cookies. That will do more to preserve your anonymity, and is easy to do.

Yes, I have been manually accepting cookies for years, and I delete all cookies regularly.

Institutions you deal with have much more ability to track you. Mainly because we usually agree to it... even if we don't know it at the time. Credit and debit cards are very closely tied to a real identification, and since new cards are issued by the people with the file - getting new card doesn't clear the file (like getting a new laptop does).

Very true. (Maybe "paying cash" isn't such a bad idea after all?!)

Do you shop at Target? Do you have a loyalty card? Really scary story recently in the NY Times about how they track customers. They got so good at predicting when someone was pregnant (and started sending coupons for things that expecting moms might want) that people got scared. So - they still send the coupons (business is business, after all) but they bury the coupons in a random selection of other coupons that they know you don't really want - but they act a camouflage.

I avoid Rebates, Promos, Sweepstakes, and Loyalty Cards for just those reasons!!! (But, I will still look for that article, because I'd like to know what Target was up to?!)

By the way... by doing bit more sleuthing - and not much more .... I know a bit more about the persona you are using than what you have told us here. Did you know you can Google search on a specific photo? And that leads to other forums you are on, and if I wanted to register I could look at your profile there and read all of your posts and probably get more details to start putting together a more complete profile?

Yes, I know about that.

Of course, what we don't know is if your name really is 'Debbie' and whether you used a real photo of yourself.

I suppose that is true...

If you travel, encrypt your HDD. Read the latest MacWorld magazine on security. It has one of the best general round ups on computer security I've seen in a while.

Will do.

If you think like that then you have already lost battle. You live in a democracy - get the laws changed. Get involved and ask candidates hard questions. One of biggest things that can be done is to change the law that allows, it sometimes appears, virtually anyone to demand your social security number for ID purposes. I live in Canada, where our Social Insurance Number is protected by law. With very few exceptions no one, except a bank and an employer, can demand your SIN. And you can say no to the bank under certain circumstances and no to the employer under certain conditions as well. Heck... you don't even have to tell the Federal Government - the entity that assigns it - your SIN unless you are dealing with certain matters.

I think you misunderstood me. I am an active U.S. Citizen, and I have not given up like over half of the U.S. after the elections.

But my point was that the Internet and Computers carry much more weight than just 10 years ago - both for the better of humanity and the demise of it.

To sum up my personal fears, working in IT and traveling a lot, I have come to the conclusion how much Corporate America - and to a large extent the Gov't - owns Debbie's soul, and that bothers me.

A lot of the blame falls on ME. (I'm naive to think the Internet and Google and Yahoo Mail and YouTube and WikiPedia don't come with a "price"...)

And yet, as an American, I am spoiled when it comes to personal freedoms...

So in the last year or two - when I have time - I have been reading up and talking to lots of people much smarter than I, trying to make sure I haven't completely sold my souls to Corporate America, and as someone said on this thread earlier, that - when taken out of CONTEXT - I will not someday regret something that seemed innocuous at the time?!

I've gone on far too long...

No, I appreciate and respect your thoughts. (You are obviously a very intelligent person - along with lots of others on this forum!!)

but really.... you are right to worried about your privacy... but you are probably barking up the wrong tree in the forest.

Duly noted.

Sincerely,


Debbie

[doubledee]

Originally Posted by monokakata

Debbie, it isn't true that the information you gave in your profile is useless.

A few minutes ago I used that information (plus a guess about something I didn't think of yesterday) to get to a professional site where you have a major presence (2,657 posts).

I joined that site, which meant I could look at your postings, and if I were a bad guy, I'd be in a position to monitor what you're interested in, offer suggestions for solving problems that could reasonably lead to my asking you for contact information or a private meeting . . . and on from there. My guess is that because the site's the kind of site it is, I could get you to reveal information that you wouldn't reveal on a site like MacRumors.

Fair enough. You have made your point.

My point is the same one I made yesterday -- even when we think that an online profile doesn't give enough identifying information to track a person, it certainly can. And I'm an amateur.

I'd guess that anybody who wanted to know my personal details could look through my postings for occupation clues, take my user profile and add that information to it, and find me quite easily.

Try it, Debbie. I won't make you endure all my postings looking for occupational clues, though. I'm an anthropologist. The rest you can get from my profile right here on the sidebar. If it takes you or anybody else more than a few minutes to find me, I'll be surprised. I'm not trying to hide from anybody, so I've taken no care to cover my tracks.

Again, I get your point.

Then again, I'm not sure you entirely understand my points...

In my original post, I am trying to learn about how to cover up digital things of which I know very little (e.g. IP Address, MAC Address, etc.) because I believe that they could be very damning over time.

By contrast, I don't mind if you know basic information about me like Name, State, Profession, etc.

But, right or wrong, it does freak me out if You, or Panera Bread, or my ISP, or the Gov't knew that I Googled "LSD" (while I listened to a Jefferson Airplane song) or that 4 years ago I landed on a Porn Site (while I was Googling "Teen Solo" while reading about that girl from Australia sailing around the world by herself) or that I frequent certain stores online, or that I have chatted with and visited many websites related to my Political Views, and so on and so forth...

Follow me?

I sorta put myself out there for people to see parts of me in things like this forum. Other things, like where I shop, or my political views, or my health conditions, or my religious views, and so on I do not want people to be logging in some database, or to end up in court some day when I'm on trial for being "human"!!

I appreciate you playing devil's advocate - all of you - but also hope you see the distinction I am making.

Really, I guess it comes down to this...

I want to be Technologically Savvy enough to control all of my information and decide who gets what, even if that is a *dream*?!


Debbie

----------

Originally Posted by Designer Dale

Or a Google employee assigned to post into various forums to gather info on tactics Internet users use to conceal their identities. All for the purpose of deploying hacks to prevent them from being successful...

Dale@DEFCON 3

Ha ha!! Nah, you can strike that one!

I'm just a working slob by day, trying to recover from "The Great Recession" and hoping that before I turn 50, I'll actually get back to living outside of work and OFFline...


Debbie

[snberk103]

Originally Posted by doubledee

snberk103, you sure know how to humble a girl?!

I'm not sure if I should be more paranoid and worried with all you have written, or if I should feel better, because I have new information to protect my privacy?!

Paranoia doesn't really get you very far. You have nothing to fear, etc... Be cautious of course.... but, I guess my question is... Why are so worried? There are over 300 million people in the US. Why would someone go to the trouble to pick on you? It could happen, of course... but what the chances? You take a risk every time you get into a car.... so you try to make those risks manageable and then you get into a car and navigate the risks. Same thing goes for the internet. There is nothing especially dangerous about the internet, is just something we deal with everyday.

Originally Posted by doubledee

...
I admire your tenacity with corporations!

Thanks! We are making a new hobby out of it.

Originally Posted by doubledee

I don't understand what you mean by "Airport Expresses"??

Well, crap... the one I was thinking about seems to be discontinued. Link But this is the refurbished store where they are selling 'em off. One ethernet port that you connect to the hotel, and then the Express sets up a WiFi network in your room. The new ones on the Apple store have two ethernet ports, so do a bit more. But are bigger. The old ones plugged directly into the wall plus, so no extra transformer (the commonly called wall warts).

Anyway, whether you paranoically use several to mask your MAC inside the hotel, or just get one because they are amazing little devices is up to you.

Originally Posted by doubledee

Also, one of my biggest fears is be tracked back to my physical computer. So, in my case, where I am away from home and using my MacBook, is there any way to ensure that I cannot be traced back to my physical machine/device?

But why are so worried? The effort needed is enormous. The gain, usually pretty small. It is far easier to just physically follow you. Unless you are in a profession that is being targeted. In which case you should be getting training from your company's security department. And in most cases it is the contents of the laptop - not you, yourself - that is valuable. In which case they are going to physically follow you until they can physically steal the laptop. Because it is easier to steal information off a laptop that is in front of you instead of "somewhere out there".

But no... there are no guarantees that someone isn't following your laptop. Just like there is not guarantee that the asteroid on Feb 15th isn't going to knock a satellite out of orbit that lands on your home. It's not likely to happen, but it may. But I'm not going to lose any sleep over it. Or the thousand other risks that are much more likely than somebody taking so much interest in me that they try to hack my computer.

Though I do put passwords on them of course.

Originally Posted by doubledee

(To say I logged in at Starbucks in Michigan doesn't mean much, but to say Computer #12345 access MacRumors.com on Feb 12, 2013 does seem pretty damning to me...)

Why? Machine IDs and MAC addresses are spoofed everyday. There is a likelihood that someone is using your router's MAC address somewhere else in the world. MAC addresses can be typed into a router, and therefore you can type anybody's MAC address you want. In fact, routers even make it easy to copy your computer's MAC address to themselves so that they can spoof your computer. MAC addresses are useless for tracking somebody simply because they are so easily spoofed. It's like a bouncer asking an 18 year old how old they are at the door of the bar, but never checking the ID.

Originally Posted by doubledee

What uniquely identifies a computer?
...

I don't know that there is. All of those parts can be taken out and replaced by a new one. Which is why tracking a computer is useless. Plus, give it to your niece and the trackers end up tracking the wrong person for a year before they figure out that you haven't suddenly developed a crush on Justin Bieber. The effort just doesn't warrant the gain in most cases, unless you work in very specific industries. like the CIA.

Originally Posted by doubledee

Yes, I have been manually accepting cookies for years, and I delete all cookies regularly.

Why do you delete them all? Do you really care that that NY Times knows you have been there before

Originally Posted by doubledee

Very true. (Maybe "paying cash" isn't such a bad idea after all?!)

...
I think you misunderstood me. I am an active U.S. Citizen, and I have not given up like over half of the U.S. after the elections.

That is good. Democracy is a precious thing.

Originally Posted by doubledee

...
To sum up my personal fears, working in IT and traveling a lot, I have come to the conclusion how much Corporate America - and to a large extent the Gov't - owns Debbie's soul, and that bothers me.

They don't own your soul... they just think they know what motivates you to buy stuff.

Originally Posted by doubledee

A lot of the blame falls on ME. (I'm naive to think the Internet and Google and Yahoo Mail and YouTube and WikiPedia don't come with a "price"...)

Well, as my wife likes to say... if you ain't paying for the service then you're not the customer, you're the goods they're selling. But we still use FB, and Google, etc. We just be cautious about what we post. The same way I don't tell my friends everything.

Originally Posted by doubledee

And yet, as an American, I am spoiled when it comes to personal freedoms...

So in the last year or two - when I have time - I have been reading up and talking to lots of people much smarter than I, trying to make sure I haven't completely sold my souls to Corporate America, and as someone said on this thread earlier, that - when taken out of CONTEXT - I will not someday regret something that seemed innocuous at the time?!

Many people who are paranoid, may seem "smarter" than you. They use their knowledge in one very narrow field to make you think they know a lot about more than they really do. Don't get caught up. I have some friends who lost a fortune on the stock market because a brilliant retired MS developer thought he had identified the Next Big Thing. Brilliant in one field does not mean you know diddly in another.

Originally Posted by doubledee

No, I appreciate and respect your thoughts. (You are obviously a very intelligent person - along with lots of others on this forum!!)

Nah... I'm just a photographer, and a generalist. But I am pretty level headed, I think. So... take my advice. Block cookies. Encrypt your hard drive. Don't surf to your bank, or other sensitive sites, on a public WiFi.

And relax!

[svenr]

Originally Posted by doubledee

2.) Are there any competitors (Proprietary or Open-Source) out there to compare against?

3.) Pardon the newbie question, but is it possible to create your own VPN, or does that require infrastructure equivalent to the cable company?

For both of those, have you seen post #26, right on top of this page?
http://forums.macrumors.com/showpost...9&postcount=26

Originally Posted by doubledee

What uniquely identifies a computer?

Is it the MAC address?

And where is that stored?

Is it on your Motherboard?

Or is it on the HDD?

What you're worried about is called fingerprinting, a relatively straight-forward way to identify you over the net (usually for relatively innocuous advertising purposes) by the unique combination of operating system and version, browser version, fonts you have installed, browser plug-ins you have installed, language settings, etc. Try it here:
https://panopticlick.eff.org/
Counter-measures also in my post above.

To get to the hardware layer and identifying unique motherboards or HDs would be MUCH harder and would require someone to launch a sophisticated targeted attack against you or at least get you to install some kind of malware to spy on you.

BTW, the EFF has a great page on this whole topic: https://ssd.eff.org/

[scarred]

Originally Posted by doubledee

Why did you delete it?

I would be very interested in hearing what you have to say. (This has turned into a fascinating thread!)

Well it came off a little preachy. There is a bit of mis-information in this thread, and I didn't want to start an argument. =) But ok, I'll try to sum up my thoughts in a neutral way.

There is nothing wrong with what you are trying to do. In real life we try to keep private all the time: from closing your blinds at night, to putting up fences, to covering up valuables in your car while shopping, we are constantly aware of keeping private. For security sure, but also for comfort and peace. You aren't being paranoid by locking your door, you are just being prudent and removing yourself as a target of opportunity.

In life we also freely give up privacy as needed. My doctor, lawyer, banker, and psychologist (if I had one :P) know a lot about me. We give up our privacy to these people because they provide us with a service that would be hard to perform without it. In turn, they promise (sometimes by law) to never share what we share with others. I have nothing to hide, but I would rather not have my medical records available to anyone who wants them.

Being online "feels" private. Like visiting your psychologist...you feel comfortable in your surroundings and rarely worry about the private details you are sharing. The difference? Your psychologist keeps your private information safe, but the same isn't true for most online websites. While online, we aren't very prudent, we do make ourselves easy targets... We think we are being private, but we aren't, at all. The blinds are wide open, goods on display in the back seat and the door is unlocked. We aren't doing anything bad, but so what?

The only effective way I've managed to stay anonymous is to disrupt this general feeling of "comfort". I might be in my office (with the blinds closed), but I'm no where near private while online. It is simple in concept, very difficult in practice: Have two completely different identities. When you are using your real identity you'll be accessing banks, support sites for products you own, email, Facebook, etc. You visit these sites freely, giving up privacy for a service. Then, for everything else, you have your other identity. Here is how to set one up:

1. Create two accounts on your computer (if you know VMs, you can use one of these instead... but two accounts is easy enough).
2. Your second account should not have any "phone home" apps like dropbox, iCloud, email, etc. You are going to use this account for all online activities that don't need to know who you are.
3. With your new computer account, download, install and run TOR. Read up on it first. =)
4. After it is installed, visit tormoil and sign up for an email address (use a nickname). This is the start of your online identity. All paths will lead back to this. Since you signed up with it using TOR, it is a pretty decent dead end.

Now, you can keep using TOR, or sign up for a VPN. I went the latter route, it isn't too much money, and while it isn't as anonymous as TOR, it is a much more pleasant experience (TOR is great, but slow). Once you've chosen, you can get a nicer email address from yahoo or gmail or wherever.

Ok, this was long enough... if you have any specific questions, just ask!

[joeycool]

Originally Posted by abz1981

to be honest with you. no one can hide anywhere from the looks of this:

http://www.guardian.co.uk/world/2013...-media-defence

Very interesting, I think if your using a service like HMA or proxy's you will be traceable but only to the HMA servers or proxy servers. I think the guy in the video was not trying to hide his IP or anything I think if you use something like this http://ipaddresshq.com/hidemyass-sof...t-anonymously/ your OK, it really depends on what measures you want to go through to have your ip address remain untraceable for me i just use HMA when i travel to log on to pay pal facebook so my ip address stays the same and Paypal don't put a lock on my account that's enough for me...

[flynz4]

Originally Posted by doubledee

Wow!! That website just described about everything I am worried about, and more that I didn't know about?!

It all sounds very good, but to play devil's advocate...

1.) Why should I trust Witopia?

If you think about it, there is virtually no way of ever knowing if any of this Privacy and Security stuff really works. (Anyone here smart enough to review the code for PGP or an RSA key fab to know if it does what it says?! Certainly not me!!!)

It is about managing risk. By far... the easiest way to get to my data is to sidejack me when I am on a public hotspot. I know that Witopia works... because I can look at my location move all over the globe as I change what server I am connected to. That means that the VPN is working... and I can change my IP address to anywhere in the world that I care to be. It also means that other people who are on the same local public network as me... cannot sidejack me. I've just eliminated 99% (total guess) of my risk when surfing in public.

/Jim

[monokakata]

Originally Posted by svenr

What you're worried about is called fingerprinting, a relatively straight-forward way to identify you over the net (usually for relatively innocuous advertising purposes) by the unique combination of operating system and version, browser version, fonts you have installed, browser plug-ins you have installed, language settings, etc. Try it here:
https://panopticlick.eff.org/


BTW, the EFF has a great page on this whole topic: https://ssd.eff.org/

This fingerprinting thing is truly discouraging. I went to the Panopticlick site and wasn't pleased by what it reported about my machine.

[HenryAZ]

Originally Posted by doubledee

In my original post, I am trying to learn about how to cover up digital things of which I know very little (e.g. IP Address, MAC Address, etc.) because I believe that they could be very damning over time.

IP is a routed protocol. This means an "addressed" protocol. This is why every device on a TCP/IP network must have an IP address.

Packets are exchanged, for example in a TCP connection state, when the originating IP (you) contacts the remote IP (Google, for example). The application at each end (Safari at yours, the web server at Google) use port numbers as well. Your port is random, Google's is port 80 (the http port). This combination of port<-->IP<-->IP<-->port is called a socket, it is unique on the network as long as it exists, and data is exchanged over this socket.

In order for the packets to get back to you (to your Safari), your IP address must be known by the protocols. There may be any number of intervening layers of proxies, network address translations, etc, but the chain must be complete for you to receive your packets.

On the Internet, you are not going to get any information unless you tell someone where to send it.

[CylonGlitch]

Originally Posted by snberk103

Do you read the privacy statements that your bank makes you sign? Recently my bank wanted me to agree to several paragraphs that gave them permission to give my information to their related (and unrelated) affiliates... when I was there to register as a signing officer for a non-profit group I belong to. Oh, they sputtered and fumed when I crossed out the whole page and initialed it (to make it legal). Told me I " ... couldn't do that!" I pointed out that I just had. And in end they accepted the paperwork. I do that kind of thing with just about every facet of my life ...I read the privacy statements and tick the 'no' box or cross off the paragraph. One time we were declined for a mortgage because we refused to the sign the contract with the marketing clauses intact.

Something to also watch out for, and it seems to be a lot more common these days, especially when children are involved. I have found a lot of places asking for waivers for accidental injuries. This, normally makes sense and I have no issue with that, I know I'm participating in some dangerous things (i.e. Paintball) I could get hurt and it isn't necessarily their fault. BUT what I did notice is that some places use this to sneak in other things. One place I visited had a form that was labeled "Liability Waiver" but also had in it's body that they had the right to video tape you, use your identity in their advertising, and not pay you for it at all.

I've now made it my mission that whenever these things are available I will first try to download it from their website (if available, otherwise I scan it in). Then I use either a PDF writer or a photo editing program and slightly modify the words. "I do NOT allow my likeness to be used." etc.. I inject the work NOT in a lot of places. Then I sign that waiver and hand it in. I have yet to have ANY place actually notice that it has been changed -- mostly because the employees there don't know anything about it besides just collecting the waivers.

These things bother me more than a lot of the online things. I honestly don't mind some of the data gathering and focused marketing; that is what keeps a lot of the good, free services free. I don't care if they know I went to porn sites, or that I like to drink tequila or Absinthe, or that I own a Mac and use Safari . . . I don't do anything illegal and if I get ads for these thing who cares. (Ad blockers and spam filters are wonderful things).

But a company that goes out of their way to hide something in another document adding clauses that will allow them to do things like use your likeness on TV without your permission or compensation means that they are also more likely to do something nefarious with it. If they weren't they wouldn't be HIDING IT! Have it a check box on the form "I opt into allowing my image used for corporate advertising" instead of trying to slip it in somewhere.

Things like Picasa that so many people use. Read the TOS, you've given google the rights to use your photos any way that they want for any purpose that they want without compensation to you. Although Google may never do this; if you use their application, they could change their mind at any minute and decide to do it. People are diligent for some things, such as hiding their identity, but they forget the easy and obvious things like reading TOS' and signing away rights in other forms.

Knowledge is power. Be smart, surf wisely. I know that this identity is NOT secure, anyone can trace it back to who I really am because I don't hide from it. There are other identities I use that no one knows about; those would be much harder to track back to me because I don't want them to be. Just use what you know wisely and sometimes not worry so much.

[snberk103]

Originally Posted by svenr

... Try it here:
https://panopticlick.eff.org/
....
BTW, the EFF has a great page on this whole topic: https://ssd.eff.org/

Tried panoptclick.... apparently I'm untraceable....

I couldn't connect to the site, so either it's down or I'm better at hiding my tracks than I realized....

[BlendedFrog]

I have been following this thread and find it fascinating but I also find just about all of you extremely paranoid. Realize that the moment you step foot on the internet you leave a footprint of your activities no matter how careful you are.

Here is my opinion.... do a google search for yourself and any variation of yourself. If you don't come up in any result within the first 5 pages then no one gives a damn about you and isn't out to get you.

I know a couple of people who wear the tinfoil hats and who always think the black helicopters are hovering overhead. It's quite funny to hear their stories. When in doubt...move to Utah or Montana, build a bunker, and prepare for the worst. The rest of use will enjoy life.

[monokakata]

Originally Posted by CylonGlitch

Something to also watch out for, and it seems to be a lot more common these days, especially when children are involved. I have found a lot of places asking for waivers for accidental injuries. This, normally makes sense and I have no issue with that, I know I'm participating in some dangerous things (i.e. Paintball) I could get hurt and it isn't necessarily their fault. BUT what I did notice is that some places use this to sneak in other things. One place I visited had a form that was labeled "Liability Waiver" but also had in it's body that they had the right to video tape you, use your identity in their advertising, and not pay you for it at all.

Public sporting events raise a lot of interesting questions. I was in the running race timing field for a long time, and saw many waivers like the ones you're referring to.

Working an the applications I occasionally did see examples of what you did (crossing stuff out) but it was rare.

Most waivers were innocuous and meant to permit the race to do things such as publish or broadcast images of the runners as they participated, without needing to go to each individual and ask permission. It's almost impossible to identify people in a mass-participation race unless the image shows a bib number. The race wants to use the images for their own publicity, or to illustrate their applications, or posters, and so on.

The image waiver comes into play in another area -- finish line photographs. Big or important races generally have photographers (third party companies) contracted to try and get a finishing photo for every finisher. The runner is then given the chance to buy that photo, and many do. The potential privacy issue comes because typically the photo companies put up everybody's image on their website, keyed to runner number (but without any name information). So potentially, everybody's image is posted on the web, and that calls for permission in some form.

It must be true that in some cases (maybe many of them, outside of mass-participation events) the organizers have a nefarious purpose, or at least one that you'd rather not allow. But sometimes it's all straightforward.

[CylonGlitch]

Originally Posted by monokakata

It must be true that in some cases (maybe many of them, outside of mass-participation events) the organizers have a nefarious purpose, or at least one that you'd rather not allow. But sometimes it's all straightforward.

Of course, it is sometimes straight forward. And I would hope that most companies are that way. But one of the ones that I caught was at a bound house for my kids. It says that they have the rights to capture pictures, and videos and use them without compensation for their advertising campaigns. Sorry, no, I don't want my kids photo showing up across the nation on some ad campaign without my permission.

IF they offered me a waiver that had a check box that said, "Check here if it is OK to use your child's image." Of course I wouldn't check it. Most would. But to hide the lines within the "Release of Liability" waiver that they tell you is for their protection in case someone gets hurt, is bad.

With the way I modify the waivers, they look almost identical to the originals. No cross outs, no marks anywhere, I make an effort to keep the lines and justification to be similar. Thus at first glance it looks identical to the original. If they are hiding this working inside a liability waiver, it's fair that I hide the fact that I removed the wording.