Anonymity on the net is a topic that is discussed more and more frequently. We all know that many services on the net can be used anonymously. Or can they? The Internet is a giant data processing machine, and data about us users is getting more and more important. Anonymity on the net is to an increasing degree becoming a hallucination. Your access is logged, your surfing is tracked by cookies and the big data companies are even gathering info about your non-digital life. People are to an increasing degree doing things online thinking they are anonymous, but in reality they leave traces behind. These traces can lead back to their real identities, and in worst case put them in serious trouble.
I’m not going into the big picture about anonymity and privacy here. I’m going to present a tool that can be used to obfuscate your true identity. The anonymity network TOR. This is a tool and network that provides fairly strong protection against anyone who try to find out where a connection over the Internet really came from.
Let’s first debunk two myths.
So what’s the problem we are trying to tackle here? Practically all services on the net log all access. This log contains the so called IP-address that you are using, no matter if you have entered your real name at the site or not. The IP-address is a numeric code that is unique for all devices that connect to the net. Your ISP assigns one to your computer (or router, or modem) automatically when you connect to the net and you don’t have to worry about that. When you surf “anonymously” on a site, the site owner will know this IP-address but not who it has been assigned to. That information remains in the ISP’s log and is typically revealed only to authorities when investigating crimes. (Depends on local laws.) So you can under normal circumstances be traced back to your ISP, but the trace stops there.
So you have a certain level of privacy when surfing from home. But what about your computer at work? Here the company is in the ISP’s position. All traffic you generate can easily be traced to the company, but not to your workstation. The company’s administrators may be able to trace further, but that depends on how the internal network is managed.
Here’s some examples of situations where the default protection may be insufficient:
TOR is a privacy network that routes your traffic through a chain of several randomly picked servers before it goes to the site you are accessing. The traffic is encrypted all the way from your computer to the last relay machine. The protocol is also designed so that the relaying machines never know more than they need to know. The first server knows who you are but not what you are doing or what site you are accessing. The last server can see your traffic in plaintext and knows where it is going, but do not know who you are. None of this is however logged by the TOR relays as their purpose is to ensure your privacy. Even if someone with malicious intent would get hold of one of these servers, they would not be able to reveal your secret.
The simplest way to use TOR is to download and install the browser bundle. It consists of two parts that work together seamlessly. “Vidalia” is the control center that sets up the chain of secure servers and handles communication. “TorBrowser” is a Firefox-based web browser that is preconfigured to communicate through TOR. It makes it easy to start using TOR, no nerdy settings needed. A separate browser is also really necessary to guard your privacy as your normal browser is full of cookies that can identify you.
Installing TOR is easy, but that alone does not guard your identity. If you want to be truly anonymous at some certain site, you need to follow some additional guidelines.
Disclaimer. I hope you never truly need this kind of protection. But if you are in doubt, play safe and cover your tracks. Also keep in mind that it is tricky to be truly anonymous on the net. That is especially true if you are wanted by the authorities. Do not rely solely on this article if you are in a situation where your personal safety depends on anonymity, like for high-end whistle-blowers or opposition activists in non-democratic countries. What’s said above is a good start in these situations too, but you should get a more comprehensive understanding of on-line anonymity before putting yourself at risk.
Check what your surfing looks like from the site owners’ perspective. This site reveals the info. If using several connections, like home and work, check all of them. If you install TOR, visit the site from the TorBrowser to see how the address has changed.
PS. Another way to see the need for anonymity. The law protects our property against thieves, but still we use locks. The law protects our privacy on-line (to some extent), but most people do not enforce that in any way. TOR is for privacy what a lock is for theft. Why not play safe and lock it?
Photo by zigazou76 @ Flickr
#SLUSH15 is almost here, and F-Secure’s participating in this year’s event in a big way. There’s going to be a big #smartsecurity announcement about the Internet of Things, as well as a couple of presentations from F-Secure personnel. SLUSH, a well-known exposition for startups in the tech industry, has become a huge international event. Both SLUSH and F-Secure call Helsinki home, so it’s only natural for F-Secure to be an active participant at the annual conference. F-Secure made waves last year after the cybersecurity company hacked the venue’s bathrooms to get people talking about online privacy. Several of the company’s researchers and personnel also put in appearances at last year’s SLUSH, including cyber security expert Mikko Hypponen, and F-Secure’s Executive Vice President, Consumer Security, Samu Konttinen. [youtube https://www.youtube.com/watch?v=u93kdtAUn7g&w=560&h=315] [youtube https://www.youtube.com/watch?v=HB-qBhWV65s&w=560&h=315] And they’re both back this year! This year, Samu will be giving a keynote address on SLUSH’s Silver Stage. His talk is called “Your home, your rules – The internet of what ifs”, and runs from 11:45am to 12:00pm (Helsinki time) on November 11th. Samu’s enthusiasm for topics related to security and online privacy will give people valuable insights into how IoT devices are creating new security challenges, and what people can do to protect themselves. Mikko will be appearing on SLUSH’s Black Stage at 9:25am (Helsinki time) on November 12th, where he’ll deliver a talk called “The Online Arms Race”. Mikko recently did an interview about this same topic for V3.co.uk, so you can check that out if you want a quick preview about Mikko’s thoughts on this matter. You can follow all of F-Secure’s SLUSH news by following @FSecure_Sense, @FSecure_IoT, and @FSecure on Twitter.
Cyber Security Month is ending. We're sure you've already done the basics to avoid a digital catastrophe, as explained by F-Secure Security Advisor Sean Sullivan in a recent News from the Labs post on avoiding malware that can take your files hostage for ransom: Back up your stuff! Uninstall software and/or disable browser plugins that you don’t use. Keep the software that you do use up to date. But there's one last cyber security tip we want to pass on from our Janne who helps businesses avoid the kind of security errors that can cost them huge amounts of time and money. His advice: “Don’t even try to remember your passwords. That system you have so no one can possibly guess your password? The attackers know that one. Get a reputable password safe that you can sync to your phone and only ever use generated passwords.” This is the one cyber security tip you need to tell your boss -- if s/he hasn't told it to you already. You can use F-Secure KEY -- our password manager -- for free on one device. For more insight on how vulnerable your office is to online threats try our free Cyber Security Stress Test. We now return you to the other 11 months of the year when criminals hope you aren't thinking about cyber security. Cheers, Sandra
I have become pretty immune to advertising on the net. The brain develops an algorithm to locate the relevant content and filter out the junk around it. Frankly speaking, ask me about what ads there were on the page I just visited, and I have no clue. And I believe that’s true for many of us. Except that our internal ad-blockers aren’t perfect. The advertising may still affect us unconsciously. This issue has been in the headlines a lot since Apple introduced a simple way to implement ad-blocking on iPhones and iPads. Many took advantage of the opportunity and released new tools, among them the excellent F-Secure ADBLOCKER. And many media providers got upset as this development will no doubt increase the usage of ad blocking, and thus reduce advertising revenues. Some newspapers are already attempting to prevent users with ad-blockers from using their site at all. And some publishers admit that advertising has gone too far and they had it coming. So let’s take a look at the pros and cons of advertising. First the pros. Advertisers pay for your “free” stuff. It makes it possible to get a lot of excellent services and content without paying money. Instead you pay by exposing yourself to ads and letting companies profile you for targeted advertising. Some may actually find ads, especially well targeted ads, useful. They may contain special offers and campaign codes that are of true value to you. Advertising can be entertaining. And then the longer list, the cons. Advertising often disturbs your user experience. You have to locate the beef among glossy blinking ads. And you may even have to dodge pop-ups to actually see your content. Advertising may lure you to make more, often unnecessary, purchases. That’s basically the objective of advertising. Advertising often tries to trick you into opening the advertiser’s site. For example by mimicking a Next- or Download- button in the ad. Advertising may show content that is unsuitable for the viewer. Advertising can be a way to deliver malware. Ads are delivered from separate servers. A compromised ad server may show infected ads on sites with a good reputation. I.e. in places where you don’t expect to run into malware. Advertising will consume bandwidth and make pages load more slowly. This can cost you real money depending on your data plan. Advertising is the main reason to track you. Many companies attempt to profile you as accurately as possible to make targeted advertising more effective. Good targeted advertising may not be evil in itself, but misuse of the collected data is a real threat. It seems likes the cons win hands-down. But there is one argument in favor of advertisement that deserves some more attention. The publishers who take an aggressive approach against ad-blocking typically say that blocking ads is like taking a free ride. You try to benefit from free content without paying the price. And this is an argument that can’t be dismissed just like that. Remember that advertising is the engine for a significant part of the net. Imagine that 100% of the users would use 100% effective ad-blockers. What would our virtual world look like in that case? I don’t know, but it would definitively be a different world. But on the other hand, it’s easy to find sites where advertising definitively has gone overboard. So it is understandable if the advertisers receive little sympathy for their fight against ad-blocking. This is yet another question without any clear and simple answers. So let’s pass it to you, dear readers. What do you think about advertising on the web? [polldaddy poll=9139628] [caption id="attachment_8591" align="aligncenter" width="1024"] Article trying to defend advertising. The beef is there under the ad. ;)[/caption] Safe surfing, Micke Image: iPhone and www.streamingmedia.com screenshots