With the recent terrorist threats & activities taking place globally from the eastern world to the western world, it is a known fact now that all government agencies are working together to read, track and analyse most of the internet traffic. Whether you are in India, USSR, France, UK Algeria or US, online traffic is now analysed by government agencies as a precautionary measure to thwart terrorist attacks and cyber warfare.
This article is a in-depth exposure of all you wanted to know about anonymous browsing, TOR, VPN, I2P and how the World’s government agencies can read all your private data without your consent and track you on the internet. I have further elaborated on how you can possibly stop others from snooping into your private data and possible ways to stay anonymous on the internet.
Even with recent revelations that the NSA is listening and tracking your activities on the NET, there are ways to anonymously browse on the internet. Tor is still probably the best way to anonymously surf the net. But to do it right, you’ve got to take some precautions. You need to know what Tor is, its alternatives and what they can do to keep you keep you anonymous on the web. Each has its strength and pitfalls.
This article takes a deep dive into implementation of maintaining anonymous identity on the internet, its pros and cons. I have also described some best possible Tools and Platforms to stay anonymous on the internet, along with the strengths and weaknesses.
Tor: The Anonymous Internet, and is It right for you
Tor by far is the best & easiest way to browse the web anonymously, but you have to be clear as to why that matters or why you’d need to use it. Let’s take a look at what Tor does, who uses it, and perhaps most importantly, what Tor doesn’t do.
What is Tor and how does it work to keep you Anonymous while browsing?
Tor is short for The Onion Router (thus the logo) and was initially a worldwide network of servers developed with the U.S. Navy that enabled people to browse the internet anonymously. Now, it’s a non-profit organization whose main purpose is the research and development of online privacy tools.
The Tor network disguises your identity by moving your traffic across different Tor servers, and encrypting that traffic so it isn’t traced back to you. Anyone who tries would see traffic coming from random nodes on the Tor network, rather than your computer.
To access this network, you just need to download the Tor browser. Everything you do in the browser goes through the Tor network and doesn’t need any setup or configuration from you. That said, since your data goes through a lot of relays, it’s slow, so you’ll experience a much more sluggish internet than usual when you’re using Tor.
Since you can easily google a plethora of articles on Tor installations I will not discuss Tor installation.
What Tor Is Good For
If you want to be anonymous—say, if you live under a dictatorship, you’re a journalist in an oppressive country, or a hacker looking to stay hidden from the government—Tor is one of the easiest ways to anonymize your traffic, and it’s free. It’s far from perfect, though (we’ll get to that in a moment).
On a more general level, Tor is useful for anyone who wants to keep their internet activities out of the hands of advertisers, ISPs, and web sites. That includes people getting around censorship restrictions in their country, police officers looking to hide their IP address, or anyone else who doesn’t want their browsing habits linked to them.
Tor’s technology isn’t just about browsing anonymously. It can also host web sites through its hidden services that are only accessible by other Tor users. It’s on one of these hidden service sites that something like The Silk Road exists to traffic drugs. Tor’s hosting capabilities tend to pop up in police reports for things like child pornography and arms trading, too.
What Tor Doesn’t Do
Tor is handy, but it’s far from perfect. Don’t think just because you’re using Tor that you’re perfectly anonymous. Someone like the NSA can tell if you’re a Tor user and that makes them more likely to target you. With a enough work, the government can figure out who you are.
Furthermore, anonymity is not the same as security. It’s hard to hack into the Tor network, but the browser is a different story. As we found in 2014, the NSA can get into your browser a lot easier than it can in the network and once it does, it gets access to everything else. So, “man in the middle” style attacks on Tor are still possible with help of your internet service providers (ISP).
You still need to use HTTPS whenever possible to protect yourself from man-in-the-middle style attacks. Likewise, Tor is only as strong as its browser, which has had security flaws before, so it’s worth making sure you always have the newest version.
So Should You Use Tor?
As I mentioned above, if you’re an average user looking at images of ladies 😉 or men and browsing Facebook, you probably don’t need to worry about the government agencies spying on your activity, and Tor is just going to slow down your connection. It’s more likely that you need to secure your internet rather than anonymize it, say, when you’re using public Wi-Fi. In that case, you’d want to make sure you’re using HTTPS on all sites that support it, and possibly even use a VPN to encrypt all your traffic when you’re away from home.
If you want to stay anonymous because you’re downloading large files and don’t want people to see what you’re downloading—say, on BitTorrent—Tor is not a good solution. It won’t keep you anonymous, and you’ll slow down everyone else’s traffic for no reason. In this case, you’d want a proxy or a VPN instead.
The most noticeable drawbacks to using Tor are performance-related. Since internet traffic is being routed through at least three relays, it tends to get held up along the way. This is especially noticeable for heavier elements like audio and video tracks, and based on the number of users signing up to act as relays, it gets worse with more users on the network. Tor is well aware of its speed issues, though, and maintains a pretty comprehensive troubleshooting guide.
Where using Tor really gets tricky is when intelligence agencies step in. Obviously, the government’s cybersecurity hawks are aware of Tor and its capabilities. As I mentioned a little earlier, they also see its use as cause for concern. As the leaked document signed by Attorney General Eric Holder details, the NSA identifies people using anonymity software like Tor as foreign nationals by default. These users “will not be treated as a United States person, unless such person can be positively identified as such, or the nature or circumstances of the person’s communications give rise to a reasonable belief that such person is a United States person.” If it’s eventually confirmed that the person of interest is in fact an American citizen, though, the records are destroyed.
There are other risks to be considered when using Tor. Those hosting exit relays, for instance, attract attention from law enforcement agencies and may receive copyright takedown notices (among other things). It is also possible that you might have your computer seized by law enforcement if you’re running an exit relay, though nobody has never been sued or prosecuted for doing so. Finally, as with any anonymous service, there’s always the chance that very smart hackers can connect the dots and figure out who you are. It would be very difficult, but not impossible.
Alternatives to Tor
While Tor has its downsides, it’s probably the easiest and best way to use the internet anonymously. Like I said before, though, the growing popularity of the software could signal some changes with how authorities treat it. So it’s always nice to have alternatives.
a) Virtual Private Network (VPN)
The most popular method for becoming anonymous is the Virtual Private Network (VPN), typically those that are encrypted. As the name implies, a VPN is a private network that’s spread across the public internet enabling that can also be used to encrypt data or increase security of individual accounts. Depending on what VPN you use, you’ll have access to different levels of security. The good news is that VPNs work well. The bad news is that they cost money. While there are hundreds of choices available and one can easily narrow down to a few good ones. VPS vendors do hold records of all its users and traffic sources (server logs). Most of the VPN vendors will advertise that they do not store traffic (server) logs of its users but this far from true. Government agencies can extract this data out from the VPN vendors as and when needed or these VPN vendors risk legal action.
If you recall that when a member of LulzSec (black hat computer hacking group) got arrested, even when he was using the VPN service called “HideMyAss”? Said VPN service claimed that they never handed over any logs to anyone, let alone even keep them. And yet, when the officials came knocking on their door, they suddenly had logs and handed them all over. The thing I am trying to say is: just because a VPN service says it doesn’t keep logs, does not mean they actually do. Don’t trust anyone!
b) Use I2P with an exit node outside the US
Discussed in detail towards the end of this study.
To Tor or Not to Tor
So what’s the verdict? Before you decide, think hard about what you’re doing online and why you want to remain anonymous. If you’re just trying to cover your tracks after looking at porn or something, a private browsing mode like Chrome’s Incognito feature will probably suffice. But if you’re someone who’s trying to evade the authorities for piracy or whatever reason—we’re not here to judge—or are generally spooked by the NSA and other local government agencies in your country, a more heavy duty solution is in order.
So if you do really want to be almost completely anonymous, use Tor. Any alternative is going to present more drawbacks, whether it’s a paid subscription or unwanted ads, and it’s hard to argue with Tor’s convenience. Plus, there’s a good reason why Tor’s become so popular: Though slow on performance, it usually works great. While that record might be challenged soon and it’s not 100 percent flawless, Tor is good enough for you if it’s good enough for the million plus people in the network. And it’s always getting better.
Although Tor is considered to provide a very high level anonymity, and if used carefully remains regarded as secure, law enforcement agencies and the NSA have developed a number of techniques that can be effectively used to de-anonymize users.
It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor malware attack in the past, the NSA can easily exploit the network.
The experts at Information Security Stack Exchange provide guidance on the safe way to use Tor.
How the NSA Is Working to De-Anonymize You When Browsing the Deep Web
Ever since the FBI took down the Silk Road and Dread Pirate Roberts, many questions have been raised about whether Tor still provides anonymity or not, and if it’s now broken. I’ll try to address that question here today succinctly from multiple angles, keeping it as simple and plain-language as possible.
The Closing of Silk Road
First, let’s address the Silk Road takedown. According to published reports, the FBI relied upon good old investigative techniques to track down Dread Pirate Roberts. They gave no indication that they used a flaw in Tor to do this, but if they did and didn’t tell us, it would not be the first time the FBI was disingenuous with the American public.
Even if the FBI did not use flaws in Tor to take down Silk Road, there remain questions about whether Tor still delivers the anonymity that so many have assumed it did. Let’s take a look at some of the techniques that NSA is employing right now to break your anonymity on the Tor network.
The Snowden Revelations
Edward Snowden, the NSA contractor now in exile in the Russian Federation after leaking information of NSA spying on innocents across the globe, revealed some information on how NSA is cracking Tor.
Tor has always been a thorn in the NSA side as they hate anyone that can do anything without the NSA being able to spy on them. As such, they have focused significant resources to be able to open Tor to their spying.
As you know, Tor relies upon a series of volunteer Tor relays or routers to move data across the globe, similar but separate from the routers that are used on the Internet. These routers are usually individuals who lend some of their bandwidth in the interest of global privacy and anonymity. These routers only track the last IP address the packet came from and is going to and not the original source IP.
It turns out that the NSA has set up some of their own Tor routers to be able to track some of the Tor network traffic. By setting up their own Tor routers, the NSA is able to sniff some of the Tor traffic as it passes their relay/router.
Of course, this doesn’t give them a peek at all Tor traffic (they would have to set up thousands of Tor routers and make certain that traffic did not access the other routers to do this), but it does give them a peek of at least some of it.
How the Government agencies track you on the internet
The Firefox Flaws
It also turns out that the NSA had been taking advantage of a zero-day vulnerability in the Firefox web browser used by Tor. NSA has been embedding cookies that tracked Tor users on the net. That flaw has been closed by the Mozilla Project, but you may still have that cookie in your browser and are being tracked by NSA.
For optimal anonymity, delete your cookies and update your Tor browser.
SSL Is Not as Secure as You Think
NSA has been working on cracking SSL encryption for some time. Tor is dependent upon SSL and its 1024-bit encryption to maintain its anonymity. Each relay only decrypts enough information to be able to send the packet to the next relay. These 1024-bit keys are rapidly becoming outdated as computing horsepower has increased.
Recognizing this, the Tor project has been moving to the far more secure elliptical curve cryptography (ECC). Unfortunately, only about one-quarter of all Tor sites have updated to the more secure elliptical curve cryptography, leaving three-quarters of Tor traffic susceptible to NSA decryption and snooping.
How Google Ads Hurt Us
Apparently, NSA has also been using advertising services like Google AdSense to be able to track Tor users. Here’s how it works.
When you’re using Tor and click on an ad, it places a cookie in your browser. When you use that same browser—even while not using Tor capabilities and the Tor network—the NSA can look for that cookie to identify you as a Tor user.
They can then correlate that cookie with your actual IP address that appears on every website when you’re not using Tor.
Entry & Exit Points
As the NSA has access to ALL traffic on the Internet, and all Tor traffic looks different from regular Internet traffic, they can identify Tor traffic from other Internet traffic.
It has long been known that if an adversary had access to both the entry and exit points on Tor, they can determine both the user and the destination.
It goes without saying, that the NSA has access to all of this information, so if they want, they can identify you and your destination.
The NSA Scandal: How Uncle Sam Can Read All Your Private Data without Your Consent (And How to Stop It)
The USA PATRIOT act, or it’s full name: “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001”, is the unique law that gives the NSA the permission to spy on any infrastructure owned by the US. This law was originally created to prevent terrorism attacks in the US after 9/11, by giving the NSA the ability to spy. The Patriot Act was signed by President George W. Bush on October 26, 2001. The Patriot Act consists of 10 titles. You can always read the Wikipedia page to know more about this act.
The scary thing about this law is that it pretty much ignores country borders. With “any American infrastructure”, I really mean “any American infrastructure”.
The Patriot Act simply gives the US government the permission to read and access the data of anyone they find suspicious without question, as long as they are on their infrastructure. But this goes much further. The Patriot Act also allows something called “mass surveillance”. Which basically means that pretty much everything is recorded and stored, but not accessed when not needed. Even if it is for the law, this is still a huge invasion of your online privacy. So basically, even if you haven’t done anything wrong, you are still being watched by “Big Brother”.
Spying Outside of the US
Think you are safe from Uncle Sam’s prying eyes because you don’t live in the US? Think again. Like I said, the Patriot Act applies to ALL US infrastructure! What this basically means is that any kind of technology made by the US can be looked into by the US government, regardless of where it is deployed. A perfect example of this is the Windows OS. Windows is developed by Microsoft, which is based in the US, so Microsoft falls under the US law. That means that the NSA can request any data they have about their customers, whether they are US citizens or not. And just to give you a heads up: 95% of the internet (not servers) runs Windows. Can you see where this is going?
Then there is also the thing that daughter companies based outside the US, but whose main company is based in the US, also fall under this law. An example is Mojang, which has been purchased by Microsoft quite some time ago. Like I mentioned above, Microsoft is a company based in the US, and technically, Mojang is a part of Microsoft. Which means that the NSA can easily demand backdoors/logs of Minecraft, for example.
What about companies that are not based in the US, but offer services in the US? The services they provide within the US also fall under this law. An example is CyberGhost. They are VPN providers based in Romania, but they have servers in the US as well. The NSA can demand logs of their servers that are based in the US. CyberGhost claims that they don’t keep any logs, but the NSA can still demand a backdoor in the US servers if they want to, let alone that they can force the ISP of those servers to sniff the traffic coming out of the servers. And even if your real IP is still hidden by the server, when the NSA finds any kind of criminal content in those sniffs, I don’t think CyberGhost will have a good time if they refuse to hand over any logs, because they don’t have them.
Besides, does anyone remember that time when a member of LulzSec got arrested, even when he was using the VPN service called “HideMyAss”? Said VPN service claimed that they never handed over any logs to anyone, let alone even keep them. And yet, when the officials came knocking on their door, they suddenly had logs and handed them all over. The thing I am trying to say is: just because a VPN service says it doesn’t keep logs, does not mean they actually do. Don’t trust anyone!
And last but not least: tourists in the US can also be spied on by the NSA. Despite them being from another nationality, their phone and other communications uses the US infrastructure as long as they are in the US. Which means the NSA can also spy on them. This makes sense to me actually, because the patriot act was originally created to spot terrorists. And every outsider that is in the US can be a potential terrorist.
This is strategically ingenious in my eyes. The US government probably knew they controlled most of the monopoly on the digital market, so they took advantage of this.
So How Do We Stop This?
Okay, I think I now made clear that the reach of the NSA goes FAR beyond what we expected. But despite its reach being almost unlimited, it ISN’T unlimited! NSA spying can be easily overcome by… well… not using anything that is from the US!
But that is actually quite hard, because almost everything in the IT industry is some sort of American product. So here are a few tips that will keep you out of Uncle Sam’s reach:
Staying Hidden Outside the US
Not being in the US already gives you a big advantage, but it is not enough. So here is what you should do to increase your chances of anonymity:
Try to avoid products from the US.
This is, I think, the best solution to NSA spying. By simply not using any digital US products or services based in the US, the NSA also can’t spy on you, because those services don’t fall under US law. Try to use Windows as less as possible, but go for a Linux distro not based in the US. Linux is open source, so it is also less likely to be back doored.
Be careful what you do when using US-based services
Using an US based is inevitable eventually. So when you use an US based service, be careful what you click, read, post, send, and re-twit. The NSA most likely won’t spy constantly on said services, but they easily could be. So keep that in mind.
Use as much open source as you can
Open source projects are less likely to be back doored, because the source code is publicly available. So what you should do is get the source code of said program, look up how to compile/build it, and then compile/build it yourself.
Encryption is your friend
Many cloud services are based in the US. So if you ever need to store a file on a server that is in the US or owned by an American company, MAKE SURE TO ENCRYPT IT! I recommend encrypting your files with AES-256.
It never hurts to use a proxy
Even if you are outside the US, you shouldn’t connect to any US-based server with your real IP. You don’t need to set up an encrypted connection (unless you have an US-based ISP), so just a single proxy will do. 2 countries that would never hand over anything to the US, regardless of what happens, are definitely Russia and China. But both of said countries aren’t known for being the most privacy friendly countries. My recommendation is Sweden, because Sweden seems to take internet privacy pretty seriously, and they have a really solid privacy law.
Use a different password when using an US-based service
This is a tip I really recommend. When you use any kind of US based service (like Skype, your Microsoft account, etc.), use a different password than your normal password. Those services might be back-doored, so just be careful.
Staying Hidden Inside the US
You are from the US, but still want to escape from the grip your government has on you? Don’t worry, because it is even possible for you to slip under big brother’s hands! Except following above tips, all you need to do extra is encrypt your internet traffic, so the NSA can’t sniff your traffic. This can be done by either using a VPN you trust, or I2P.
Another thing you should keep in mind, is that it is not only your internet traffic that is being sniffed, but also your phone calls, text messages, what TV channel you watch, everything is recorded when you are in the US.
Use a trustworthy VPN
Don’t trust anyone blindly, but you should still use a VPN service. I recommend CyberGhost VPN. But make sure you select a server outside the US, because otherwise, nothing will really help. Consider using a server located in Sweden, as I mentioned earlier, they are a very friendly country when it comes to privacy.
Invisible Internet and Onion Routing
I2P initially began in 2003 as a proposed modification to Freenet. To deal with a wide range of attacks, I2P is fully distributed with no centralized resources— hence there are no directory servers keeping statistics regarding the performance and reliability of routers within the network. I2P is not 100% secure, as nothing is 100% secure as of date, but using it will provide you with meaningful security nonetheless.
Content sent over I2P is encrypted through three-layer garlic encryption, used to verify the delivery of the message to the recipient. All messages passing through a tunnel are encrypted by the tunnel gateway to the tunnel endpoint, and undergo inter-router transport layer encryption along the way. You also have the ability to tunnel TCP/IP based applications (IRC, Jabber, steaming music, etc.) through the network. In fact, you can even tunnel your torrent downloads!
I’d recommend this method over a VPN, actually. Why? Because the NSA might find it suspicious that you are using a VPN, and in the case of a VPN, they can talk to the company. If you are using a VPN outside of the US, they can’t be forced to follow the patriot act, but you are better to take the sure for the unsure. When you use I2P, the NSA will also spot that you are using I2P, but since I2P is a decentralized (peer to peer) network, they can’t track it back to an organization. You just need to make sure that your exit node is not located in the US, because then you might be vulnerable to a certain attack where the NSA can decrypt all the traffic going through the 3 nodes. If all 3 nodes are in the US, that means you are likely to be watched on. To check if your exit node is outside the US, simply go to an IP checking site after you configured your web browser to use I2P, and then locate the country of the IP address using a service like IP tracker.
Hold sensitive conversations through I2P.
The NSA can spy on your cell phone calls too. Sadly, I don’t know of any workarounds for that. If you want to tell something to someone and you don’t want anyone to see it, you should use IRC with I2P. Allen Freeman who wrote a really good article to do just that.
Uncle Sam Isn’t the Only Bully
Okay, I’ve been targeting the US for the entire article now. But unfortunately, the US isn’t the only country that spies on its citizens. Germany for example, despite having a strong privacy law, also have an anti-terrorism program that is not too different from the patriot act. Germany is just an example. As of date, France, the UK, The Netherlands, Spain, and other countries also have an anti-terrorism program.
The reason I wrote solely about the NSA is because 1. It is the most known case of cyber-espionage and 2. The NSA has scale it out to astronomically!
So regardless of where you live, you should keep my tips in mind. You will never be truly anonymous, but you can be almost untraceable if you keep my tips in mind, and put some of your own effort into it as well, which brings me to the next point.
You Will Need to Change Your Mentality if You Truly Want to Be Anonymous
I think the headline says it. If you are really paranoid and you don’t want anyone following you, you should abandon social media like Facebook and twitter (or don’t use your real name on the latter). Most famous black- and greyhats got busted simply because they made these mistakes. They routed all their connections through the TOR or I2P network, they encrypted their entire hard drive, but they made the single mistake of bragging about their attacks on social media.