DOCSEARCHbyAlgolia
Submit Docs

The Hitchhiker's Guide to Online Anonymity

repository·main·Indexed 20 days ago

https://github.com/anon-planet/thgtoa

A comprehensive guide for online anonymity and Operational Security (OpSec) designed for activists, journalists, and whistleblowers. It covers online tracking and ID verification techniques, guidance for maintaining anonymous identities, and mitigations for IP exposure, DNS leaks, RFID/Bluetooth tracking, and Tor traffic analysis.

Tokens
70K
Snippets
60
Records
313
Agent score
73%

What's inside thgtoa

  1. Overview of thgtoa

    main

    thgtoa (The Hitchhiker's Guide to Online Anonymity) is a comprehensive guide focused on online anonymity and Operational Security (OpSec). It provides detailed information on:

    • Online tracking techniques
    • Online ID verification techniques
    • Guidance for creating and maintaining anonymous online identities

    The project is licensed under Creative Commons Attribution-ShareAlike 4.0 International (cc-by-sa-4.0), meaning it can be used for any purpose, including commercial use, provided proper attribution is given.

  2. Review requirements and limitations for using the guide

    main

    Before proceeding with the guide, ensure you meet the following criteria and understand the scope:

    Requirements

    • Language: Proficiency in English (specifically American English).
    • Legal Context: Ideally, be a resident of Germany (where pseudonymity is legally protected under §13 VI of the German Telemedia Act of 2007) or verify the legality of these practices in your own jurisdiction.
    • Hardware: Access to a personal laptop (Windows/Linux/macOS), ideally not a work or shared device.
    • Commitment: Patience and free time, as implementing these techniques can take several weeks.

    Limitations & Prohibited Uses

    This guide is not intended for:

    • Creating bot accounts.
    • Identity theft or impersonation.
    • Malicious activities (trolling, stalking, harassment, fraud, etc.).
    • Use by minors.

    Disclaimer: This guide is not legal advice. Use it at your own risk and verify compliance with your local laws.

  3. Access The Hitchhiker's Guide to Online Anonymity

    main

    The Hitchhiker's Guide to Online Anonymity (THGTOA) provides resources for tracking techniques, ID verification, anonymous identity creation, and operational security. You can consume the content in several ways:

    • Read Online: Access the full guide directly via the web interface.
    • Download Offline Copies: Download the guide as a PDF or ODT file for offline use.
    • Tor Mirror: Access the guide via a .onion address to ensure your IP and destination remain private without exit node exposure.
    • Verify Authenticity: Use GPG signatures and SHA256 checksums to verify the integrity of downloaded files.

  4. Understand and mitigate digital metadata risks

    main

    Metadata is structured data embedded in or alongside files (describing how, when, where, and with what a file was created) that can be used to identify authors or locations. Common risks include:

    • File Metadata: Print metadata (serial numbers), revision history in documents, and digital timestamps.
    • Location Data: Harvested by smartphones, operating systems (Android/iOS), browsers, and apps.
    • Correlation: Even if using a VPN, an ISP may know when you connected to a VPN, which can be correlated with service activity.

    Mitigation:

    • Use tools to strip metadata from files before sharing.
    • Refer to the Metadata auditing section of the guide for specific removal methods.

  5. Key concepts for anonymous chatting and file sharing

    main

    When selecting messaging apps for sensitive activities, evaluate them based on these security properties:

    End-to-End Encryption (E2EE)

    Ensures only the sender and recipient can decrypt communications. When evaluating providers, check if:

    • Metadata is protected or just the content.
    • E2EE is opt-in (disabled by default) or opt-out.
    • E2EE applies to group messaging as well as 1-to-1.
    • The app is Open-Source, allowing verification of encryption claims.

    Forward Secrecy (FS/PFS)

    Ensures that every new session generates a new set of keys. If current keys are compromised, past communications remain secure. Prefer open-source apps that implement this, as some providers omit it for usability (e.g., in group chats).

    Zero-Access Encryption at Rest

    Ensures that data stored by a provider (like chat history or backups) is encrypted on your side, so the provider cannot read it. This protects against server-side hacks and data harvesting.

    Metadata Protection

    E2EE protects content, but not necessarily metadata (who you talk to, when, for how long, group memberships). Look for protocols like the Signal Protocol which offers features like:

    • Sealed Sender
    • Private Contact Discovery
    • Private Group System

  6. Understand Secure Boot and its limitations

    main

    Secure Boot is a UEFI security feature that prevents the computer from booting an operating system with an unsigned bootloader.

    How it works:

    • It uses keys stored in the UEFI firmware to verify the integrity of the bootloader.
    • Most mainstream Linux distributions (Ubuntu, Fedora, Debian, etc.) and Windows support it.
    • You can use "custom mode" in some laptops to manage keys and only authorize your own signed bootloaders.

    Critical Limitations:

    • No Encryption: Secure Boot does not encrypt your disk. It must be used in conjunction with Full Disk Encryption (FDE) to protect data from physical disk theft.
    • No Protection against Compromised Signatures: It cannot protect against a bootloader that has been legitimately signed by a compromised manufacturer (e.g., Microsoft).
    • Qubes OS Compatibility: Qubes OS does not support Secure Boot out of the box.

  7. Understand Wi-Fi and Bluetooth geolocation tracking

    main

    Mobile operating systems (Android/iOS) maintain databases of Wi-Fi access points and Bluetooth devices to provide precise geolocation, even when GPS is off. This continuous probing can be used to fingerprint and track users.

    Mitigation:

    • Be aware that Android devices are particularly difficult to secure due to Google's telemetry.
    • Use a Faraday cage for high-sensitivity environments.
    • Note that advanced radio interference techniques can track movement even inside buildings.

  8. Understand Plausible Deniability and its risks

    main

    What is Plausible Deniability?

    Plausible deniability (or Deniable Encryption) allows you to cooperate with an adversary by providing a password that only grants access to "plausible data" (a decoy OS or file container), while your true secret data remains hidden. The goal is to ensure an investigator cannot prove that hidden data exists.

    Threats to Encryption

    1. The 5$ Wrench Attack (Rubber-hose cryptanalysis)

    Encryption is ineffective against physical coercion or torture. If your threat model includes hard adversaries, do not rely on plausible deniability; use standard, robust encryption (e.g., Windows Pro with Bitlocker).

    2. Evil Maid Attack

    An adversary tampers with your device while it is unattended (e.g., installing keyloggers or cloning the drive). Mitigation strategies:

    • Use physical tamper protection to prevent unauthorized access to internals.
    • Disable USB ports in a password-protected BIOS/UEFI.
    • Set BIOS/UEFI/Firmware passwords to prevent unauthorized booting.
    • Enable Anti-Evil Maid (AEM) protection if supported (e.g., Windows/VeraCrypt or Qubes OS on Intel).

    3. Cold-Boot Attack

    An adversary captures the contents of your RAM immediately after shutdown or while the device is in sleep mode to extract encryption keys. Mitigation strategies:

    • Avoid Sleep/Stand-by: Use Shutdown or Hibernate instead. Sleep maintains power to the RAM, keeping keys resident. Shutdown and Hibernation clear the keys from memory.
    • VeraCrypt settings: Enable the option to "Wipe keys from memory" when a device is inserted.
    • RAM Encryption: If supported by your OS/software, encrypt keys within the RAM.

  9. Core Principle: Compartmentalization of Identities

    main

    The most critical rule for maintaining OPSEC is complete compartmentalization.

    Keep your anonymous identities completely sandboxed from your normal environment and real identity.

    Do not share any information, data, or assets between your anonymous environments and your real-identity environment. Most OPSEC failures result from accidental information leaks rather than technical failures.

  10. Understand SSD Garbage Collection

    main

    Garbage Collection is an autonomous internal process managed by the SSD controller.

    • Process: The controller identifies blocks containing pages marked for deletion (via Trim), copies the remaining valid pages to a new block, and then erases the entire source block.
    • Relationship to Trim: While Garbage Collection can function without Trim, it is significantly more efficient and faster when Trim is used to mark data for erasure.
    • Role in Security: Garbage Collection is the actual mechanism that physically erases data from the drive permanently.

  11. Limitations of the Tor Browser route

    main

    While the Tor Browser route is the simplest method for anonymous browsing, it has significant limitations:

    • Adversary Resistance: It is not designed to resist highly skilled adversaries.
    • Traffic Analysis: It is vulnerable to correlation attacks.
    • Device Integrity: It is blind to malware, exploits, viruses, remote administration software, or parental controls present on your device.
    • Complexity: For higher security requirements, more advanced methods (not covered in this simple route) are recommended to lower the attack surface.

  12. Understand the difference between Privacy and Anonymity

    main

    The guide distinguishes between these two core concepts to help users define their goals:

    • Privacy: People know who you are, but they do not know what you are doing.
    • Anonymity: People know what you are doing, but they do not know who you are.