View source for Anonymizing yourself

{{TOCright}}
The internet is a cruel and horrible place. You might want to drop out of the matrix and join an anonymous network. Alternatively, you can take steps to minimize data-minining by reducing your online fingerprint.

A broad approach on how to start evading global data surveillance and improving your overall online privacy can be found [https://prism-break.org/ here], and [https://www.privacytools.io/ here].

== Anonymous networks ==

=== [[File:Torbrowser.png|48px]] [https://www.torproject.org/ Tor] ===

<span style="padding-left: 20px;">''Main article: [[Tor]]''</span>

Let's get something clear: [[Tor]] is '''NOT''' illegal to use (unless you live in one of those crazy whackjob countries run by a militant dictator such as Iran or China). Tor traffic was '''NOT''' significantly reduced by the removal of Silk Road, and as far as is known, new compromises for the underlying Tor framework did not come about from the removal of Silk Road. If you are interested, concerned or skeptical, check out [http://www.youtube.com/watch?v=CJNxbpbHA-I this video here] and [https://www.torproject.org/docs/faq.html.en read the FAQ].

Tor sets up a SOCKS proxy to the normal internet, allowing you to send any application’s connection anonymously through the Tor network. Any connections made through Tor will be '''anonymized but not confidential''' unless you use end to end encryption in the application, like SSL/TLS for web browsing, or an SSH tunnel. Torrenting is discouraged as it uses up too much bandwidth, and torrenting on Tor is near-impossible due to latency issues.

=== [[File:I2p.png|48px]] [https://geti2p.net/en/ I2P] ===

I2P is end to end encrypted and separate from the normal internet; this means that connections through I2P are '''confidential and anonymous'''. No-one can know who you are talking to, or what you are saying to them, because there are no exit nodes. Tor onion services (.onions) work in a similar way. All internet applications can be forwarded through I2P including ed2k, Gnutella, and torrents. Unlike Tor, I2P encourages torrenting on the network, although you cannot connect to non-I2P torrent swarms. Also unlike Tor, I2P is not an outproxy for the clearweb and uses Tor as an outproxy to non-I2P domains. "Hidden" services that would be called onions on the Tor network are called eepsites on the I2P network and end in the '.i2p' domain.

=== [[File:Freenet.png|48px]] [https://freenetproject.org/ Freenet] ===

Freenet is a distributed filesystem, where you can store files ‘in the cloud’ and download them anonymously from the Freenet network. Many of the files are HTML pages which can be viewed as static websites using a browser, and many are standalone files which can be searched and downloaded anonymously. Freenet content is undeletable as there is no way of knowing which node is holding each file. An example of a Freenet link is like this:

http://127.0.0.1:8888/USK@Ls9yplmu~tAb7XDGZBdstFdt~aaDagL1xknrN~fvRLo,c-XpJ5njAmwz~iWJm11lifb6Q54Xj6mGBoG6cuiSA1U,AQACAAE/NSAspycenter/1/

This follows this scheme

http://[LOCALHOST]:[FREENET PORT]/[TYPE OF KEY IDENTIFIER]@[HASHED IDENTIFIER]/[HUMAN-READABLE ADDRESS (OF SPECIFIC PAGE ON HASH)]/[VERSION OF PAGE]

When using Freenet, it is recommended to have your connection settings to "normal" (which is the highest it can be set when connecting to strangers), and your encryption settings to Maximum (which uses temporary keys and wipes the cache when you shutdown the server). Once you get more experienced with Freenet, you can switch to darknet mode, which prohibits stranger connections but requires you to connect to at least 5 friends you personally know. They also need to connect to you. '''NOTE: These friends you connect to can see your plain-text IP address, and as such only add people you truly trust.'''

Freenet has existed since 2000, and because of this, there are a large number of web 1.0 abandoned sites made by early adopters of the service. Also, because of being so old, it is programmed in [[Java]], which was commonplace at the time.

Please note that the Freenet network (much like other, especially anonymous, networks) attracts criminals and a number of sites contain child pornography. Some sites jokingly add a disclaimer saying ''This site does not contain child pornography. click here to continue.''

== Browsers ==

'''See [https://www.privacytools.io/ privacytools.io].'''

* Always use an [https://wiki.installgentoo.com/wiki/Web_browsers open-source browser]. This ensures it can be freely audited. [[Google]] [[Chrome]] is not open-source, and while Chromium is, it hasn't been fully audited yet.
* Use a search engine that at least claims to respect your privacy such as [https://metager.org/ MetaGer](encrypted google searches) or [ixquick.com ixquick](non-Google searches, owned by StartPage) instead of Google. Note that while [https://duckduckgo.com DuckDuckGo] is a better alternative than Google or Bing, it's based in the US and has known issues that [https://8ch.net/tech/ddg.html raise the possibility of privacy concerns].

=== [[File:Software Chromium.png|48px]] [[Chromium]] ===

Using Chromium is generally not recommended because even though you can disable its known tracking features (the RLZ identifier is in Chrome, not Chromium), Chromium's code isn't as audited as Firefox's and Chromium's security addons don't provide the same fine-grained control over web requests as Firefox's, due to its extension API being slightly less broad (no control over WebSockets, for instance). If you absolutely refuse to use anything else, follow these instructions:

* If you seriously sync Chromium to your Google account, you're a fucking dumbass. De-sync the two immediately.
* Go to your settings menu, click advanced settings scroll down to privacy, and turn everything off.
* Go to Content Settings above that and check "Block 3rd party cookies and site data"
* Unless you want to use a script blocker, also turn off JavaScript.
* Now scroll down to "Continue running background apps while Chromium is closed" and disable that as well unless you trust your addons.

Despite all of this, there are [[Chromium#Notable_forks|a few forks]] that offer parity with the stable release, which are also open-source and have taken invasive Google crap out of the browser, as well as implemented some extra security measures. Alternatively, you can compile the browser yourself and apply one of these [[Chromium#Notable_patches|many patches]].

==== Security extensions ====
See them [[Chromium##Notable_Extensions|here]].

=== [[File:Firefox.png|48px]] [[Firefox|Mozilla Firefox]] ===

It is recommended that you compile [[Firefox]] from scratch/source, as it allows you to make use of security oriented USE flags such as ''hardened'' and forcing it to use more up to date system-wide libraries (eg: systemsqlite).
To ensure maximum security while browsing the internet, always turn off third party cookies, unless you're using a proper firewall like uMatrix, for finer-grained control, in which case you should still put the appropriate measures into place. Mozilla describes them as: ''For example, cnn.com might have a Facebook like button on their site. That like button will set a cookie that can be read by Facebook. That would be considered a third-party cookie.''

'''Change your search engine'''. There are ways to get around Google’s insane profiling. See [[Search engines]].

'''Use freshplayer [GNU/Linux only]'''. Freshplayer is a  NPAPI wrapper for PPAPI Flash that works on Firefox. It is inherently safer and more performant, if you must use flash.

If you can, use a [[fork]] of Firefox, such as [[GNU IceCat]] or [[Debian Iceweasel]].

==== Security extensions ====
There are many extensions available for Firefox to make you less trackable. Refer to the [[Firefox#Adblocking.2C_privacy.2C_and_security|Firefox]] article for a comprehensive list of addons.

== Fingerprinting ==
Fingerprinting is the process of using otherwise non-identifying information to identify you. When enough non-identifying information is collected, you will usually be unique amongst others.
{| class="wikitable"
|-
| '''Threat'''
| '''Countermeasure'''
|- valign="top"
| 
* Plugins such as Flash or Java leak information.
| '''Recommended:''' Disable and uninstall browser Plugins (note: Plugins are different than Extensions) such as Flash and Java.
Alternative: Set the plugin to "Ask to activate". You will still be vulnerable whenever you activate that plugin.
|- valign="top"
| 
* JavaScript leaks information
| '''Recommended:''' Disable JavaScript
Alternative: Use [https://addons.mozilla.org/en-US/firefox/addon/umatrix uMatrix] or [https://addons.mozilla.org/en-US/firefox/addon/noscript NoScript] to whitelist JavaScript on a per-site basis. You will still be vulnerable on those sites.
|- valign="top"
| 
* HTTP Header information can be identifying
| '''Recommended:''' Use an extension such as [https://dephormation.org.uk/index.php?page=81 Secret Agent] to randomize header information. Alternatively, you can change your HTTP_ACCEPT headers by modifying your [https://github.com/CrisBRM/user.js/ about:config/prefs.js] file.
|- valign="top"
| 
* Cookies can be used to track you
| [https://support.mozilla.org/en-US/kb/disable-third-party-cookies Disable 3rd Party Cookies] and use an extension such as [https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies Self-Destructing Cookies] to automatically purge cookies.
|- valign="top"
| 
* IP Addresses can be personally identifiable
| '''Recommended:''' Use an [[Anonymizing_yourself#Anonymous_Networks|anonymous network]], a non-logging [[VPN]] service, or a non-logging proxy service. Check out our very comprehensive article on [[VPN|VPNs]] for ways to further foil this mechanism.
|- valign="top"
| 
* Cross-site Requests may expose you to tracking.
| '''Recommended:''' Use an extension such as [https://addons.mozilla.org/en-US/firefox/addon/uMatrix uMatrix] or [https://addons.mozilla.org/en-US/firefox/addon/requestpolicy-continued/ RequestPolicyContinued] to selectively whitelist such requests.
|-
| 
* The HTTP referrer header may leak information
| '''Recommended:''' Turn off sending HTTP referer information.
Alternative: Install an extension such as [https://addons.mozilla.org/en-US/firefox/addon/smart-referer/ Smart Referer] to keep referer information limited to a single domain, or [https://addons.mozilla.org/en-US/firefox/addon/uMatrix uMatrix] to spoof it on a per-hostname basis.
|}

See also: [https://panopticlick.eff.org/ EFF Panopticlick] and [http://samy.pl/evercookie evercookie].
For a more comprehensive guide on how to foil most fingerprinting mechanisms, see https://github.com/CrisBRM/user.js

== Web cache ==
Web caches mirror web requests locally for t time, thus ensuring a decrease in the number of servers hit, thereby somewhat reducing your privacy exposure and decreasing page load speeds.

=== [[File:Squid.png|48px]] Squid ===
Whilst modern browsers have their own cache implementations, they are often outdated, slow, and not very secure. [http://www.squid-cache.org/ Squid] is a modern, high performance web cache and proxy server that supports a plethora of protocols. It can be used in combination with any browser that supports proxies. Best used in conjunction with a DNS caching server like Unbound.

== DNS ==
DNS is what allows your computer to convert a domain name (such as wiki.installgentoo.com) into an IP address to connect to. That process is called resolving. 

When your computer attempts to resolve a domain name it queries a DNS server. Usually this will belong to your ISP if you have not configured it manually. Not all DNS servers are created equal—some block queries to certain websites, others hijack queries and redirect them elsewhere, and some log your queries. You should look for a DNS server that is close by (for minimum latency) that doesn't log your IP address. In addition, you may want to use DNSCrypt for added protection, and a caching DNS server for reduced privacy exposure and higher performance.

{{Warning|Google DNS and OpenDNS log queries. Google "anonymizes" query information after a period of time, but keeps associated ISP information permanently.[https://developers.google.com/speed/public-dns/faq#privacy] OpenDNS logs your IP address and may also correlate it with other information that is normally non-personally identifying.[https://www.opendns.com/privacy-policy] Avoid those two services.}}

=== [[File:Dnscrypt.png|48px]] [[DNSCrypt]] ===
''Main article: [[DNSCrypt]]''

End-to-end encryption for your DNS requests. This prevents any intermediaries (such as advertising or the FBI) from monitoring your DNS request. Ideally, it should be used with a caching DNS server like Unbound.

=== [[File:Unbound.png|48px]] [[Unbound]] ===
''Main article: [[Unbound]]''

[https://www.unbound.net/ Unbound] is a [https://www.unbound.net/documentation/howto_optimise.html high performance] validating, recursive, and caching DNS server with a multitude of privacy oriented features. The simple fact it acts as a DNS cache ensures less frequent connections to your DNS server. On top of that, it is able to enforce DNSSEC and use clever algorithms to harden your DNS queries.

=== [[File:Opennic.png|48px]] OpenNIC ===
The [https://opennicproject.org/ OpenNIC Project] is a privacy-minded collection of volunteer-run servers that also allow you to use extra TLDs such as .geek etc. Also features DNSCrypt support.

== Operating systems ==
While unfortunately, government organizations around the world have a variety of back doors into a variety of operating systems, one can still attempt to be anonymous through a variety of methods. Free software alternatives to [[Windows]] or [[OS X]] appear to be more secure than their counterparts, since their code is almost always individually reviewed.

===Tails===
[https://tails.boum.org/ Tails] is an OS specifically designed to preserve your privacy and anonymity. It forwards all your packets through the Tor network and uses anti-forensics like memory wiping to leave no trace on the computer you are using it on.  Tails mitigates layer 2 surveillance by randomizing MAC address on boot. Tails can be run in a VM, but this renders the OS less secure.

===Heads===
[https://heads.dyne.org/ Heads] is a Live OS relatively like tails based on Devuan. Like Tails, it sends your packages through the Tor network and leaves the no trace on the computer. Unlike Tails, though, it is fully libre, and uses Linux-libre. It also uses no systemd, and instead opts for OpenRC and SysV. Sadly (and also gladly), due to its freetard attitude it contains no proprietary drivers, making it run on a limited number of machines. It hasn't been updated for a long time though, so it's recommended to use Tails instead.

===[[File:WhonixLogo.png|48px]]Whonix===
[https://www.whonix.org/ Whonix] is a system of virtual machines, a client and server, each based on Debian GNU/Linux and configured with Tor which focuses on anonymity, privacy and security. The client VM is designed to route all traffic through the gateway/server VM which in turn routes it through Tor. This prevents the client VM from accidentally leaking your real public IP because it never knows it. All traffic is transparently routed through Tor preventing applications which are not designed for use with Tor from leaking.

== Sandboxes ==

=== [[File:Firejail2.png|48px]] Firejail ===

[[Firejail|Firejail]] is a [[Linux_(kernel)|Linux-only]] sandbox that uses Linux namespaces, seccomp-bpf and all the latest Linux security features to create a new, fully secure filesystem. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. It comes with a myriad of profiles by default, which are then used on a per-software basis.

Ignoring the security factor and focusing more on the anonymization potential, it is important to use sandboxes in order to minimise certain exploits in the software that could otherwise be used to identify you. For instance, in Firefox, Firejail limits its data leaks by replacing the standard temporary file directory with a more secure version, which is completely erased when the Firefox session ends.

== Tools ==
[https://mat.boum.org/ MAT] or Metadata Anonymization Toolkit, is a toolbox composed of a GUI application, a CLI application and a library, to anonymize/remove metadata.

[https://github.com/psal/anonymouth Anonymouth] is a tool designed to take your documents and change the wording so you can't be found through word choice, grammar, theme, tone, and etc. Here is an article on [https://archive.is/xNP9r anti-stylometry (the scientific study of literary style)] discussing it, and here is [https://archive.is/vZ2Cw another article]. While Anonymouth is audited and considered safe, [https://se7en.neocities.org/articles/anon-word-attack.html there are ways] that a [[non-free]] program that is ''like'' Anonymouth can harm you.

[http://www.privoxy.org/ Privoxy] Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks.

[https://www.caida.org/tools/taxonomy/anonymization.xml Anonymization Tools Taxonomy] A list of anonymization tools. Hasn't been updated since 2004.

== Routers ==
A router that supports free and open source firmware is recommended over one provided by your ISP. ISP routers often come preloaded with software that can compromise your privacy and security. There are many GNU/Linux based firmwares available for common routers:
* [https://openwrt.org/ OpenWrt]: An open source Linux distribution for embedded devices. It is optimized for minimal storage and RAM usage to fit on home routers;
* [https://librecmc.org/ LibreCmc]: The FSF's fork of OpenWrt with all non-free software removed;
* [https://dd-wrt.com/site/ DD-WRT]: A firmware focusing on the Linksys WRT54G series routers;
* [http://www.polarcloud.com/tomato Tomato]: Partially FOSS firmware released in 2008. It is still actively updated by community mods;
* [https://github.com/grugq/portal PORTAL]: An acronym for Personal Onion Router To Assure Liberty. It forces all internet traffic through the Tor network to limit the possibility of user mistakes.
For more detailed information see: [[Routers#Third party firmwares|Routers]]. You can also [[Routers#Use a computer as a router|use a computer as a router]].

== Android and cell phones==
{{warning|By their nature cellphones cannot be completely anonymous, but there are some steps that can be taken to at least limit your footprint. Be forewarned that the cellular network itself is ''designed'' to track you with only 30 seconds of delay, without a GPS chip.}}

Using an Android-based phone is a plus over iPhones or Windows Phone (if you can even call it that), but it is highly recommended that you [https://se7en-site.neocities.org/articles/cellphones.html avoid using cell phones all together]. Even better, use a dumb phone with no camera. If you absolutely think you '''need''' (not want) a cell phone, follow these tips:

=== Android replacements ===
* [[Android_ROMs|Custom ROMs]];

=== GNU/Linux Phones ===
* [https://puri.sm/products/librem-5/ Librem 5]: A security and privacy oriented phone by Purism that comes with the [[GNU/Linux]] distro PureOS preinstalled. Features kill switches and a removable battery, but it is quite pricey.
* [https://www.pine64.org/ PinePhone]: A cheaper GNU/Linux phone by Pine64 that has to be flashed with a distro by SD card. Comes with kill switches and a removable battery, but the hardware isn't too powerful compared to Android phones.

=== Alternative GApps ===
* [https://f-droid.org/ F-Droid]: Part of the Replicant project. An app store that only contains Free Open Source Software;
* [http://forum.xda-developers.com/showthread.php?t=1715375 NOGAPPS Project]: Replaces the Play Store, Google Maps API, Network Location API, and others in the future;
* [http://apps.evozi.com/apk-downloader/ APK Downloader];
* [https://f-droid.org/repository/browse/?fdid=net.osmand.plus OsmAnd~]: Replacement for Google Maps;
* [https://f-droid.org/repository/browse/?fdid=com.tobykurien.google_news GApps Browser];
* [https://archive.today/S3rMI Relevant thread] on google app store alternatives.

=== Removing ads ===
* [https://f-droid.org/repository/browse/?fdfilter=adaway&fdid=org.adaway AdAway] (Requires root): Hosts file based ad-blocking;
* [https://f-droid.org/repository/browse/?fdfilter=adblock&fdid=org.adblockplus.android Adblock Plus];
* [http://repo.xposed.info/module/tw.fatminmin.xposed.minminguard MinMinGuard] (Requires root and Xposed Framework): Disables the ad activity in apps to prevent the ad from loading. This also means there wont be a blank space where the ad was supposed to be.

=== Enforcing permissions ===
* [https://repo.xposed.info/module/eu.faircode.xlua XPrivacyLua] (EdXposed needed for Android 10);
* [https://repo.xposed.info/module/org.synergylabs.pmpandroid Protect My Privacy] (ditto);
* App Ops: Available since Android 4.3. Removed in 4.4.2, but still retained in custom ROMs. Allows you to tweak individual permissions on a per-app basis;
* Available by default on Android 6 (M).

=== Browsers ===
* [https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/ Fennec F-Droid]: A Firefox fork;
** [https://addons.mozilla.org/en-us/android/addon/ublock-origin/ uBlock Origin]: The only trustworthy adblocker;
** [https://addons.mozilla.org/en-US/android/addon/smart-https-revived/ Smart HTTPS]: Automatically enables HTTPS on websites that support it;
** [https://addons.mozilla.org/en-US/android/addon/self-destructing-cookies/ Self-Destructing Cookies];
** [https://addons.mozilla.org/en-US/android/addon/smart-referer Smart Referer]: Hides HTTP referer;
** [https://addons.mozilla.org/en-US/android/addon/canvasblocker/ CanvasBlocker]: Feeds fake data to websites using advanced fingerprinting techniques making use of APIs like audio, WebGL, canvas size and so on;
* [https://github.com/uazo/cromite/ Cromite]: A Bromite fork which still being maintained

== OPSEC/Operational Security ==
All the software in the world won't help you if ignore the human element. Obvious no-nos:
* Using the same username everywhere;
* Using the same email address everywhere;
* Logging into the same accounts through your real IP and a proxy/VPN/tor;
* Posting photos or images which can be traced back to you via a [https://tineye.com/ reverse] [https://images.google.com/ image] [https://yandex.ru/images search].
* Using the same MAC Address / Hostname on an untrusted network can identify you to local attackers/surveillance. Check out [http://hacktownpagdenbb.onion/Links/Chapter-3.html Computer MAC Addresses and their importance]{{dead link}}
[[Wikipedia:Dread_Pirate_Roberts_%28Silk_Road%29 |Dread Pirate Roberts]] was brought down by many of the above points.

More subtle no-nos:
* [[Wikipedia:Forensic_linguistics |Forensic Linguistics]] is the science of figuring out someone's identity by the words, phrases and grammar they use. Recommendation to counter this: [[Anonymizing_yourself#Tools|Anonymouth]];
* Using the same browser with your real IP as your proxy/VPN/Tor IP (see fingerprinting above);
* Discussing personal preferences, or knowledge of specific locations such as a school, shop or town;
* Being unprepared for a proxy/VPN/Tor to drop out.

Steve Rambam gave [https://www.youtube.com/watch?v=dNZrq2iK87k an excellent talk] at the HOPE hacker conference which summarizes many of the techniques that you/private investigators/LEA can use to determine someone's identity.

To err is human. As clever as you think you are, all it takes is one connection from your real IP address to deanonymize you. One day when you're distracted/tried/stressed/drunk/high/panicked/surprised or when something out of the ordinary is happening, you will mess up. Putting up many automated layers of anonymity/security will help protect you from yourself.

== External links ==
* http://browserspy.dk/
* https://www.howsmytls.com/
* https://www.dnsleaktest.com
* http://www.whatismyreferer.com/
* https://panopticlick.eff.org/
* https://securityinabox.org/en
* https://myshadow.org/
* https://ssd.eff.org/
* https://thetinhat.com/
* http://login2.me/
* http://bugmenot.com/
* https://alternativeto.net/software/bugmenot/
* https://alternativeto.net/software/fake-mail-generator/
* https://www.eff.org/issues/anonymity
* ('''Tor Link''') http://hacktownpagdenbb.onion/1.html {{dead link|OnionV2}}

== See also ==
* [[Cryptocurrency]]

[[Category:HowTo]]
[[Category:Software]]
[[Category:Anonymity networks‏‎]]