Let's assume that the VPNs in the nested chains have been anonymously purchased through bitcoin, maybe using Anonabox. Let's also assume I have good OPSEC.

Now isn't this the ultimate setup guaranteeing 100% anonymity and untraceability, even against global adversaries?

  • Nothing is guaranteed. Your behaviour online while hidden and completely untraceable may match the behaviour of another person - coincidentally yourself elsewhere - and this may lead to an investigation or seizure. It has happened before... – Birb Sep 24 '19 at 21:08

Few holes.

Anon purchased VPNs help prevent your identity from being exposed when the VPN is raided. It doesn't shield the first VPN from knowing your IP address. So assuming you piss off the NSA, and they raid your VPN while your connected to the VPN, and the sysadmin doesn't hit the kill switch when they kick in the door, the NSA would be able to correlate your real IP address with your VPN account name of your first VPN. From there they could raid your ISP which are less privacy conscience than bitcoin VPNs. If your ISP keeps NSA logs, then the NSA would have a pretty good idea of when you were connected to your first VPN.

Now if your global Mr Robot NASDAQ hack started 5 minutes after you connected to your first VPN in the chain, and stopped 5 minutes before you disconnected from your first VPN, there would be pretty good circumstantial evidence for the FISA judge to go medieval on you.

To mitigate you should randomize which VPN is first in your VPN chain (you didn't mention if you did that or not). If you randomize which is first, you reduce the NSA agent and FISA judge from catching your global conspiracy by a factor of the number of VPNs in your chain. So if you have 10 VPNs in your chain or pool, then there is only a 10% chance that the agents raid the VPN your connected to when you do your Mr Robot work.

Your biggest vunerability will be on your laptop itself. Even with Whonix VMs you are exposed to hardware implant hacks, acoustic cryptanalysis, and other side-band attacks like Meltdown and Spectre. These are all theoretical and there is no proof that the NSA or GCHQ have deployed AC, Spectre, or Meltdown to deanonomize a Whonix instance or RSA keys from a host OS. In theory its possible giving an infinitely intelligent advisory with limitless funds and sole focus on taking down Mr. Piece0fshite@stackexchange.

Point is there is no 100% anonymous if your dealing with omnipotent opponents. But unless your planning to hack NASDAQ or something, Comcast + TOR + HTTPS will likely be all you will ever need.

  • But wouldn't the value of an NSA discovery of ISP be significantly mitigated by use of a Yagi-Uda antenna or cantenna that would allow one to use or hack into Wi-Fi connections hundreds of kilometers away from the actual address? If I'm using a long-distance Wi-Fi connection, then they would only be able to trace it back to the address in question's ISP, but not the real address which is hundreds of kilometers away. That would make one completely untraceable. Also there have been instances where groups with good OPSEC were able to successfully defeat global adversaries, such as Silk Road 3.0. – piece0fshite Dec 27 '18 at 10:30
  • Absolutely. mitigation of surveillance is a much better plan than 100% untraceable and anonymous. I wasn't trying to be pedantic, simply wanted to illustrate that it is impossible to get to 100% unless you remove power. Ultra-Fi directional antennas, yeah, thats great, and will definitely confound your adversary, but it's not 100%, just real damn close. Your still dealing with 100s of pounds of radio equipment that will make your van stand out like a sore thumb. Honestly most people who get busted usually fail in something simple like leaving prints on an antenna jacked into a starbucks. – Dan Dec 27 '18 at 10:59

Your Answer

