Anonymity methods on the net. Part 2

[DronVR]

Anonymity methods on the net. Part 2

Cookies
Cookies are text files with any values stored by the application (often the browser) for various tasks, for example, authentication.

If you completely disable the acceptance of cookies, then some sites may experience authorization problems, but Firefox allows you to accept cookies and clear them after it is closed. The option “Accept cookies from third-party sites” is also desirable to disable, however, for example, logging in to Habr with disabled 3rd party cookies, we will not get access to habrastorage.org, so I prefer to accept cookies from the sites visited.

Moreover, Firefox allows you to maintain a white and black list of sites with cookies.

If we want privacy, then when you close Firefox, you need to clear everything. Yes, it’s not very convenient, but there are no traces left.

Pay attention to the “Flash Cookies” checkbox, this is not the default Firefox checkmark, we will talk about it a little later when we touch the LSO or Flash cookies.

Here, in the settings, special attention should be paid to clearing the browser cache. In the article: "[DLMURL =" https://anonym.to?https://habrahabr.ru/post/190488/ "] Cookie without cookies [/ DLMURL]", the need to clear the cache is justified.

On the Firefox: about: config settings page, there is a parameter: browser.cache.disk.enable responsible for using the disk cache. A value of false means that the cache will not be used at all. For the rest of the settings browser.cache.disk do not bother, after disabling the cache they are no longer important.

A convenient and free program, [DLMURL="https://anonym.to?https://www.piriform.com/ccleaner"] Ccleaner [/ DLMURL], will help you clean up all the already accumulated traces of Internet activity stored even in the farthest corners of the hard drive.



Java, Flash, Adobe Reader ...


All of these plugins are separate applications that run on behalf of the user. They can bypass the proxy settings, store their separate long-lived cookies (Flash - Local Shared Objects), etc.

All plugins should ideally be disabled or removed. Without Java and Adobe Reader, it’s quite possible to live in a browser, but there are situations when Flash still has to be enabled, otherwise the site simply won’t work. In this case, you need to ensure regular updates to Flash and the prohibition of storing Local Shared Objects (LSO) or Flash cookies.

It is also recommended that you enable Flash only on request. So you allow to run exactly the Flash element that you really want. You can do this in the settings of plugins (add-ons).

To prohibit LSO storage, a Firefox add-on is specially designed, [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/betterprivacy/"] Better privacy [/ DLMURL]. I prefer that the checkmark for clearing the LSO be added to the Firefox “Clear History” menu, as in the previous figure.

Browser fingerprint

The browser provides the server with dozens of categories of data, including the so-called [DLMURL="https://anonym.to?https://en.wikipedia.org/wiki/User_agent"] user agent [/ DLMURL]. All this can form a rather unique “digital fingerprint of the browser”, by which it can be found among many others already in an anonymous session.

There are many additions to changing the browser user agent, I'm used to using [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/user-agent-overrider/"] User Agent Overrider [/ DLMURL]. The add-on is stable, convenient, constantly updated, is in the official Firefox repositories.

Javascript Scripts


Client-side Javascripts can collect many categories of identifying data for a server. Moreover, if the visited site is subject to [DLMURL="https://anonym.to?https://en.wikipedia.org/wiki/Cross-site_scripting"] XSS [/ DLMURL], then the Javascript scripts included on it will help the attacker conduct a successful attack with all the ensuing consequences.
In order to prohibit these scripts, the addition [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/noscript/"] is best suited NoScript [/ DLMURL].

In addition to Javascript, the add-on can block many more different elements: Java, Flash, etc. The user can temporarily allow all active content to run on the page or do it on an ongoing basis.

In the same section, I will describe another addon that goes side-by-side with NoScript: [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/requestpolicy/ "] RequestPolicy [/ DLMURL].

The RequestPolicy addon is needed to control cross-site requests and protect against [DLMURL="https://anonym.to?https://en.wikipedia.org/wiki/Cross-site_request_forgery"] CSRF [/ DLMURL]. Cross-site requests are made when you go to one site, he has already requested from another site the desired resource, for example, a picture, and showed it to you. Similar mechanisms are most often used for advertising purposes. I note that in this way malicious sites can do very bad things, for example, under certain conditions, perform unauthorized actions on the third site with your saved cookies. Imagine what this could threaten.

The author of RequestPolicy recommends using it in conjunction with NoScript, as each add-on is tailored for its own purposes, and together they provide flexible and comprehensive protection. In the picture, RequestPolicy blocks the picture from habrastorage.org.

It is worth noting that some sites do not like blocking Javascript and cross-site requests at all. Some time must pass in the "training" mode to form a trusted list of regularly visited resources. What to do, safety and convenience have always stood on different scales.



Web bugs


Web Bugs are invisible details of web pages used to monitor site visits; they are also able to send different client information to the server.

There are two main additions to blocking web bugs: [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/ghostery/"] Ghostery [/ DLMURL] and [DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/donottrackplus/"] DoNotTrackMe [/ DLMURL].

The principle is similar for them, when I compared them, I stopped on my subjective feelings on Ghostery, and I will describe it. It is important to note that during default configuration Ghostery does not block all bugs and trackers, it must be done manually in its settings at the local address: resource: //firefox-at-ghostery-dot-com/ghostery/data/options.html.

When you visit a site where there are similar elements, Ghostery will block them and issue the following notification.

Over time, you will notice that Ghostery and RequestPolicy intersect in blocking some elements, for example, Google Analytics, Yandex.Metrics, etc.



HTTP referer


An HTTP referer is an http header with which a website can determine where traffic is coming from. If you clicked on the link that http-referer passes, then the site to which the link leads will be able to find out which site you went to from.

Firefox has an interesting setting in about: config: network.http.sendRefererHeader . This clause determines in which cases an HTTP referer will be sent. There are three options:

• 0 - never send an HTTP referer
• 1 - send only by clicked links
• 2 - send for links and pictures (by default)

Let's do an experiment. There is a site: www.whatismyreferer.com whose purpose is to show our HTTP referer.

Use the default value. network.http.sendRefererHeader = 2 .

Click on the link: www.whatismyreferer.com , we see our referrer highlighted in red (in your case it will be slightly different):

Let's do the same: www.whatismyreferer.com but with network.http.sendRefererHeader = 0 . Oops!

Bet network.http.sendRefererHeader = 0 , and the referrer will not be transmitted.

There’s another similar parameter in the settings, network.http.sendSecureXSiteReferrer , he is responsible for transferring the referrer between two https sites. However, do not bother, it does not work after disabling the previous setting.

By the way, everyone heard about the search engine Duckucko go ? That he did not send referrers, I was sure. But left-clicking on the first link (after advertising) in its search results for: duckduckgo.com/?q=www.whatismyreferer.com with installed network.http.sendRefererHeader = 2 I saw the following:

If you click the middle mouse button (open a new tab), then everything is OK, the referrer does not really appear.

be careful : referrers are used in the work of many Internet resources, their disconnection can lead to the most unexpected consequences, for example, after disconnecting the referrer I was not allowed to log in to TM ID.

Other

It will be completely superfluous to send any service information to Mozilla.

For the sake of anonymity, I would advise you not to store passwords at all, although Firefox has the ability to use a master password with which all other passwords are encrypted, so you can’t remove them in clear text.

[DLMURL="https://anonym.to?https://www.eff.org/https-everywhere"] HTTPS Everywhere [/ DLMURL]

This add-on is needed in order to force use only the https connection for sites that support this.

[DLMURL="https://anonym.to?https://addons.mozilla.org/en/firefox/addon/adblock-plus/"] Adblock plus [/ DLMURL]

Not so much safe as just useful. Adblock Plus is needed to block all possible advertising while it has a regularly updated list of filters. I note that in the settings there is a checkmark: "Allow some unobtrusive advertising", which can be removed if desired.

The last tip for those who actively use SOCKS when surfing the web. Customization network.proxy.socks_remote_dns determines where DNS queries will be executed when using SOCKS5. A value of “true” sets that they will be executed through a SOCKS proxy, and not on the client itself. This will protect us from [DLMURL="https://anonym.to?https://www.dnsleaktest.com/what-is-a-dns-leak.php"] DNS-leaks [/ DLMURL].

You can read more about each setting from about: config Firefox [DLMURL="https://anonym.to?https://kb.mozillazine.org/About:config_entries"] here [/ DLMURL]. And according to [DLMURL="https://anonym.to?https://forum.mozilla-russia.org/viewtopic.php?id=36226"] this link [/ DLMURL] some of them are painted in Russian.

Tor over VPN. VPN first, then Tor

The VPN server with this scheme is a permanent input node, after which encrypted traffic is sent to the Tor network already. In practice, the scheme is implemented simply: first, a connection is made to the VPN server, then a Tor browser is launched, which will automatically configure the necessary routing through the VPN tunnel.

Using such a scheme allows you to hide the fact of using Tor from our Internet provider. We will also be closed from the input node of the Torah, which will see the address of the VPN server. And in the case of theoretical compromise of Tor, the VPN boundary will protect us, which, of course, does not store any logs.

Using a proxy server instead of a VPN is meaningless: without the encryption provided by the VPN, we will not get any significant advantages in such a scheme.



It is worth noting that, specifically to circumvent the Tor ban, Internet providers have come up with the so-called bridges.

Bridges are nodes of the Tor network that are not listed in the central Tor directory, that is, they are not visible, for example, [DLMURL="https://anonym.to?https://bridges.torproject.org/https://194.109 .206.212 / tor / status-vote / current / consensus / "] here [/ DLMURL] or [DLMURL =" https://anonym.to?https://bridges.torproject.org/https://atlas.torproject .org / "] here [/ DLMURL], and therefore more difficult to detect.

How to configure bridges, it is written in detail [DLMURL="https://anonym.to?https://bridges.torproject.org/https://www.torproject.org/docs/bridges.html.en"] here [/ DLMURL].

Several bridges can be given to us by the Tor site itself at [DLMURL="https://anonym.to?https://bridges.torproject.org/"] address [/ DLMURL].

You can also get bridge addresses by mail by sending to bridges@torproject.org or bridges@bridges.torproject.org letter with the text: "get bridges". Be sure to send this email from gmail.com or yahoo.com

In response, we will receive a letter with their addresses:

" Here are your bridge relays:

bridge 60.16.182.53:9001

bridge 87.237.118.139-00-0044

bridge 60.63.97.221-00-0043 "

These addresses will need to be specified in the settings of Vidalia - Tor proxy server.

Sometimes it happens that the bridges are blocked. To circumvent this, Tor has introduced the so-called “obfuscated bridges”. Without going into details, they are more difficult to detect. To connect to them, you must, for example, download, [DLMURL="https://anonym.to?https://www.torproject.org/docs/pluggable-transports.html.en#download"] Pluggable Transports Tor Browser Bundle [/ DLMURL].



pros schemes:

• we will hide the fact of using Tor from the ISP (or connect to Tor if the provider blocks it). However, there are special bridges for this;
• hide your IP address from the Tor input node, replacing it with the VPN server address, however this is not the most effective increase in anonymity;
• in the case of theoretical compromise of Tor, we will remain behind the VPN server.

Minuses schemes:

• we must trust the VPN server in the absence of any significant advantages of this approach.

VPN through Tor. Tor first, then VPN


In this case, the VPN server is a permanent output node to the Internet.

A similar connection scheme can be used to bypass the blocking of Tor nodes by external resources, plus it should protect our traffic from listening on the output Tor node.

There are many technical difficulties in establishing such a connection, for example, do you remember that the Tor chain is updated every 10 minutes or that Tor does not pass UDP? The most viable option for practical implementation is the use of two virtual machines (more on this below).

It is also important to note that any output node can easily allocate the client in the general flow, since most users go to different resources, and when using this scheme, the client always goes to the same VPN server.

Naturally, the use of conventional proxy servers after Tor does not make much sense, since traffic to the proxy is not encrypted.

pros schemes:

• protection against listening to traffic on the Tor output node, however Tor developers themselves recommend using encryption at the application level, for example, https;
• Protection against blocking Tor addresses by external resources.

Minuses schemes:

• complex implementation of the scheme;
• we must trust the exit VPN server.

Whonix concept

There are many OS distributions whose main purpose is to ensure the anonymity and protection of the client on the Internet, for example, [DLMURL="https://anonym.to?https://tails.boum.org/"] Tails [/ DLMURL] and [ DLMURL="https://anonym.to?https://dee.su/liberte"] Liberte [/ DLMURL] and others. However, the most technological, constantly evolving and effective solution that implements the most advanced techniques for ensuring security and anonymity is the OS distribution [DLMURL="https://anonym.to?https://sourceforge.net/p/whonix/wiki/Home / # whonix-homepage "] Whonix [/ DLMURL].

The distribution consists of two Debian virtual machines on VirtualBox, one of which is a gateway that sends all traffic to the Tor network, and the other is an isolated workstation that connects only to the gateway. Whonix implements the mechanism of the so-called isolating proxy server. There is also an option for the physical separation of the gateway and workstation.

Since the workstation does not know its external IP address on the Internet, this allows you to neutralize many vulnerabilities, for example, if malware gets root access to the workstation, it will not be able to find out the real IP address. Here is a diagram of Whonix, taken from its official website.

Friendship between Tor and VPN is controversial. Disputes on the forums on this topic do not subside.

DEEPWEB Channel Article