This could well have worked, I didn't protect against that.

I'm not sure how you embedded flash, can you explain? just <img>blah.swf</img> or what?

Do you see 85.17x.xxx.xxx in your logs?

thanks, theymos.

ok guys and girls, where to go from here?

It seems to me I'm pretty safe for now, right? Many possible flaws and improvements have been pointed out but none of them lead to you guys getting close to me.

That bitcointalk-posting-time-attack seems hard to pull off and will likely take weeks to deliver meaningful data.

I pretty much decided to "have the VPS compromised" at some point, but I think I should wait with that since it could be over pretty quickly after that and I must say I'm quite enjoying this and learning a lot.

So maybe I should try to do some more stuff that might endanger my anonymity to make it more interesting? Like pop up on irc and chat with you guys or something.

Open for any suggestions that don't involve me actually doing anything illegal.

Heres your chance to set up some trap

Awesome!

I could give you an address from joes wallet, but would prefer someone to do escrow for us.

Maybe he's open to helping you guys by releasing any info he has on joe23 (with my consent)?

So if you ask him and he's ok with it, I will give him my consent to publish anything he has on me in this thread.

Ah, good to know.

I think you also deserve some payment for your effort if you share an address. I hope I didn't miss anyone else? afaik I so far gave some monetary incentives to:

• MysteryMiner
• Jasinlee
• Openyoureyes

cool.

sent a little bit to you address as can be seen in this updated screenshot of joes wallet:
(I had to use the VPS proxy to upload it, imgur disallows tor)



OOOPS! I accidentally had electrums connection setup dialog open when I took the screenshot.

I think this could be a viable attack.

It would involve some serious page-scraping of bitcointalk. Assuming you guys do that and then have the posting times of all bitcointalk users you could compute a likelyhood of each user being "real me" using various heuristics. Especially over a long period of time, combined with my roughly known timezone info and maybe some manual language analysis in the end, this could potentially boil it down to maybe a handful of users that would then be suspects.

I would consider that to be a pretty dangerous development for my anonymity.

thanks, OpenYourEyes for chipping in. That's some valuable info.

Let me answer some of your questions:


I use

  #> ssh -D 0.0.0.0:55555 joe23@188.165.73.235 -o ProxyCommand="~/bin/connect -4 -S localhost:9050 %h %p"

to ssh to the VPS and at the same time setup the proxy, which I connect to using

  #> chromium-browser --proxy-server="socks5://localhost:55555"

I only use chrome through that VPS proxy for bitcointalk. All other browsing activity I do with firefox through tor (use localhost:9050 as proxy).

Very good point about the DNS leaks! Officials could probably evesdrop on the dns server and identify my IP through timing, right?

Would my idea of ensuring at my home router that the box can only go out through tor (drop all other pakets, is that even possible?) help against such "accidental" leaking? Any ideas on how to protect against such accidents in a fool-proof way?


I sure as hell wont enter my real IP in the VPS shell at any time. You sneaky guys might have compromised the machine already and are likely keylogging . I might look through the logs manually, though.


I use onion url http://jhiwjjlqpyawmpjx.onion to access tormail using firefox. As said before, I only use the VPS as proxy for bitcointalk.org because they disallow tor.


I might've said that wrong before. I don't tunnel all traffic through the VPS, just when I need to access sites that don't allow tor connections. Sorry about that misinformation, it was not intentional. I will not try to mislead you guys, at least not at this point, only when you're getting close


Problem is I need a non-tor exit point somewhere for bitcointalk.org. Any other ideas on how to post to bitcointalk?

OpenYourEyes, I'd like to reward your effort if you give me an address, I will.

Hey guys,

just got up (hint, hint). yawn.

You seem to have found some info on the VPS even I didn't know (couldn't care less where its located).

I think the basic concept is pretty sound: I'm using that VPS for everything: to host the page and as a proxy. I olny ever connected to it via tor (hopefully). So when the VPS is compromised, I should still be secure.

Things I've learned from you guys (and own thoughts) so far:

• reevaluate use of lastpass, it's a risk, lastpass inc. could be subpoenad or whatever into slipping me custom code or there already is a backdoor of sorts that could leak info, who knows
• isolate joe on the client system better (currently all I do is use a seperate user) and make sure the client can only connect through tor, maybe at the router or something. There's currently the chance that I might accidentally connect through the parent network and reveal my IP to the VPS. Maybe use a virtual machine. Protect it (or /home/joe at least) locally so your visitors or the people you live with don't accidentally find joe. Always unmount /home/joe, shutdown the Virtual Machine when leaving machine physically. Maybe put /home/joe or even a whole system on a usb stick or use an old laptop for joe so he's portable (some secure distro, suggestions?)
• Watch your language, always be very conscious who you are, don't post drunk, avoid using phrases/language the real me notoriously uses,...
• What MysteryMiner said: "The problem of staying hidden is not in the short term. In long run you get comfortable, relax on security, reuse the same address or e-mail or whatever [...]"

I'm upping the bounty to BTC 14 for now. I might lower it again at some point when I intentionally leak more info that'd make it easier.

sent some bitcents for your great effort so far.

Now for finding me through the blockchain: I cleaned the coins using SR. That means all inputs of transactions contributing positively to my balance are owned by SR.

I deposited a higher balance to SR from my private wallet than I withdrew to joes wallet to make same-amount-attacks a lot harder if not impossible. I waited between deposit and withdraw, making timing attacks harder, if not impossible. Safe?

sent you some.

lastpass of course I use not only for VPS, but also domain name service and tormail.

congratulations are in order. Welcome to our little club .

It sounds like you're a bit like me when it comes to trading: too emotional. So be careful, don't loose your coins! Just being long and staying long is a good option imo, and very easy to manage, too

MysteryMiner, I would like to give you a little token of appreciation for your great input. So if you want that, give me an address.

fuck wine . Does keepass help with filling login forms in the browser? If not, a text file is just as good, right?

Are there better alternatives to lastpass?

keepass seems to be windows-only .

I'm not currently doing this, but "for real", I would probably use an encrypted /home/joe folder anyway, so I could just put a text-file with the login pws there.

However: lastpass (or any other password store that has a browser addon) is very convenient.

What are the specific problems with using lastpass?

yes, you can ask questions. This is to simulate the case where I run some anonymous service but I still want to interface with people on bitcointalk, so I engage in discussion and will reveal bits of info.

To answer your question: no, I don't mine at all.

you're wrong.

please understand that I have to discourage people from guessing.

well, I'm not using a separate client machine for this. Merely a separate user on my day-to-day system. To be safer, it'd probably make sense to use a seperate machine and also block all non-tor traffic from that machine to make sure I don't accidentally go through public net.

One thing for example might be a problem: I use lastpass to manage joe23s identities and passwords for the services. I'm not entirely sure the lastpass addon follow my browsers proxy settings. Anyone know?

"you must provide a credible story of how you obtained the info"