[liberationtech] Outed via 'anonymous' email address.... Re: Anonymous blogger outed by analytics signature

[Frank Corrigan]

I recently set up an 'anonymous' email address on aol.com - I naively
set up an alternative email address with a domain name that can be
traced back to be me. Not a problem you might say, but those who have
the email address can just go to:

    mail.aol.com

type in the address [xxxxxxxx at aol.com ] press the 'forgot password'
section and get presented with a masked version of the backup email
addresses domain name, though I did not use [xxxx at franciscorrigan.com]
but could have...

Though at least with aol there is no need to provide a back up email
with registering.

Frak


----- Original message -----
From: "G." <griffinboyce at gmail.com>
To: "Graham Webster" <g at gwbstr.com>
Cc: "liberationtech List" <liberationtech at lists.stanford.edu>
Date: Wed, 16 Nov 2011 13:24:10 -0500
Subject: Re: [liberationtech] Anonymous blogger outed by analytics
signature

Hi all,

  Yes, this is something one has to keep an eye on when *publishing*
  while
maintaining your anonymity online.  Any overlap in identity can give you
away if you are an anonymous blogger.  This is the same as using a User
ID
across multiple sites you own.  A better option than using One analytics
account (company is irrelevant) is to simply create a different account
for
each site.

  Adsense has the same disadvantage.  If you run ads, switch over to
  using
something like Project Wonderful that allows you to have multiple
accounts.
 Or, run ads yourself and accept payment with WePay.  Or have merch, or
accept donations. Or forego advertising altogether.

  What you do to protect yourself as an anonymous blogger really depends
  on
who you're trying to conceal your identity from.  If you're trying to
keep
your identity from the US government, you'll have to go through a lot
more
trouble than if you're just trying to keep your employer from finding
out.

  If you want to be truly anonymous, you need to have no overlap in
accounts (hosting, analytics, etc) at a minimum.  I'd like to see more
discussion about this issue, since it affects so many people.

Best,
Griffin


On Wed, Nov 16, 2011 at 11:34 AM, Graham Webster <g at gwbstr.com> wrote:

> Hi Libtech,
>
> Thought it would be worth pointing out this article that reports it's
> possible in some cases to determine who runs a site because of shared
> analytics signatures. The writer notes that this risk isn't found in guides
> to anonymous blogging he consulted.
>
> http://www.wired.com/epicenter/2011/11/goog-analytics-anony-bloggers/all/1
>
> Graham
>
>
> --
> Graham Webster
> g at gwbstr.com
> web gwbstr.com
> twitter @gwbstr
>


-- 
"I believe that usability is a security concern; systems that do
not pay close attention to the human interaction factors involved
risk failing to provide security by failing to attract users."
~Len Sassaman

PGP Key etc: https://www.noisebridge.net/wiki/User:Fontaine

_______________________________________________
liberationtech mailing list
liberationtech at lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click "yes" (once you click
above) next to "would you like to receive list mail batched in a daily
digest?"

You will need the user name and password you receive from the list
moderator in monthly reminders.

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech