Robert - 6/8/24

Why anonymity isn’t enough for sensitive use

In this post we are going to see why anonymity is not enough for sensitive use, and what can be done about it.

Why anonymity is not enough for sensitive use

Let’s say Charlie is a whistleblower leaking information about widespread corruption via a popular online forum. To stay anonymous, he makes sure to connect to the site only through Tor and VPN, and uses a burner email address to sign up.

In the foreword to his first leak, he uses one of his favorite personal phrases. To his misfortune, his real-name X account is the only one to ever publicly use that phrase before.

The government connects the dots and uses its key disclosure legislation to issue a search warrant for the X user’s hard drives.

Thankfully, Charlie needn’t worry: he has set up VeraCrypt’s deniable encryption to separate his personal life from his leaks. He gives the authorities the key to the main volume; they find nothing related to the leaks. The leaker’s use of that particular phrase is deemed a mere coincidence.