Original subtitles

as a matter of fact you know being in

the U.S makes it uh somewhat more

challenging to be too anonymous because

we have the NSA who has uh who has their

fingers into every transaction so all

you NSA people out there who are

watching this video we know we know we

know what you're doing and

um so that was episode one that's an

important lesson Elliot says whoever

controls the final hop on the network

controls the traffic the onion reading

protocol it's not as Anonymous as you

think it is whoever's in control of the

exit nodes is also in control of the

traffic which makes me

the one in control and that's the same

thing that the NSA knows is that they

know whoever controls the final hop

controls the network

you know from my experience of dealing

with all of these these young people

that's that's like their ultimate goal

is to be able to hack their neighbor's

Wi-Fi yeah that that's that's why they

all want those Wi-Fi they want to get

the white they want to get the Wi-Fi of

the neighbors and they think also that

maybe we should throw this in here is

that they think that if they use the

neighbor's IP address that they're safe

so joking aside because obviously we

don't recommend that would using your

neighbor's Wi-Fi actually keep you safe

you know a lot of people believe that if

they use their neighbor's Wi-Fi that

they're going to be safe because the IP

address is going to be show that the

neighbor was on that website many years

ago I was working with an investigator

for I think it was with the Navy at the

time he was uh what they call the naval

criminal investigation unit and he and I

were talking he said to me that doesn't

work and I said why not he says because

whenever there's a crime committed the

first it is clear that the people whose

whole Wi-Fi did not commit the crime the

first thing we do is we start knocking

on the doors of everybody within a few

houses and a hundred percent of the time

a hundred percent that is what he said

I'm not saying this he said he said a

hundred percent of the time we will find

the person who committed the crime

within a few houses all right so he says

I said 100 of the time it was yes a

hundred percent of the time even though

it's possible to be able to pick up

Wi-Fi in some circumstances with special

yagi antennas and what have you you can

pick up Wi-Fi for or two right but

hackers because they're people who think

that they can get away with a crime by

using their neighbors they almost always

get caught because they are using the

next door neighbors or the person two or

three houses down and then law

enforcement just has to go knocking on

doors and asking questions I was

surprised when he told me that he said

100 of the time and so since that this

is over 10 years yeah I've I've kind of

checked the cases and he's right 100 of

the time the person is is right next

door or right behind the house or in the

same apartment building hey everyone

it's David Bumble back with occupy the

web it's been too long since our last

interview so glad to have him back okay

by the web welcome thanks David it's

always good to be back on the best I.T

cyber security Channel on YouTube that's

very kind of you to say that if you

don't know who occupy the web is have a

look at our previous videos which I've

linked below he's also the author of

this book Linux basics for hackers

fantastic book if you want to learn

Linux from a hacker's point of view he's

also recently published this book

Network basics for hackers what I love

about his books is he takes subjects

like networking Wi-Fi whichever subject

you're interested in like Linux and he

teaches it from a hacker's point of view

he's also got this book getting started

becoming a master hacker really great to

have you back occupy the web what are we

talking about today because this is a

really good topic I think well today's

topic is how to remain anonymous on the

internet this is a subject matter that

is near and dear to my heart I've just

got to interrupt you before because I

want to say this for everyone who asks

because I get this a lot I don't know

who occupy the web actually is because

you're anonymous to me as well I don't

know your name I don't know where you

live I kind of believe that you live in

the US

um but I know almost nothing about you

so you've done a really good job of

being anonymous so I think you're the

right person to talk about this ah

thanks uh yeah I am in the US so we can

you can tell my American accent I'm in

the U.S as a matter of fact you know

being in the US makes it uh somewhat

more challenging to be uh to anonymous

because we have the NSA who has uh who

has their fingers into every transaction

every packet that traverses the internet

through the US they don't necessarily

have that around the world they try to

have that around the world but they

definitely have it in the US so all you

NSA people out there who are watching

this video we know we know we know what

you're doing and we know that you're

looking at every packet and they know

exactly who everybody is and the NSA

folks they have made it really clear to

me that they know who I am they have

actually you know they accept me

messages saying we know who you are and

they do that on purpose because the NSA

they kind of see the internet as their

territory and they want to know

everybody who's in their territory so

trying to stay Anonymous from the NSA

is really really hard if you're in the

U.S it's not as hard in your other

countries but in the U.S it's really

hard because they basically have Taps

into all the pipelines of all the

traffic in the U.S and they capture

every packet and can examine it if they

want to know who you are and they can

find out so but if you're in other

countries it's a little bit easier to

stay Anonymous from the NSA and the

other intelligence agencies but it's

really hard to stay Anonymous from your

own countries intelligence agencies

because all of them have Taps into the

local internet so let's let's say this

right up front Okay that is really hard

to stay Anonymous from your own

countries intelligence agencies I also

want to point out that if you become a

target from these intelligence agencies

it's really really hard to remain

anonymous because they have tools that

make it really really difficult to stay

Anonymous uh David you and I are going

to do a show on Pegasus yeah Pegasus is

this notorious cell phone hacking

software put out by NOS I mean NSO the

um Israeli hacking group and with NS

with Pegasus they can basically just

Target your phone and take over your

phone and then of course you're not

Anonymous every message that you send on

your phone all your geolocation Services

every message you send becomes captured

by the intelligence agency so that's a

whole different bailiwick of trying to

remain anonymous from those guys because

they have capabilities and they have

legal sanction to do things that nobody

else does if you're talking offline

there's different levels right so you've

got like the commercial companies is

that right and then it like the NSA is

like right at the extreme NSA is the

extreme in the United States because

literally they're given access to to all

the pipes and they can see all the

traffic and they can trace but they

don't have that necessary that access in

other countries some countries they do

but in U.S they've been given Total

Access to all the pipes and so they they

collect all of the data they have this

big data Farm where they put all the

data in there and they can basically

Trace just about they can trace anybody

and they get metadata off all of the

packets and all the traffic if they if

you become a Target then they can do

even more and get more information about

you so I mean some people might be

disappointed about what you said because

it's like how do I stay invisible how do

I stay you know Anonymous is can I stay

Anonymous from Google can I stay

Anonymous from from anyone or as soon as

I go on the internet I'm not going to be

discovered well if you're trying to stay

Anonymous from the commercial interest

that's relatively easy and we can talk

about that the other thing that I find

with a lot of people is that they

believe that the only way to trace them

is through through their IP address so

this is fixation on on being able to

hide their IP address there's other ways

of tracing your identity other than your

IP address so if all you're focused on

is hiding your IP address you're going

to be exposed by both the commercial

interests and you know the the law

enforcement and intelligence agencies so

you have to think about all of the

different ways that somebody can trace

you and that's why one of the things

that I emphasize is that if you want to

remain anonymous and safe you need to

understand forensics you need to

understand OSN so if you understand both

of those fields and you understand then

what people can do to find you and find

your information then the better off you

are in being able to hide your identity

and your traffic are you saying that

that vpns are like all these VPN adverts

are wrong you know if I get a VPN I'm

safe

let's start off by saying one okay that

you're only as safe as the VPN is safe

right so the VPN is going to hide your

IP address right that's what I was my

point I was trying to make earlier is

that there's obsession with the IP

address but the whole business has been

built on this whole industry so I'm just

I'm just being sarcastic yeah and we're

gonna blow it apart right because yes

it's a it's a good it's a good measure

vpns are a good measure proxies are good

measures Tor are good measures but there

are ways of tracing you other than just

the IP all of those okay are going to

hide your IP address but there's other

ways of tracing you other than just your

IP address one of the things you have to

keep in mind when trying to remain

anonymous is that you you can only put

up you know you can put up hurdles all

right but it's almost impossible if an

intelligence agency wants to find you

that they do if law enforcement is going

to try to find you they have resources

but they have to spend a lot of

resources if you're good they have to

spend a lot of resources to find you now

in general you know most people who are

navigating the internet are not thinking

about anonymity and basically they're

giving away all of their information

about their entire life to commercial

interests like Facebook or Google and

others I don't know I'm not comfortable

with that maybe you are but yeah and so

one of the things you have to keep in

mind is that if you're using Chrome

which is a great browser by the way

Google Google makes a really good

browser and I really love Chrome but

it's constantly sending back all your

personal information back to Google

Headquarters if you if you ever using

Chrome open up say Wireshark while

you're using Chrome and what you'll see

when you're using Wireshark is that

Chrome home is constantly communicating

back to Google Headquarters everything

that you're doing they're constantly

sending back information on you so when

you get an ad then you go cash that's

amazing I was just thinking about buying

that how did that pop up on my screen

well that's no mystery because you know

they not only are they sending back

information about you but remember we're

living in the era of artificial

intelligence and artificial intelligence

is not only looking at what you're

searching for but they're trying to

create a mind map of you so what they're

doing is that they're saying the person

who is doing these types of searches is

likely the next thing they're going to

want is this because that's the pattern

that we understand from looking at

billions of people in the world that

with these characteristics they're going

to want this and they can actually

anticipate your need leads and send you

an ad for it so if you want to stay

Anonymous from those people that's a

little bit easier to do now one of the

things is first off just don't use

Google Chrome

because Google Chrome is is owned by

Google right and it's communicating Bing

is communicating to Microsoft even

Mozilla is communicating back it's most

of those a little safer than the others

but still you know they're they're

communicating back what you're searching

for on the web there's a relatively new

browser called Brave right that um yeah

you use it I use it that is a is more

Anonymous than the others so that's one

of my first recommendations is get away

from using Chrome and Bing and when you

say you mean you mean one of the new

browsers Edge right Edge I'm sorry being

the search engine yeah Bing is their

search engine edges so yeah those those

products are designed to capture

information about you and then once

somebody captures information about you

it's pretty easy for them to be able to

to determine who you are there's other

things that can also be captured like

for instance there's a whenever you

visit a website you know you're

presenting these cookies that are in

your browser right so if there's any

cookies in your browser they are going

to appear and that cookie is has

identifying information at least if it's

a cookie that has been placed there by

Google or Facebook okay and those both

those companies put cookies in your

browser then it's going to identify who

you are all right so one of the things

you can do with your browser is go to

the settings and turn off no cookies now

that's going to make your life a little

bit less convenient because that means

you're going to have to log into every

website and nobody's going to know who

you are when you go when you log into

your Facebook account they're not going

to automatically know who you are and

log you in or other services so it makes

life a little more difficult but it's

going to save your identity you would

use like recommend using private browser

windows stuff like that right private

browser windows and just turning off the

no cookings okay on any browser that you

use it's going to come in different

places it's usually going to be in

settings security and you can go ahead

and and click on no cookies cookies are

a lot of information for those who

aren't familiar with cookies cookies

basically a text file that has

information about who you are and what

your interests are it may actually

include

um things like uh your your username and

password this is it as you Traverse the

internet these cookies can be presented

to other people other websites so people

are focused on IP addresses but remember

for somebody to identify You by IP

address us they actually would have to

get into the ISP or the VPN to get their

records their log files to identify you

IP addresses are something to be

concerned about but these other issues

are equally important in terms of trying

to maintain your anonymity on the

internet one of the things that I'd like

to show you here let's go into Kali and

talking about IP addresses one of the

things that is available to us in Cali

and other places is what's called proxy

chains so proxy chains is a tool that

uses multiple you can use a single proxy

or multiple proxies okay to be able to

hide your IP address so let's go just

hiding your IP address we're going ahead

let's open up a terminal in I've got

some let's open up a new one here

there's a tool in Cali that allows you

to use proxies it's called proxy genes

so you can just go proxy changes built

into

um Cali and others not just not just uh

Cali but now there's parrot and Arch

Linux and a number of others have proxy

chains built into it as well the key to

using proxy chains is simply to set up

the configuration file in Linux you know

every configuration file is simply a

text file all you have to do is go into

the text file to be able to edit it so

let's go and look at the proxy chains

configuration file let's see it's I'm

going to use that I

mouse pad which is built into Cali it's

a GUI bass person's Bim and we're gonna

go is that Etsy proxy but I remember

where is that

proxychains.com nope it's not there

we'll close this yeah okay let's go to

CD Etsy and we'll go to etsy's where

most of the configuration files are in

Linux and you go up to you'll see up

here proxy chains four that's what I had

wrong it's four so we're gonna go up

Arrow here let me clear my screen all

right so then we're gonna go mouse pad

proxy chains four and then look at that

all right all right here we go this is

the configuration file for proxy chains

what proxy chains will do is it'll allow

you to select proxies that will then

take your traffic and move it through a

proxy hiding your IP and you can even

send it through multiple procs as you

can see here there's all of this up here

is basically comments describing what

they do the option below identifies how

proxy this is treated you can have a

dynamic chain where each connection will

be done via chain proxies a strict chain

okay which is what I have uncomment and

so we'll just use a strict chain

initially there's a round robin chain

each connection will be done via chain

proxies at the chain length which is a

variable you can set the chain length

there's a random chain each connection

will be done via a random proxy all

right here's a chain length by default

it's set to three and if we scroll down

a little further we'll see there's a

number of other variables here here's

the proxy list format it's going to look

like this sucks five and then the port

number and if there's a username and

password okay HTTP these are all local

IP addresses so you know that really

those are ones that you want to use all

right what what I've done and usually

it's set by default within the Cali in

this proxy chains is using the sox5 and

then using

127001 your local host on 90 50. this is

tor as you know Tor is the special and

separate network of routers okay that

encrypts your traffic from Hop to hop to

hop Tor was originally developed by the

U.S Navy so that they could go ahead and

navigate anonymously it's now an open

source project we do know that there are

some issues with Tor where it's not

totally Anonymous

institutions and intelligence agencies

like the NSA can still crack Tor but

it's still pretty effective for what we

want to do here so let's go ahead and

try it out just using Tor as a our proxy

chain you can go ahead once you you set

those major settings go ahead and save

and then close it and now what you need

to do is to go ahead and start Tour

alright so you can go pseudo system

control start core or enable tour so

tour should be running now on your

system then let's go to proxy chains you

can use use a sudo because uh Mozilla

doesn't like it and then just go Mozilla

and now what this says is it runs proxy

chains and then runs Mozilla Firefox I

guess it's actually Firefox is the

Mozilla is the name of the Project's

Firefox is what it is and there we go so

what you've done now is you've started

um Firefox my browser but going through

tool Network right right it's I'm

running my Mozilla Firefox simulator to

our Network you can see it in the

background here let's kind of see if we

can get both of those online yeah all

right you can see it's running through a

strict chain it tells us right here

chain which means that it's only it's

it's going to go through all of the

proxies that you've listed in our case

we've only listed one we've listed the

Torah Network and then let's go and

let's go to uh hackers arise I hear it's

a good website I hear this too yeah lots

of good information there that's right

so you can see that it's going through

and uh and it's anonymizing my traffic

coming through the the Torah Network so

we could use both there is a separate

Mozilla perhaps a Mozilla a Tor Browser

or we can use the uh Mozilla built in to

Cali and just send it through the Torah

Network let's check our IP on this okay

let's go what's my IP

yeah you live in Amsterdam now right

Amsterdam okay Amsterdam is where it's

at that's my location let's go and uh

and refresh again and see if we can get

a different tour router and this one's

still the same same IP okay

sometimes you can go ahead and just

refresh it and it'll jump to another IP

let's see if we can get another IP out

of it you can see how slow it is this is

one of the drawbacks to use in tor

some of the commercial

proxies will run a lot faster I think

I've told the story before that when I

was doing some work in Washington DC I

was doing a training of FBI at the uh a

few years back and I thought it'd be

funny that when everybody was out at

lunch that I was going to go ahead and

this was when the Silk Road was still up

and running I said I had the Silk Road

up on the screen as they walked in from

lunch and had all the drugs all the

drugs for sale so so they came back from

lunch and I had the Silk Road up on the

screen you can tell us it's been a while

because the Silk Road's been down for a

while but of course there's other other

sites now that do the same thing on the

dark web and I said okay you guys what

are you gonna do about this and they

said that's not our problem that's drug

enforcements had interestingly if you

know the story that it actually was the

FBI then who took down the Silk Road

even though their response to me he was

no that's not our job that's that's drug

enforcement and didn't you say something

along the lines that it was it was

actually very fussed because it looked

like you were using one of the local

nodes or something exactly so I did tell

the story here before yeah so I'm I'm

I'm in Washington DC and I'm like gosh

you know it's so much faster in

Washington DC and that was before I knew

that the NSA had nodes all around the

Washington DC so that it was running

just as fast as my regular internet

would in DC because they've got no

distributed all over DC to make sure

that they can see all the traffic

interestingly if you've watched the Mr

Robot Series in the very first episode

Elliott is able to he goes into a coffee

shop and it's like Dan's coffee shop or

something like that and it turns out

that Dan is actually running a

server from his coffee shop and uh and

Elliot discovers this and confronts him

with this information and he's like how

do you know that you know how could you

he said well because your internet is so

fast that I was counting you to use your

internet and then I began to wonder why

is it so fast and so and he put up a a

node on the Tor Network and was able to

see the traffic going to his server and

then got into the server and saw that

was all

um so that was episode one and that's an

important lesson and Elliot says whoever

controls the final hop on the network

controls the traffic the onion rooting

protocol it's not as Anonymous as you

think it is whoever's in control of the

exit nodes is also in control of the

traffic which makes me

the one in control and that's the same

thing that the NSA knows is that they

know whoever controls the final hot

controls the network so he did the same

thing it's easy you can set up a a a

router on the Tor Network easy enough

just go to the website and they have the

software you can download and put

yourself as a router on the tour Network

so this is the problem you're telling us

about tour but we could be still

compromised right because they could

have could have like exit notes exactly

Whoever has that last exit node and

controls the traffic I'm not going to

refresh it one more time and see if we

it's still sending me back to Amsterdam

consistently I'm gonna go let's uh let's

let's stop it and and try connecting

again and let's see if we can't get a

different IP address there we go and

let's go uh what is my what is my IP is

this coming out socket here is there

timeouts whenever I go there let's go to

Google again

right here let's go what's my IP and see

if we get a different IP this time here

we go detecting should get a different

IP just give me a uh the IPv6 but not

the ipv4 yeah yet at least

well this would actually be best right

if it's the ipv4 is not detected but it

does have the IPv6 and still working on

it and it still comes back with not

detected so you could make the case that

that's even better that's not detecting

it but but I think it's basically the

website is the problem in that

um and that the IP address is not uh no

okay so I'm going to go ahead and shut

this down I'm going to go ahead and shut

down our our proxy chains one of the

other things that I wanted to show is

that um there's actually a tool called a

non-surf that you can install on your

Cali that will automatically send all

your traffic okay through Tor so let's

go there

okay we've got it installed now all

right so now we've got a directory

called Kalyan on surf let's just take a

look and see where it's at all right

here's Cali and on surf right here

let's go into that directory

okay let's take a look inside there

there's the installer and then we gotta

run sudo

installer sh

gives me a ears while processing and see

if we can get it to run okay go pseudo

and then

surf

start

there it is we're running that surf okay

you can see it's killing dangerous

applications cleaning some dangerous

cash elements stopping IPv6 starting

Anonymous mode saving IP tables rules

modified resolve dot confuse tour and

private internet access DNS all traffic

was redirected through Tor and you're

under an non-served tunnel so now what

happens is that everything you do on

this operating system is going to go

through the Torah Network it's going to

be a little bit slower but it's going to

give you better anonymity than it would

otherwise so your IP address is going to

be hidden except for the from the person

who has the exit node on the Torah

Network

um and hope and hopefully that's not the

NSA or the law enforcement so a couple

of the things that we want to talk about

we talked about using you know a browser

like Brave okay that's not and not uh

collecting cookies along cookies on your

browser one of the things that people

often ask me about is what's the safest

operating system and there's a number of

them that are out there that you know

all of them all of them pretty much are

using the Tor Network to make you more

secure I found that using Kali using the

announcer is actually works pretty good

pushing everything through the Torah

Network the other issues that people

often ask me about is how about using a

phone isn't a phone a major

vulnerability trying to whether it be

Android or Apple because both of them

can be hacked by Pegasus right and so

one of the things about your phone is

that you probably don't want to use your

actual phone whenever you're doing

anything that where you want to remain

anonymous because the data that's

collected from your phone is all

available to law enforcement they can

trace your your geolocation they can see

your messages one of the things that I

recommend is to go out and buy a burger

phone a burger phone is simply a phone

it could be a cheap phone if you go into

some of the phone stores you can buy

these phones that are inexpensive I

think I've bought some of them as little

as twenty dollars thirty dollars and put

them on a pay-as-you-go contract where

you pay cash for them and then that's

really really difficult to trace there's

no way to connect that phone to your

identity and so then you can go ahead

and make your calls and your messages

from that phone one of the things you

want to keep in mind though is that when

you go to buy that phone that you're not

traveling with that your other phone in

your pocket because you're you can be

then traced to the purchase of that

phone okay because every one of your

steps is being followed whenever you're

traveling with your phone there's always

geolocation that's available because

your phone is connecting to the cell

phone phone towers and from the cell

phone towers they have to get your

location now it's not as precise as GPS

but it's still they can tell if you're

going into a store to buy the phone they

can trace you that close so don't take

your phone with you all right go buy

your burner phone use your burner phone

for anything you want to remain

anonymous do not do any of the same

things on your usual phone your normal

phone as you would do on your burner

phone do not go to the same websites

don't go use the same browsers and so

that's kind of the rules of thumb for

using a burger film ultimately if you

really want to remain anonymous I

recommend using two separate systems

this is if you can afford it this is

probably the best way to go of course

you know you could have two separate

internet services all right or you know

you can hack your neighbor's Wi-Fi you

can use their that service I'm not

recommending that you do that but

someone else I would never recommend

that I'll never recommend that no

and then you could use somebody else's

IP address maybe but keeping your

activities separate in two separate

systems is going to be one of the safest

things that you can do because you're

using a different browser you're using

different uh operating system you're

using a different IP address so they

can't be connected back to you one of

the things I also do is that I create

false profiles I I put false information

out on the internet so that that

information doesn't need back to me

people try to connect that information

to the lead but it really is false

information that's going to be you know

there's breadcrumbs out there somebody's

going to follow and it's going to take

them to the wrong place and if they

follow all the bread comes it's going to

take them to separate identities this is

the kind of work that you need to do to

truly remain anonymous because there's

an awful lot of information that's out

there about you from OS in sources from

your cookies from your IP address and to

really remain anonymous it's like a a

full-time job you have to think about

everything that you do on the internet

and whether or not it's going to leave a

trace back to you is it safe for me to

use an ISP or or should are there

certain isps that you recommend I think

starlink was one that we've kind of

mentioned in the past well I use

starlink and I use starlink primarily

because they their IP addresses are not

geo-located right so if you go and

somebody looks at your IP address all

it's going to do is it's going to take

them to a regional office of starting so

I find Starlight to be just create one

more level of anonymity into your

traffic on the internet it just all it's

going to do is going to say hey it's a

starlink IP address now if starting

wants to give up your identity then

that's a different thing or a starting

gets hacked then your identity can be

resolved from that but most isps

distribute IP addresses by location

right so somebody can find out what City

you're in not with 100 accuracy but

pretty close to it what city you're in

simply buy your IP address knowing

there's there is these databases of IP

addresses and cities so so I would say

to create one more level of anonymity I

like starlink and then run starlink say

through proxies or vpns or Tor so a

great thing about stalling is you can

often buy this mobile solution can't you

so you could drive around and you know

you doesn't matter where you are you

could take it with you and then you

could access the internet from different

physical locations but I like what you

said there because if I use internet at

my house as an example and it's a fiber

link or something like that I mean it's

tied directly to my my house it's very

easy to find me right but exactly I

could be anywhere starlink allows you to

be mobile they charge an extra 25 a

month that gives you mobile and so the

Satellite Dish can move around it

automatically unlike some of the old

satellite technology where you were

fixed on a single satellite in in

starting they have thousands of

satellites and the dish is smart enough

to find the closest satellite so as

you're moving it goes and finds the note

the closest satellite to you makes it

much harder to be able to geo-locate you

when you're using Starbucks I mean

that's at least like I'm trying to think

in layers okay so how do I get to the

internet I could use stalling I could

for instance go to McDonald's or

somewhere else and get onto the internet

that way but then I've got to all sort

and look cold train station or somewhere

you know get onto the internet somewhere

somehow at least with stalling I'm I've

got something with me that I can take

her on yes yeah you can if you're you

can put it in your vehicle

you know if you're if you're traveling

you can take it with you and it will

automatically connect and there's

nothing there's no geolocation that's

assigned to it although you know you

have to pay for with a credit card so

your name is still linked to that IP

address if somebody gets inside of

starlink or Starling gives up your

information now to you know starlink is

an American company as we all know owned

by Elon Musk and Elon Musk wants to give

up the information about you then you're

still not Anonymous but at least it's

one layer um it's one layer and that's

what you think about you're right you

gotta think about later layers right

this is one layer that makes it just a

little bit more difficult to identify

you next one and this is always a

question people have do I use a Windows

computer do I use apple do I use Linux

or you know Apple Windows seem to both

have a lot of like data that they pull

from your Telemetry data that they pull

from you

um a lot of people don't trust them so

perhaps Linux is the best Well I

obviously would recommend Linux one of

the things that that both apple and

Microsoft do is that they put in user

IDs a guid into documents and so that if

you if you're creating a document and

you're just Distributing that document

it could be true increased right back to

your computer one of the things I

recommend is do not use Microsoft Word

or the whole Suite of Microsoft products

because they'll pull the the globally

unique ID off the machine and put it

into the document this is where

forensics becomes really critical so you

know if you're a forensic investigator

you know that you know that there's a

globally unique ID on that word document

so if you're trying to trace somebody

you can pull that globally unique ID

it's not going to have geolocation data

in it but once your machines identified

they can say that this document came

from this machine is it safe enough to

use a virtual machine or should I have a

dedicated physical machine that runs

Linux physical machine creates one more

layer if you're going to run multiple

machines I would recommend one one

machine that you're doing stuff that you

don't want to be traced on and one

machine that you're doing everything

thing else if you can afford that if you

can't afford that I would say run a

Linux machine in a virtual machine such

as virtualbox or VMware Workstation it's

all about like cost versus what you're

really trying to accomplish right so I

mean if you really want to go hardcore

you go to you've got to spend the money

to to do something like that I would say

yeah yeah if you want to really make

sure that you're you're not going to be

traced you want to go and spend a little

bit of money possibly have two systems

okay one of them that you're only doing

the work you're gonna have a separate

identity for each machine right and you

can create separate identities and not

have them be connected in any way shape

or form so like we mentioned stalling so

as an example I could have like an

internet connection at home that's my

normal internet let's say fiber whatever

and then I have a starlink which I do

all my Anonymous stuff on and then I

have like a Linux machine that I use for

my Anonymous stuff and then perhaps

whatever operating system I like for my

normal stuff what about phones because

like um they all seem to be you know to

choose the worst type it's like is it

iOS is it Android or do I have to go and

use graphene or something like that

that's a good question

um basically the most important thing I

think is simply have a phone that isn't

linked to any carrier right so any

carrier in any credit card because once

you've linked a credit card you pay for

it by credit card or have a service

through any one of the major carriers

then you can be traced these burner

phones that you can buy for cash you can

pay for them with cash the service for

cash the month-to-month the service uh

with cash that's really the only way to

remain to make certain that you're going

to remain anonymous and like I said they

they should not be in the same location

right at the same time right if if

they're in the same location same time

one of them has to be turned off because

once they're in the same location then

they can be tied together to your

location and your identity so in other

words graphene by itself wouldn't be

enough you'd want to buy a Bono phone

with cash or something because it's not

the operating system that's a problem

it's the fact that it can be traced to

you right exactly exactly that's I agree

it's I what I feel safest with is simply

using a burner phone right that's what I

feel confident that can't be traced and

what about VPN versus Tor there's this

always good argument on YouTube and you

know on the internet and that's why it's

great to get your opinion because you're

well experiencing this should I use a

VPN like XYZ VPN or should I use tool or

should I use Tor over a VPN or you know

what would you recommend it all depends

upon you know how much protection that

you want VPN for the average individual

who's trying to protect themselves from

Commercial Services VPN generally are

going to be pretty good but remember

that you're putting your hands you're

putting your life maybe into the hands

of the VPN developer they have all of

your information if they get hacked

right and they do get hacked then all of

your information is available so that's

a trust that you have to place in them

so for the average user a VPN is going

to be fine if you're working in cyber

War Warfare where your life is dependent

upon the remaining Anonymous that may

not be adequate in that case that a

cyber warfare environment where your

life isn't in is dependent upon

remaining Anonymous I would prefer

either proxies or the Tor Network

proxies can pose a an additional problem

once again that they can be hacked as

well I would never trust a free proxy

right because why would somebody put up

a free proxy why would somebody put out

[Laughter]

or it's a GRU or whoever so remember

that the NSA the gru all the

intelligence agencies one of the things

that they want to know is everybody's

identity they know that people use

proxies so their job is to figure out

who you are and what you're doing if you

were them and your job was to find that

out wouldn't you put up free proxies

here connect to our free proxy and of

course we keep no logs and of course

that's what they advertise and that way

they can at least get some of the

traffic going through their proxies it

doesn't make any money so they have no

business model to if there's no

legitimate business model to keep them

safe if somebody's putting up a free

proxy there's no legitimate business

interest to keeping you safe as a matter

of fact there's an interest in keeping

you unsafe and selling your data so I

recommend if you're going to use a proxy

use a commercial proxy where you're are

paying somebody to keep you safe so

let's take you to the extreme I mean

let's say you want to your life depends

on it you're a journalist or someone

who's involved in cyber warfare

something like that you really want to

keep yourself safe so if I've if I

understand correctly you're going to

have two infrastructures one for like

normal and then one for

um Anonymous stuff so starlink or

whatever it is separate infrastructure

separate laptops separate phones Bono

phones you're gonna buy that with cash

if you can you're going to use

um proxy chains or you're going to use

tall or something like that is that

right anything else that I've missed no

I think that that pretty much covers

them I just want to make sure that when

you're using those two separate systems

that they do not intersect the the sites

that you visit the things that you do

the information that you provide do not

intersect because that intersection can

be detected by people who are trying to

determine your identity do I need

separate homes or separate locations

like like you said the phone I mean I'm

just trying to think like you said don't

and put the two phones together right so

I'm gonna have to put that don't put the

don't put two phones together ah okay I

mean you could put one of them in a

faraday cage okay just so that the

location doesn't show the geolocation

Services don't show them being in the

same location because once you've

revealed that so for instance if you

have an Apple phone and you've got a

burner phone and they're both sitting in

your office and they're both on right

they're both showing that they're in the

same location you've subtly given away

your identity as the person who owns the

iPhone right that burner phone has been

now been linked to that iPhone so you

put the burner phone in the Faraday cage

or you leave it somewhere else and you

don't bring it to your home where you do

your normal stuff or you just turn it

off what I really appreciate about

occupy the web for everyone who's

watching is he doesn't it's not

sensationalist nonsense he's giving you

the you know really good information so

okay by the web thanks for doing that of

course anytime David So occupy the web

another one we didn't touch on this

email do you have any email providers

that you could recommend for secure

email because email seems to be one of

those things that's it's easy to find

people yes email can easily be traced

and so one of the things that I like and

those people who have worked with me and

been my students or in some way

Associated know that I use protonmail

protonmail is the only one that I feel

comfortable with they are based out of

Switzerland it's end-to-end encryption

you might ask yourself well what

difference does it make that they're in

Switzerland well Swiss the Swiss have

particular laws that protect people's

privacy more than even the EU does or

certainly the US does because the US

doesn't really have any good privacy

laws at all Switzerland has long had the

history that's why there are these Swiss

bank accounts right because the Swiss

have special laws of protecting people's

privacy even if you have end-to-end

encryption and the encryption in a

service then if the servers get

compromised or law enforcement shows up

that's often what happens law

enforcement shows up and says we think

that you know we need to have the data

from your servers that's how can that's

less likely to happen in Switzerland

than it is in other countries it's

happened in the U.S it's happened in

Germany it's happened in Australia where

law enforcement shows up and wants the

once the records Canada where law

enforcement shows we want the records

and therefore that all of your email and

all of your communication is then

compromised Switzerland has laws that

protect privacy that's more strict than

other nations do and proton male I've

been using them for I don't know almost

I actually got one of the beta Accounts

at protonmail when they first opened up

you had to actually ask for an account

um and you had to wait like three or

four months to get an account so I've

been with them a long time and I have a

lot of confidence that that they're

going they're going to do as good a job

as possible to protect my information uh

there's a number of others that are out

there as well including male fans

private mail a non-atti Google mail

secure mail what have you uh those are

all out there as well as far as secure

operating systems some of the hardened

operating systems and cubes sub graph

hardened BSD are all good choices you

want to hardened and safe and secure

operating system one of the things I do

want to mention before we finish here

and that is that a lot of people believe

that making trans transactions in

Bitcoin is untraceable and that's not

true all right as a matter of fact I

have a class coming up I think it's in

December on how to trace Bitcoin if

you're trying to remain anonymous and

you're using Bitcoin Bitcoin is

traceable it's not easy to trace but it

can be traced so it's not going to

maintain your anonymity but also

remember that maintaining anonymity is a

matter of throwing up a lot of

roadblocks to the people trying to trace

you so the more roadblocks that you can

put up then the harder it is situation

but Bitcoin a lot of people believe that

they can simply purchase them with

Bitcoin and be safe now some of the

other

cryptocurrencies have better anonymity

that Bitcoin does so and that's one of

the things that I think we're going to

talk about in the future that'd be great

I could do a video on that and everyone

is watching please put in the comments

below would you like to see a video on

occupy the web showing us how to trace

Bitcoin transactions one other thing we

want to talk about is anti-forensics I

have a class coming up this summer on

anti-forensics first of all I recommend

that you want to remain anonymous that

you study forensics and Os in but after

you've studied it then you have to focus

on how can I keep the information off my

machine this includes cleaning off any

files off your system as we know that if

you delete a file out of your system it

still is there so you have to overwrite

files on your system and then of course

you want to clean your bash history or

wherever you're entering your commands

what would you say to people who say

that the only way to do operating

systems is to run it in Ram so you boot

off a USB or something and it's all in

Ram and then when you finish you pull

that out and it's all gone well I think

that's a really good idea that's that's

certainly an option is to Simply run

your operating system all in Ram say off

a flash drive and then once you've taken

the flash drive off it means is gone I

mean it is still possible but if you

reboot the system everything is gone and

nearly everything's gone from Ram okay

there's still forensic investigators can

still pull

some information from Ram even after

you've rebooted the system remember also

that operating systems when the ram is

full it begins to write to the hard

drive right there's swap files so the

strategy is good one but it's not a

hundred percent that's my point none of

these strategies is 100 but if you put

up enough of these on anonymity

strategies the safer you're going to be

we spoke about like buying a separate

laptop or something for running Linux on

but you could perhaps boot into RAM on

that laptop if you just want to you go

to the next level so it's just like

layers and layers and layers of right

anonymity right yeah the more layers you

put in okay the safer you are my thing

that I emphasize to nearly everybody is

that if somebody with enough skills and

enough knowledge and enough resources

wants to find you they can't but it's

that's key enough resources enough time

and enough skills they can find you but

most people don't have unlimited

resources unlimited time and unlimited

skills what you want to do is to make it

as difficult as possible but if you

really need to remain anonymous from say

the intelligence agencies that's a

really really difficult job if you want

to remain anonymous from the commercial

interests or your next door neighbor

that's a little bit easier to do than it

is from the intelligence agency they

have a huge amount of resources and high

level skill okay by the way we have

another one that comes up a lot search

engines

um Google's tracking you like crazy

um what about DuckDuckGo some people say

bad things about them do you have any

favorite um search engines what I what I

would prefer okay is to use Dr go in

Brave all right the brave browser Google

is probably the worst in terms of

tracking your information uh so the

Google Chrome is a great browser I love

Google Chrome but they trace they track

everything that you're doing so I would

recommend using DuckDuckGo in Brave uh

to remain safest to have least amount of

information that's but once again

remember that even then you want to be

able to have two separate identities so

that what you're searching for induct.go

is different than what you're searching

for in Google or other places so the two

cannot be connected I love what you said

here because in this interview you kind

of like make taking putting emphasis on

have different identities like have

everything separated a lot of people I

think make the mistake that they use the

same devices or go to the same websites

when when they're trying to be anonymous

and when they're just normally surfing

and I'm glad that you've really

highlighted that so a technical solution

isn't the the answer to everything it's

like make sure that you separate your

your behavior if you like exactly and

and also one of the things that I do is

put out false information so I I leave

behind false information that will take

people to will take people to other

identities so that when they're trying

to trace me they all of them are not

leading to the same identity they're

leading to multiple identities and and

that can at least obscure and make it

more difficult to find you okay by the

way as always I really want to thank you

for sharing your knowledge and

experience with all of us you know

you've got many many years of experience

and you have are anonymous online even

though you've write books you share so

much information

so thanks for sharing um your warnings

and your tips with all of us I really

appreciate it you're welcome David I

always enjoy being on your show and look

forward to doing more of these with you

on in the future so just for everyone

who's watching ideas that we've got let

us know in the comments ideas would

include Pegasus

um talking about that uh what other ones

do we think about with Bitcoin right how

did trade Bitcoin forensics yeah what

about like wi-fi hacking that would be a

good one Bluetooth I think is another

good one and we definitely want to have

Mr Robot right and we'll do more with Mr

Robot as well so for everyone watching

please put your comments below things

that you'd like to see occupy by the way

but thanks so much thanks David see you

soon

thank you