There's a parallel phenomenon in political behavior that's ably explained in Brian Caplan's The Myth of the Rational Voter.
You could practice really rigorous security culture and avoid creating any digital footprint worth talking about in the first place, but then you'd be socially isolated to a degree that was economically disadvantageous (economically meaning in multiple contexts besides purely fiscal). And to the degree that you can be socially connected, inferences could still be made about you through the behavior of your friends.
As a crude example, recall that Osama bin Laden's hiding place was determined to be interesting because there was physical traffic of people and goods to the residence, but an uncharacteristic lack of electronic communication for the neighborhood it was situated in. What kind of house has a bunch of people living there and regular visitors, but not internet or phone service?
Finally, people have different kinds of risk calculus. Many people know that they're subject to such surveillance and the ramifications that follow from it, but choose to be who they are anyway despite the risks, on the theory that they'd rather live on their feet than die on their knees.
I laughed and pointed out that I'm not a teen and am quite familiar with my rights. They were visibly disappointed and told me that I was kicked out of Kansas and that I'd be arrested if I ever went back to Kansas. I giggled again but left and they followed me to the interstate slipway.
This certainly isn’t a localized tactic. I recall discussion of videographers printing statutes and employing them when threatened about recording police activity in public spaces. The frightening aspect (to me) is that some law enforcement officers genuinely appear to believe that they have authority that they don’t have.
http://www.oregonlive.com/portland/index.ssf/2017/04/gresham...
https://www.aclu.org/news/aclu-portland-police-reach-settlem...
They'd just been almost totally destroyed by a tornado and I happened to be just a little ways away. So, lacking anything better to do, I bought some work clothes and went to help move rubble.
I was leaving the State and decided I'd nap for a few hours. I didn't feel like getting a hotel so I slept in the car. It turns out, I was sleeping in a factory parking lot and the people who came in to open it called the police - or so the cops said. It probably didn't help that I was in manual labor clothing, I'm not white, and I was in a new BMW. I probably looked like a drug dealer. That's still not an excuse.
Not to worry, I didn't let it reflect on the nice people of Kansas. But, after I'd spent a couple of weeks just giving my time to those in need, their cops harassed me and told me that I was banned from their State. I haven't been back but that's just coincidental.
I know this does happen sometimes now. What happens when saying "I don't have a facebook account" becomes a significant enough indicator that your're hiding your past?
I've heard stories of people at airport customs attempting to enter a country and having to try explain to the customs officers their lack of web presence or social media posts that they would otherwise use to corroborate and back up their intent for travel.
Demanding a social media identity or password is a great idea if you want to paint a huge target on your back for a discrimination lawsuit.
Said social media account will contain a lot of information about whether or not you are a member of a protected class. Good luck proving that you didn't use it in your hiring decision.
If I still cared enough about writing software I'd probably do a startup around some of this. Instead I'm writing SF about it.
I would act the in the same manner you would as well, it's not worth working for a company if they don't have some very basic principles and it's a huge red flag. If they don't respect your privacy in the interview, they probably wont respect it in day to day business. But just like you explained we have to be careful because there's a lot of people who don't really have a choice, especially in today's job market here in Australia; a lot of people would have to decide between privacy and their ability to pay the power, rent, food, etc.
> Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? [...] Privacy will be [...] the effective capacity to misrepresent yourself.
> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. Your fused identity is not a question unless you work to make it be. Lest you think that this is a problem statement for the random paranoid individual alone, let me tell you that in the big-I Intelligence trade, crafting good cover is getting harder and harder and for the exact same reasons: misrepresentation is getting harder and harder. If I was running field operations I would not try to fabricate a complete digital identity, I'd "borrow" the identity of someone who had the characteristics that I needed for the case at hand.
OPSEC is hard. You leak incredible amounts of data, and modern analysis techniques reveal a lot more than most people realize.
Re: your secondary identity - how do you plan on obfuscating the changeover events so the usage times (and/or network entry/exit times) of your secondary identity are not the inverse of when you use your primary identity? I recommend ZOZ's talk "Don't fuck it up!"[2] for a better sense of just how hard is to do proper OPSEC in the modern age of surveillance.
We reveal so much more about ourselves than we could ever imagine. If you use, or used Reddit, Snoopsnoo [1] is a site that uses incredibly primitive language parsing to build a profile on users based on what they've voluntarily submitted. And again I have to emphasize that is using very primitive parsing. It's disconcerting how much we reveal when an algorithm is able to rapidly and effectively piece it together.
Now when enter the government that data can be cross matched against other meta-data to nail down your identity to a very small segment, if not outright match it. And then we get into things like language analysis. I make some token effort to anonymity, but my wife has mentioned she often knows its me posting before seeing the username. And I can do the same for other people I know well. No idea what we're picking up on, but it's a task that machine learning would be phenomenally well suited to do - and do better than we do. And then there are things like more explicit dialect issues. This [2] is a quiz based on American dialects. Again it is phenomenal how much your vocabulary, which undoubtedly you view as 'proper', actually reveals your location. Our very language is not only a finger print but also a geo-tracker.
[1] - https://www.snoopsnoo.com/ [2] - http://www.nytimes.com/interactive/2013/12/20/sunday-review/...
As someone who doesn't know much about American dialogue, do people over there really use similar wording? Or is the quiz just coming up with random answers because it has no clue what to suggest?
Anyway I'm not that impressed it had me down as either coming from Providence (because I pronounce mary, marry and merry different), or Santa Rosa or San Jose (because I'd never heard of a drive through liquor store which actually seems a mental idea, from a UK perspective). I know it's not supposed to work on me but there's a massive distance between the first and last two places based solely on one data point.
Makes me wonder how this would fare in a smaller country like the England or Scotland, etc.
Friends and family might have a hard time tracking your discrete secondary identities, but your ISP or facebook might see it very transparently.
It of course won't work well against police, who can look up the VPN provider, ask who's paying for it, and it's mostly enough to find you.
Forums: often the need for a separate identity arises from the need to join a particular forum frowned upon by your peers or superiors. Same for audience. That is, if you want a different persona and not a sock puppet to support your "main" persona.
Timing: this is also solvable if you want to.
For example, "okay, so you have one account exclusively post hard core right-wing arguments in the early morning, and then your second account posts left-wing arguments in the mid-afternoon."
At that point, what's the point? :-)
All these three personalities need not be connected in any way, nor need they contradict each other in what they say. They are just for different and unrelated facets of one's life.
Possible? Maybe. Easy? No.
And about style. Mirimir only writes in English. I draw on my experience working with Americans, including many from the South. My meatspace identity never uses English online.
I suppose someday they might implement features to try to detect and filter out that kind of thing, but then it will time to abandon the platform totally.
(Also, creating secondary identities is easy on paper, but IME segregating myself like that and presenting a fake persona takes a psychological toll. Perhaps others are more adept at it.)
Me, I enjoy having multiple personas :) I also enjoy writing about this stuff: https://www.ivpn.net/privacy-guides/online-privacy-through-o...
Mirimir is a rather unique name, Google turns up a lot of results which seem to be you, so it’s not hard to see what mirimir is interested in. I’d assume ad networks also have a pretty good profile on mirimir too.
I’m sure there’s more to you than just mirimir, but it’s probably a big part of who you are so what does this really gain? Your real name isn’t revealed, but that’s just another persona. Potential employers won’t find you are interested in opsec through Google, but I’d assume you work in that field anyway. I’d guess having the choice of what to reveal is an advantage, but it’s very easy then to reveal too much so that personas could be put together (e.g. Steve who is the friend of another persona on Facebook, comments on mirimirs article).
Maybe people aren’t going to come across your non-work interests in (e.g.) steampunk or painting dragon pictures, but so what? For most people that is part of who they are, and they don’t care to hide it. Maybe if you have something to hide this is a good idea, but I’d say most people don’t (given how many post private details of their life online).
Personally I use my real name online. I’ve considered switching to pseudonyms to make it harder for casual people to stalk me, but at the end of the day I’ve already revealed so much that it’s not going to help much, and there isn’t anything I feel the need to hide.
Yes, Mirimir is rather unique. There's that South American woman, and a travel agency in Iran. But still, yes. I picked it because "мир и мир". And name recognition is intentional.
Indeed, Mirimir is a big part of my online presence. I've worked hard on that persona, for some years. And it occasionally gets me into interesting stuff, even some consulting work.
My meatspace identity is distinguished from Mirimir in three important ways. First, I rarely use English. Second, I don't work on OPSEC, or display any interest in anything related to that. Third, I don't have much of a public online presence. All of my professional work is private, as required by clients. And my social life stays just about totally in meatspace.
The rest of my online activity goes through nested VPN chains, routed through the main VPN. So it's only the final VPNs in those chains that see anything except throughput patterns.
I routinely have several workstation VMs running, each connecting through its own VPN chain. So, while I'm drafting posts for HN or whatever, I'm typically doing stuff in other VMs. It's pretty much like most people do with apps in multiple windows, or SSH logins, or whatever.
And Tor. I've never connected directly to Tor. I only connect through nested VPN chains, at least three deep. So yes, I consider Tor use to be a serious risk.
In this regard, you might well be one of the very few 0.000000001% for whom that statement might be true.