I’ve read your article and it makes sense, but I’m wondering if what you are doing with multiple personas is really any better.

Mirimir is a rather unique name, Google turns up a lot of results which seem to be you, so it’s not hard to see what mirimir is interested in. I’d assume ad networks also have a pretty good profile on mirimir too.

I’m sure there’s more to you than just mirimir, but it’s probably a big part of who you are so what does this really gain? Your real name isn’t revealed, but that’s just another persona. Potential employers won’t find you are interested in opsec through Google, but I’d assume you work in that field anyway. I’d guess having the choice of what to reveal is an advantage, but it’s very easy then to reveal too much so that personas could be put together (e.g. Steve who is the friend of another persona on Facebook, comments on mirimirs article).

Maybe people aren’t going to come across your non-work interests in (e.g.) steampunk or painting dragon pictures, but so what? For most people that is part of who they are, and they don’t care to hide it. Maybe if you have something to hide this is a good idea, but I’d say most people don’t (given how many post private details of their life online).

Personally I use my real name online. I’ve considered switching to pseudonyms to make it harder for casual people to stalk me, but at the end of the day I’ve already revealed so much that it’s not going to help much, and there isn’t anything I feel the need to hide.

I ended up writing a long reply to mercer, so let's incorporate that by reference.

Yes, Mirimir is rather unique. There's that South American woman, and a travel agency in Iran. But still, yes. I picked it because "мир и мир". And name recognition is intentional.

Indeed, Mirimir is a big part of my online presence. I've worked hard on that persona, for some years. And it occasionally gets me into interesting stuff, even some consulting work.

My meatspace identity is distinguished from Mirimir in three important ways. First, I rarely use English. Second, I don't work on OPSEC, or display any interest in anything related to that. Third, I don't have much of a public online presence. All of my professional work is private, as required by clients. And my social life stays just about totally in meatspace.

Isn’t the most important rule of opsec, “don’t post comments about your opsec, even if you totally believe you are ‘safe’”?

That's true. But Mirimir is a special case for me, because his role is sharing about OPSEC. And for what it's worth, Mirimir plays things quite safely. An adversary would need to work out Tor connections through other VPN chains to find anything I really care about. And even then, I'm totally white-hat, so hey.

Doesn't using VPN's and Tor in itself put you on the map of anyone looking for 'deviant' behavior?

Regarding VPNs, that depends where you are. In many countries, VPN usage is over 20%. So it's not such a huge flag. And I do torrent lots of HD video. So my ISP just sees one VPN connection, with torrent-like throughput patterns.

The rest of my online activity goes through nested VPN chains, routed through the main VPN. So it's only the final VPNs in those chains that see anything except throughput patterns.

I routinely have several workstation VMs running, each connecting through its own VPN chain. So, while I'm drafting posts for HN or whatever, I'm typically doing stuff in other VMs. It's pretty much like most people do with apps in multiple windows, or SSH logins, or whatever.

And Tor. I've never connected directly to Tor. I only connect through nested VPN chains, at least three deep. So yes, I consider Tor use to be a serious risk.