Sinisterly
How does online ID verification work? - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: How does online ID verification work? (/Thread-How-does-online-ID-verification-work)

Pages: 1 2 3 4 5

RE: How does online ID verification work? - sinisterlee - 02-10-2023

(02-09-2023, 06:28 PM)EquitableEngineer Wrote:
(02-09-2023, 10:42 AM)sinisterlee Wrote: Could use a vcc or create a new legit account and pay if he is planning to pay anyway.
No sense in building up legit payment history on a cracked account that can be suspended or reclaimed at any moment imo.
Or buy a dedicated ip account if there are account sellers providing that.

Don't you guys worry about using cracked vpns on your wifi or do you only connect to cracked services with an "anonymous" internet connection?
I wouldnt want my card details on an account that is linked with SEing in any way and as for using a cracked account on your own WIFI you will be fine given that most VPN providers are claiming not to keep any logs. Some claiming this have actually been found to be lying and were handing over records to LE but stick to reputable providers and you should be fine.

Agreed on that but don't you think they who you are if you have for example been a paid user and you switch to cracked accounts on the same wifi?
You can disconnect the modem for a new IP but it is still almost the same as the original.

RE: How does online ID verification work? - EquitableEngineer - 02-10-2023

(02-10-2023, 12:17 AM)sinisterlee Wrote: Agreed on that but don't you think they who you are if you have for example been a paid user and you switch to cracked accounts on the same wifi?
You can disconnect the modem for a new IP but it is still almost the same as the original.
Having never paid for a VPN service in my life (i didnt choose the thug life...) i dont really have this problem but you can circumvent it by just buying a cracked account for a different provider from the one your details are linked to. There are plenty to choose from.

RE: How does online ID verification work? - sinisterlee - 02-10-2023

(02-10-2023, 12:17 AM)EquitableEngineer Wrote:
(02-10-2023, 12:14 AM)sinisterlee Wrote: Any opinions on the recent claims of demasking tor users?
Have you tried I2P yet?
Link about the TOR story please and yeah ive dabbled in I2P but not really something i see myself getting much benefit from considering how I operate. Could be wrong about that though.

https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html
https://www.bbc.com/news/technology-28573625
https://www.wired.com/2014/12/fbi-metasploit-tor/
https://eandt.theiet.org/content/articles/2019/07/hackers-expose-russian-backed-tor-demasking-project/

Different angles on demasking but wouldn't put all of my eggs in one basket with any of these methods.


Do you believe that both the silkroad and alpha bay creators were dumb/careless enough to connect their private email address to a coding job advert or have it connected to messages sent out to new users? Not being sarcastic just wonder if others believe that story.

RE: How does online ID verification work? - EquitableEngineer - 02-10-2023

(02-10-2023, 12:23 AM)sinisterlee Wrote: https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html
https://www.bbc.com/news/technology-28573625
https://www.wired.com/2014/12/fbi-metasploit-tor/
https://eandt.theiet.org/content/articles/2019/07/hackers-expose-russian-backed-tor-demasking-project/


Do you believe that both the silkroad and alpha bay creators were dumb/careless enough to connect their private email address to a coding job advert or have it connected to messages sent out to new users?
Firstly they are some old ass articles, i thought you were referring to some new technique that has been uncovered. Secondly as with the cases mentioned in those articles and almost all cases where users identities are revealed despite their efforts, user error is to blame. In other words making a mistake or not knowing what they were doing to begin with is what caused their demise.

I cant tell you how many official court documents ive read about these DN drug dealers making silly mistakes like the one you mentioned or something like having a tip jar BTC address that they cash out on an exchange where they have linked their identity - You are a drug dealer making Gs upon Gs a month, why the hell do you need a tip jar ?

RE: How does online ID verification work? - mothered - 02-10-2023

(02-10-2023, 12:00 AM)sinisterlee Wrote: I meant adding an additional layer of security for example when logging into this forum Wink
In that case, I agree with what you've stated about anonymity.

Here's my personal non-exhaustive recommendations.
  • Change your browser's user agent.
  • Run a VPN alongside the Tor network by Installing the Tor browser (VPN > Tor > Internet)
  • Change your screen resolution with a tool named Multiloginapp (The user agent will NOT do this).
  • Disable all location features and settings- both browser and OS-based.
  • To help prevent your browser leaking your connection (ISP, connection type, Internal & external IP address), disable WebRTC. Although VPNs do prevent such Information from being disclosed, leaks do happen.
  • Some VPNs only handle IPv4 requests, hence (where supported) If an IPv6 request Is made, the VPN will not handle It and result In an IPv6 leak, thereby disclose your location, ISP etc. If supported, disable IPv6 In your router.
  • Going to the extreme, If you're navigating via your cell phone, certain sensors (example, proximity sensor, gyroscope sensor, magnetometer sensor, barometer sensor, ambient light sensor) can reveal PINs, passwords, location, voice searches etc. Disable those you don't need/use.
  • Use a private search engine. I recommend MetaGer- It also has a built-In proxy that allows you to open links anonymously within that proxy. This adds an additional layer of protection to your current setup.
  • Use a secure web browser. I recommend Epic browser. This also has a built-In proxy.
  • Where possible, disable JavaScript. This Is responsible for an array of browser leaks.
  • Encrypt your DNS servers. A tool named Simple DNSCrypt does the job well.

By no means does this cover anonymity In Its entirety, but It will certainly suffice.

RE: How does online ID verification work? - sinisterlee - 02-10-2023

(02-10-2023, 12:38 AM)EquitableEngineer Wrote:
(02-10-2023, 12:23 AM)sinisterlee Wrote: https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html
https://www.bbc.com/news/technology-28573625
https://www.wired.com/2014/12/fbi-metasploit-tor/
https://eandt.theiet.org/content/articles/2019/07/hackers-expose-russian-backed-tor-demasking-project/


Do you believe that both the silkroad and alpha bay creators were dumb/careless enough to connect their private email address to a coding job advert or have it connected to messages sent out to new users?
Firstly they are some old ass articles, i thought you were referring to some new technique that has been uncovered. Secondly as with the cases mentioned in those articles and almost all cases where users identities are revealed despite their efforts, user error is to blame. In other words making a mistake or not knowing what they were doing to begin with is what caused their demise.

I cant tell you how many official court documents ive read about these DN drug dealers making silly mistakes like the one you mentioned or something like having a tip jar BTC address that they cash out on an exchange where they have linked their identity - You are a drug dealer making Gs upon Gs a month, why the hell do you need a tip jar ?

I don't have the technical competency to ascertain whether they are legit or not.
It was a recent article from this year that peaked my interest, it might have been related to this bust covered in this blog but can't remember now:
https://www.schneier.com/blog/archives/2023/01/the-fbi-identified-a-tor-user.html
Threw in some old ones for good measure, highlighting different security concerns about TOR.

For sure human error or carelessness is probably one of the main reasons vendors get busted.
Would not put the founders of SR and AB into the same category as your regular drug dealer.
Especially Alpha02, he was a software engineer with a deep understanding of opsec (formally a carder as well).
Mistakes are possible but it seems a bit too convenient that two of the most succesful founders were caught by the same basic opsec mistake.
Alpha02 may have been technically competent in terms of the site security but was balling out of control in his real life.
He did make obvious mistakes such as owning several properties when he didn't have income in that country, had the fancy cars etc.
He apparently said the money laundering practices of desnake were overkill, so again taking the easy option.
So I could be more likely to believe that he could be careless based on his other tendencies.

In the new AB, desnake (if it is really him has proven opsec credentials) is also recommending users to move to I2P.
Of course it is possible to always make conspiracies. Such as I2P is LE controlled and as AB2 is a honeypot, they are trying to guide users to use a less secure anonymisation method.
(02-10-2023, 01:31 AM)mothered Wrote:
(02-10-2023, 12:00 AM)sinisterlee Wrote: I meant adding an additional layer of security for example when logging into this forum Wink
In that case, I agree with what you've stated about anonymity.

Here's my personal non-exhaustive recommendations.
  • Change your browser's user agent.
  • Run a VPN alongside the Tor network by Installing the Tor browser (VPN > Tor > Internet)
  • Change your screen resolution with a tool named Multiloginapp (The user agent will NOT do this).
  • Disable all location features and settings- both browser and OS-based.
  • To help prevent your browser leaking your connection (ISP, connection type, Internal & external IP address), disable WebRTC. Although VPNs do prevent such Information from being disclosed, leaks do happen.
  • Some VPNs only handle IPv4 requests, hence (where supported) If an IPv6 request Is made, the VPN will not handle It and result In an IPv6 leak, thereby disclose your location, ISP etc. If supported, disable IPv6 In your router.
  • Going to the extreme, If you're navigating via your cell phone, certain sensors (example, proximity sensor, gyroscope sensor, magnetometer sensor, barometer sensor, ambient light sensor) can reveal PINs, passwords, location, voice searches etc. Disable those you don't need/use.
  • Use a private search engine. I recommend MetaGer- It also has a built-In proxy that allows you to open links anonymously within that proxy. This adds an additional layer of protection to your current setup.
  • Use a secure web browser. I recommend Epic browser. This also has a built-In proxy.
  • Where possible, disable JavaScript. This Is responsible for an array of browser leaks.
  • Encrypt your DNS servers. A tool named Simple DNSCrypt does the job well.

By no means does this cover anonymity In Its entirety, but It will certainly suffice.

Nice suggestions on browsers and search engines, only seen you mention them.
You recommend tor browser over a built in option like in brave browser?
What are your opinions about brave browser and firefox private?
Do you consider startpage.com to be private at least for personal usage?

Rarely seen startpage mentioned, duckduckgo seems to be mentioned a lot by Americans particularly.

RE: How does online ID verification work? - mothered - 02-10-2023

(02-10-2023, 10:49 AM)sinisterlee Wrote: You recommend tor browser over a built in option like in brave browser?
You never know what type of Information Brave collects, hence direct access via the Tor browser Is always the better option.

(02-10-2023, 10:49 AM)sinisterlee Wrote: What are your opinions about brave browser and firefox private?
Do note that private/Incognito In Firefox, only relates to your local environment and not your online activity.

(02-10-2023, 10:49 AM)sinisterlee Wrote: Do you consider startpage.com to be private at least for personal usage?
It's much of a muchness to most other private search engines.

Personally, I prefer MetaGer. It also allows you to open webpages via Its built-In proxy.

(02-10-2023, 10:49 AM)sinisterlee Wrote: Rarely seen startpage mentioned, duckduckgo seems to be mentioned a lot by Americans particularly.
DuckDuckGo seems to be the most popular.

RE: How does online ID verification work? - sinisterlee - 02-10-2023

(02-10-2023, 11:31 AM)mothered Wrote:
(02-10-2023, 10:49 AM)sinisterlee Wrote: You recommend tor browser over a built in option like in brave browser?
You never know what type of Information Brave collects, hence direct access via the Tor browser Is always the better option.

(02-10-2023, 10:49 AM)sinisterlee Wrote: What are your opinions about brave browser and firefox private?
Do note that private/Incognito In Firefox, only relates to your local environment and not your online activity.

(02-10-2023, 10:49 AM)sinisterlee Wrote: Do you consider startpage.com to be private at least for personal usage?
It's much of a muchness to most other private search engines.

Personally, I prefer MetaGer. It also allows you to open webpages via Its built-In proxy.

(02-10-2023, 10:49 AM)sinisterlee Wrote: Rarely seen startpage mentioned, duckduckgo seems to be mentioned a lot by Americans particularly.
DuckDuckGo seems to be the most popular.

Makes sense, using the tor browser adds another level of seperation.
Got two more points to add to your list.
Use a device exclusively for your grey activity and also obsfucate your internet connection, don't use home wifi if possible.

RE: How does online ID verification work? - mothered - 02-10-2023

(02-10-2023, 12:04 PM)sinisterlee Wrote: Makes sense, using the tor browser adds another level of seperation.
Absolutely.

(02-10-2023, 12:04 PM)sinisterlee Wrote: Got two more points to add to your list.
Use a device exclusively for your grey activity and also obsfucate your internet connection, don't use home wifi if possible.
Thanks for the suggestion.

It's pretty much common sense, hence I didn't feel the need to add something to that effect at the time of writing my list.

RE: How does online ID verification work? - sinisterlee - 02-10-2023

(02-10-2023, 02:38 PM)mothered Wrote:
(02-10-2023, 12:04 PM)sinisterlee Wrote: Makes sense, using the tor browser adds another level of seperation.
Absolutely.

(02-10-2023, 12:04 PM)sinisterlee Wrote: Got two more points to add to your list.
Use a device exclusively for your grey activity and also obsfucate your internet connection, don't use home wifi if possible.
Thanks for the suggestion.

It's pretty much common sense, hence I didn't feel the need to add something to that effect at the time of writing my list.

It is common sense but the majority of people don't do it.
Plenty of people been tracked to their home wifi and caught.