Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

Is anonymous web surfing possible? If so, can't the 'bad guys' use it too?

Question:

I heard about TORPARK today. Does it work, if so what are the implications
for abuse, terrorism etc? Does this software make us completely unanswerable?
Puzzled and bemused!

Torpark is one of several freely available approaches to surfing the
internet anonymously.

Sort of.

Anonymous surfing might not be everything you think, and it’s important to
understand what it does, and does not, do to protect you.

Become a Patron of Ask Leo! and go ad-free!

Every computer on the internet is, ultimately, identified by its IP address.
Whenever one computer connects to another, each “knows” the others IP address.
It’s how data is routed across the internet from one computer to another.

So, for example, when I visit a web site such as this one, the server
“knows” and records my internet IP address.

Now, I’ve spend a lot of time on this site discussing how IP tracing is
not possible for mere mortals. You and I cannot trace an IP
address to the physical location of the computer it represents. At best, you
and I can find out the ISP that has assigned that IP, and perhaps the general
region that the IP address is located in.

But the ISP – well, that’s different. They can trace the IP address to the
exact location of the computer connected to it. They’ll typically only do it in
response to a law enforcement request or court order, but they can do it.

“You and I cannot trace an IP address to the physical
location of the computer it represents.”

That’s where anonymous surfing services come in.

An anonymous surfing program runs all of your web traffic through a third
computer. Instead of connecting your computer to a web site directly, you
connect to the service, and the service connects to the web site on your
behalf. All data is funneled through the service.

This “anonymizes” you, because the web site you’re visiting never sees your
IP address. All they see is the IP address of the anonymization service.

Now, conceptually that’s all very simple. But there are issues…

  • Your IP address is visible to the anonymization service:
    that’s required for your connection to work. You are trusting that they are not
    logging your connection and logging who you’re connecting to. You’re further
    trusting that they won’t reveal any of that to anyone else.

  • The service’s IP address is visible: possibly
    making it obvious that you are using an anonymization service. That might make
    it look like you have something to hide.

  • Your IP address may not be the only thing that identifies you
    (#1)
    : there’s often other information included when you make a request
    that could identify you or could at least help distinguish your visits from
    someone else. Torpark addresses this by actually including Firefox to be used
    in conjunction with Torpark. Other services may, or may not, address this at
    all.

  • Your IP address may not be the only thing that identifies you
    (#2)
    : as we saw with the recent search data “accidentally” released by
    AOL, you may not need an IP address to be identified. Many individuals were
    identified solely by the search queries that they made. As always, be careful
    with what information you provide as you browse; search terms, URLs, form
    information – individually they might mean nothing, but taken in aggregate you
    might be leaving an identifiable trail.

  • The services tend to be slow: The very nature of adding a
    computer “in the middle” of your web requests adds time and makes things
    slower. I’ve tried several anonymous surfing tools over the past few years, and
    each has been noticeably, if not unacceptably, slow.

“Web surfing is already mostly anonymous anyway – not
because it can’t be traced, but because there’s no one who cares to take the
time and effort to do the tracing.”

And one other issue you touch on with your question: Anyone can us ’em. Are
there social implications if everyone can surf without accountability? Using
the currently semi-inflammatory example, does this technology enable terrorists
to operate without being caught?

As always, the answers are not that simple.

First realize that anonymization services are not new. They’ve been around
for years already.

The fact is that anything can be traced if you have sufficient resources,
and especially if you have the backing of the government. But what are
“sufficient resources”? As I mention above, the practical reality is that
sufficient resources are well beyond the means of most people on the internet.
Doing so legally means having a legal reason, and the support of an already
over-taxed legal system to back you up. Doing so illegally starts to look like
some kind of spy movie – except it takes much more energy and time than
Hollywood would lead you to believe.

It’s typically just not worth it. Web surfing is already mostly anonymous
anyway – not because it can’t be traced, but because there’s no one who cares
to take the time and effort to do the tracing.

Anonymous surfing services simply put up another barrier to detection. But
if the people attempting to track it are sufficiently motivated and have the
resources (I would expect HUGE resources) – then it wouldn’t surprise me at all
if it’s a barrier that could be breached, or at least shut down.

But I personally don’t expect that to happen often at all.

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

12 comments on “Is anonymous web surfing possible? If so, can't the 'bad guys' use it too?”

  1. Normally, somebody wouldn’t want to stay anonymous and an average user may as well not try it as you explained about the issues. But, not all servers used for these purposes keep records for very long and it is possible to use more than one server and compounding makes it almost impossible to track down IP’s. Of course, things would slow down terribly, but why would someone could go to such extremes?

    Reply
  2. Leo did a great job at attacking the technical stuff, but let me chide in on the social side.

    Yes, ‘bad guys’ can use it too. The internet, much like a telephone, a shotgun, or a screwdriver is a tool, and can be used by ‘good guys’, ‘bad guys’, ‘grey guys’, and ‘ugly guys’ — The tool doesn’t care. ‘Most guys’ leave traces other places; with some detective work, the necessary connections can be made. It just might take longer and more effort (track by sessions & cookies, track by putting an active tap on the machine, etc).

    ‘Most guys’ use screwdrivers to turn screws, pry open lids, that kindof thing… I don’t favor adding ‘a bunch of extra crap’ to make it hard to use the screwdriver to stab someone (yes, even though I’ve stabbed myself) — it always makes it worse at doing its usual job (driving screws). What’s worse is that the internet has a variety of uses (VOIP telephones, email, web, jokes), not just “one use” that “the man” wants it to have (eg, Hollywood would like it to be just like TV. The news people hate the idea of blogs. The phone companys are throwing hissy fits over VOIP saying “its just like a telephone” — but my VOIP does things like “get rid of telemarketers” and other things the phone ppl don’t want to do).

    Trying to mess with that fabric (like Earthlink & Network solutions) usually bungles it up (eg, if Earthlink makes a webpage with ads and suggestions when it can’t find a domain… what is my VOIP-telephone going to do with it?).

    I like my screwdrivers simple and my internet to work.

    Reply
  3. IT IS POSSIBLE AS A MATTER IN FACT I WAS THE FIRST ONE TO ISE ONE AT MY SCHOOL BUT IT DEPENDS WHAT DO YOU MEAN BY BAD GUYS IF IT IS SOMEONE THATS TRYING TO HURT PEOPLE WELL IT IS BAD BUT THERE GOTTA BE REASONS WHY TO BE BAD RIGHT??? THE QUESTION IS HARD TO ANSWER BUT LET THE PEOPLE THAT WANT TO ANONYMISE THEIR SURFING FIND IT NOT JUST LET IT HAPPEN FEEL ME??? THANX

    Reply
  4. Google web accelerator works like an in between site, does this in any way mask your IP address? It actually speeds up browsing. Sometimes by a significant amount.

    Reply
  5. Bad guys use more advanced features, they get into servers trough known bulnerabilities, and make tunnels trough it, after they do the job, they delete all logs.

    Free software to make you anonymus are not too effective.

    Reply
  6. I think Anonymous Web Surfing is important because no website needs to see my real IP address. A hackers first shot at someones PC is via their IP address which is literally the online “door” to their computer. If a site logs a “fake” IP address ,then that is good. One less thing to worry about. As far as services go, I like Ultimate Anonymity http://www.ultimate-anonymity.com as they have been around for a long time (1997 I think) and provide top notch support if needed. Very good tools for those interested in online privacy or anonymity.

    LN

    Reply
  7. I subscribed to Ultimate Anonymity about a week ago based on this article and am quite impressed to say the least. Any one of their U-brand softwares alone is worth the small price of admission. thanks for the heads up.

    Reply
  8. I went to the Anonymizer website and tried their product. When I got to the site, they showed me my IP number, my provider, my computer information, what city I lived in, the latitude and longitude of my HOUSE!!!! I went pale. I did try their product for a day, but it royally screwed up my computer and I had to restore a checkpoint because of it. But the information they had really scared me. Imagine what the ‘bad guys’ could get?

    Reply
  9. Is there any law that requires an ISP maintain any type of logs? What if a service were offered that guarantees that ALL logs, records, etc of usage were never kept and IP access at any time other than the present can not be traced. Think there is a market for that?

    Reply
  10. Reminds me of the iPod’s Google map showing the aproximate location based on the wireless router that it happens to see at any given time.

    Reply
  11. Bad guys can also utilise an anonymizer to hide whatever online information they want to hide, but we should not forget that it is our best defense against identity thief, most especially if we shop and enter our credit card information online.

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.