- Messages
- 554
- Likes
- 43
- Points
- 980
In the digital age, anonymity has become a key aspect of personal security. It allows us to keep personal information private, protecting us from potential threats. However, like everything else in this world, anonymity has a downside: deanonymization. Today, I want to tell you how deanonymization works and why it's important for everyone to know.
The internet has long been sold to us as a space of freedom: close a tab, and it's as if nothing happened. But technology has its own, tenacious memory. Every action leaves a trace. Imagine wet footprints on the floor, carefully wiped clean, but they still show through under a certain light. Deanonymization is that very same sidelight: a set of methods and tools that, through indirect and direct evidence, link digital activity to a specific person.
This isn't just about investigative journalists or activists. We all carry devices with dozens of sensors and a constant internet connection in our pockets. We pay with cards, leave reviews, share photos, and simply scroll through the news. These harmless crumbs add up to a surprisingly coherent picture. The good news: understanding the principles of deanonymization helps reduce the risks. The bad news: absolute invisibility doesn't exist.
Deanonymization is the process of matching online activity with a real person. The source can be a single thing, such as a phone number, or a whole constellation of indirect indicators: login time, interface language, a rare device model, or common routes. The more signals, the stronger the connection.
It's important to distinguish between identifiers and indicators. An identifier is something that directly identifies you: a card number, an email address, a messenger account. An indicator is a piece of a puzzle: browser version, time zone, favorite keyboard layout. Individually, they are uninformative, but together they become quite revealing.
Deanonymization is carried out by advertising networks, providers, various platforms, researchers, fraudsters, and government agencies. The motives range from displaying "relevant ads" to investigating crimes. Technically, the tools are often the same.
There are many traces, and they lie at various levels—from network packets to writing style. At the device level, hardware identifiers, sensors, and firmware versions are visible. At the network level, IP addresses, DNS requests, and routes are visible. The browser provides cookies, local storage, a list of fonts, and rendering characteristics. Services store payments, logins, and contacts. The behavioral level is when, from where, and how we act.
It's useful to think in layers: if one layer leaks, the others should compensate, not fix it. For example, if you use a VPN to protect the network layer but continue to log into your personal account with old cookies at the browser level, you shouldn't be surprised by the coincidences.
At the browser level, the main tool is a fingerprint. Even without cookies, a website can collect dozens of parameters: screen size, font list, Canvas and audio rendering features, time zone, language, and hardware acceleration. This combination is rarely repeated among two random users, making the user recognizable.
Cookies and local storage enhance this effect: you are "remembered" from previous visits, even if you've changed your IP. Profile transfer between devices, bookmark syncing, and autofill are convenient, but from a privacy standpoint, they're additional tweaks. To check browser fingerprinting, there's the EFF's Cover Your Tracks service and sections on BrowserLeaks . Profile containers in Firefox, via Multi-Account Containers , help isolate different roles in a single browser.
On mobile devices, advertising identifiers (MAID), app telemetry, Bluetooth, and Wi-Fi signals are added. Passive beacons in shopping malls and transport hubs can map device paths. And app permissions for accessing geolocation and contacts are a whole other story. Finally, file metadata: a Word document or photograph often reveals unnecessary information—the owner's name, the editor version, the camera model, GPS coordinates. This is a classic source of quick deanonymization. To clean up metadata before publishing files, use the ExifTool utility .
Technology isn't everything. People are predictable: we log online at roughly the same time, use favorite turns of phrase, and make typos in similar patterns. These "little things" add up to a persistent profile. Linguistic analysis can match anonymous text to the author's known posts with alarming accuracy.
The OSINT (open-source intelligence) approach relies on a mosaic of crumbs: avatars, photo tags, rare hobbies, and friendships. Individually, nothing; together, an address, work, and social circle. This is especially easy on social media.
Almost every major service has experienced incidents: logins, password hashes, phone numbers, and addresses have leaked online. After the first leak, it's as if people take off their masks: old nicknames, backup emails, messaging app links—it all starts to connect.
Even if you're careful, you're not alone: leaks of friends' contacts, corporate databases, delivery and rewards card data—other people's mistakes can drag you down with them. It's helpful to regularly check whether your email has been exposed. For this purpose, there's Have I Been Pwned —a service that shows whether your data has been included in known leaks.
It would seem that addresses without names are a dream of privacy. In fact, public registries are perfect for analysis. Clusters are formed based on behavioral patterns and address "glues," and entry and exit points (identity-verified exchanges, payment gateways) connect addresses to individuals.
Transactions live forever, meaning any future incriminating evidence could expose even older transactions. Anonymity requires an unusual discipline, which most people simply don't need or can't handle.
Myth 1: "A VPN makes me invisible." Nope. It hides your traffic from your ISP and shows websites a different IP address, but it leaves a browser fingerprint, cookies, payments, and logins. Furthermore, much depends on the integrity and settings of the VPN provider.
Myth 2: "Incognito mode saves." Nope. It simply doesn't save your history locally. Websites, network administrators, and search engines continue to see you.
Myth 3: "Tor solves everything." Tor is a powerful tool, but bad habits (logging into personal accounts, plugins, documents with metadata) easily negate its effectiveness.
Myth 4: "No account, anonymous." This applies until the first correlation between time, language, and fingerprints is established.
Myth 5: "Deleted, gone." Copies and logs last longer than we expect.
First, see yourself through the websites' eyes. Start with a basic IP and DNS check. If you're using a proxy or VPN, make sure DNS requests are going through it and not directly. Also, check WebRTC: sometimes it returns local addresses and bypasses the tunnel.
Next, evaluate the uniqueness of your browser fingerprint. If a service says your profile is "rare," consider changing your settings or approach to managing profiles. To do this, use BrowserLeaks (for a detailed analysis of parameters), Cover Your Tracks (for comparison with typical profiles), DNS Leak Test , and Tor Check to check Tor's functionality.
You can't "protect yourself from everything." First, clearly define who exactly you want to hide what data from and why. Advertising networks? Your ISP and employer? Criminals? Government agencies? Each scenario requires a different set of measures.
Next, determine the adversary's resources: time, money, legal leverage. If you're defending yourself against ad tracking, browser hygiene is sufficient. If you're a journalist in an authoritarian country, a completely different level of discipline is required.
For sensitive tasks, use specialized tools. The Tor browser builds routes through several nodes and strictly averages parameters to help you blend in. There's also an approach to "masquerading as a regular user," such as Mullvad Browser , developed jointly by Mullvad VPN and the Tor Project with an emphasis on fingerprinting protection. For browsing, Firefox with containers , uBlock Origin , and Privacy Badger are good options . For the web, consider Tor ( official website ) for sensitive sessions and proven VPNs with no-logs policies and transparent policies. Among messengers, consider Signal , which blocks screenshots and hides your IP in calls. For files, use EXIF cleaning via ExifTool before publishing.
A VPN isn't magic, it's just another internet connection. Questions worth asking include: where the company is registered, what are its sources of income, have independent audits been published, how is DNS structured, and what about WebRTC and IPv6 leaks? Suspiciously cheap solutions are often monetized differently—guess how.
Don't forget about "gluing": if you log in to your old account through a VPN, the site will remember you even without your IP address. If you purchased a subscription with a card in your own name, the payment trail will link the account to that person. The more important privacy is, the fewer end-to-end connections there are.
Important: VPNs and proxies are tools, not indulgences. Using anonymization tools does not absolve you of responsibility for your online activities. Laws apply equally whether you hide your IP address or not. Moreover, in some countries, using a VPN to bypass blocks or conceal illegal activity can itself be a violation. Use these technologies responsibly and for legitimate purposes: protecting personal data, working safely on public networks, and accessing blocked content within the law.
Security policies are in place at work: corporate proxies, logs, telemetry agents. Even if you're confident, a device managed by the IT department is no place for personal anonymity. Separate devices and accounts.
At home, explain basic principles to children: don't forward documents and photos to strangers, don't install "free boosters," and carefully read app permissions. One innocent game can easily leak the entire family's contact list and geolocation.
Knowledge of deanonymization is not a license to "hunt" others. Don't violate other people's privacy or the laws of your country. The main point of this article is to learn to manage your data carefully and understand where exactly you leave a trace.
If you feel like no one cares about you, remember: data is the currency of the digital world. It is hoarded, resold, and analyzed. The less you "give away" by default, the better off you will be.
You don't have to go to extremes. A few simple habits can significantly reduce the "noise" around you and break up the direct connections between roles and devices.
Online anonymity isn't a sacred artifact, but a set of disciplines. Everything leaves its mark: your browser, your payments, your habits. Complete invisibility isn't possible, but reasonable hygiene can dramatically reduce the amount of data available to outsiders. Develop a threat model, eliminate unnecessary information, and separate roles—and many "magical" deanonymization methods will lose their effectiveness.
The key is curiosity and common sense. Know how systems see you and use this knowledge to your advantage. Then the internet will no longer be a one-sided mirror.
A quick start guide. These aren't "silver bullets," but rather handy aids in your daily privacy hygiene.
The internet has long been sold to us as a space of freedom: close a tab, and it's as if nothing happened. But technology has its own, tenacious memory. Every action leaves a trace. Imagine wet footprints on the floor, carefully wiped clean, but they still show through under a certain light. Deanonymization is that very same sidelight: a set of methods and tools that, through indirect and direct evidence, link digital activity to a specific person.
This isn't just about investigative journalists or activists. We all carry devices with dozens of sensors and a constant internet connection in our pockets. We pay with cards, leave reviews, share photos, and simply scroll through the news. These harmless crumbs add up to a surprisingly coherent picture. The good news: understanding the principles of deanonymization helps reduce the risks. The bad news: absolute invisibility doesn't exist.
Deanonymization is the process of matching online activity with a real person. The source can be a single thing, such as a phone number, or a whole constellation of indirect indicators: login time, interface language, a rare device model, or common routes. The more signals, the stronger the connection.
It's important to distinguish between identifiers and indicators. An identifier is something that directly identifies you: a card number, an email address, a messenger account. An indicator is a piece of a puzzle: browser version, time zone, favorite keyboard layout. Individually, they are uninformative, but together they become quite revealing.
Deanonymization is carried out by advertising networks, providers, various platforms, researchers, fraudsters, and government agencies. The motives range from displaying "relevant ads" to investigating crimes. Technically, the tools are often the same.
There are many traces, and they lie at various levels—from network packets to writing style. At the device level, hardware identifiers, sensors, and firmware versions are visible. At the network level, IP addresses, DNS requests, and routes are visible. The browser provides cookies, local storage, a list of fonts, and rendering characteristics. Services store payments, logins, and contacts. The behavioral level is when, from where, and how we act.
It's useful to think in layers: if one layer leaks, the others should compensate, not fix it. For example, if you use a VPN to protect the network layer but continue to log into your personal account with old cookies at the browser level, you shouldn't be surprised by the coincidences.
- Device: model, serial numbers, radio modules, sensors.
- Network: IP address, DNS, WebRTC leaks, latency.
- Browser: cookies, fingerprint, plugins, fonts, Canvas.
- Accounts and payments: mail, phone numbers, cards, subscriptions.
- Behavior: schedule, geography, writing style, vocabulary.
At the browser level, the main tool is a fingerprint. Even without cookies, a website can collect dozens of parameters: screen size, font list, Canvas and audio rendering features, time zone, language, and hardware acceleration. This combination is rarely repeated among two random users, making the user recognizable.
Cookies and local storage enhance this effect: you are "remembered" from previous visits, even if you've changed your IP. Profile transfer between devices, bookmark syncing, and autofill are convenient, but from a privacy standpoint, they're additional tweaks. To check browser fingerprinting, there's the EFF's Cover Your Tracks service and sections on BrowserLeaks . Profile containers in Firefox, via Multi-Account Containers , help isolate different roles in a single browser.
On mobile devices, advertising identifiers (MAID), app telemetry, Bluetooth, and Wi-Fi signals are added. Passive beacons in shopping malls and transport hubs can map device paths. And app permissions for accessing geolocation and contacts are a whole other story. Finally, file metadata: a Word document or photograph often reveals unnecessary information—the owner's name, the editor version, the camera model, GPS coordinates. This is a classic source of quick deanonymization. To clean up metadata before publishing files, use the ExifTool utility .
Technology isn't everything. People are predictable: we log online at roughly the same time, use favorite turns of phrase, and make typos in similar patterns. These "little things" add up to a persistent profile. Linguistic analysis can match anonymous text to the author's known posts with alarming accuracy.
The OSINT (open-source intelligence) approach relies on a mosaic of crumbs: avatars, photo tags, rare hobbies, and friendships. Individually, nothing; together, an address, work, and social circle. This is especially easy on social media.
Almost every major service has experienced incidents: logins, password hashes, phone numbers, and addresses have leaked online. After the first leak, it's as if people take off their masks: old nicknames, backup emails, messaging app links—it all starts to connect.
Even if you're careful, you're not alone: leaks of friends' contacts, corporate databases, delivery and rewards card data—other people's mistakes can drag you down with them. It's helpful to regularly check whether your email has been exposed. For this purpose, there's Have I Been Pwned —a service that shows whether your data has been included in known leaks.
It would seem that addresses without names are a dream of privacy. In fact, public registries are perfect for analysis. Clusters are formed based on behavioral patterns and address "glues," and entry and exit points (identity-verified exchanges, payment gateways) connect addresses to individuals.
Transactions live forever, meaning any future incriminating evidence could expose even older transactions. Anonymity requires an unusual discipline, which most people simply don't need or can't handle.
Myth 1: "A VPN makes me invisible." Nope. It hides your traffic from your ISP and shows websites a different IP address, but it leaves a browser fingerprint, cookies, payments, and logins. Furthermore, much depends on the integrity and settings of the VPN provider.
Myth 2: "Incognito mode saves." Nope. It simply doesn't save your history locally. Websites, network administrators, and search engines continue to see you.
Myth 3: "Tor solves everything." Tor is a powerful tool, but bad habits (logging into personal accounts, plugins, documents with metadata) easily negate its effectiveness.
Myth 4: "No account, anonymous." This applies until the first correlation between time, language, and fingerprints is established.
Myth 5: "Deleted, gone." Copies and logs last longer than we expect.
First, see yourself through the websites' eyes. Start with a basic IP and DNS check. If you're using a proxy or VPN, make sure DNS requests are going through it and not directly. Also, check WebRTC: sometimes it returns local addresses and bypasses the tunnel.
Next, evaluate the uniqueness of your browser fingerprint. If a service says your profile is "rare," consider changing your settings or approach to managing profiles. To do this, use BrowserLeaks (for a detailed analysis of parameters), Cover Your Tracks (for comparison with typical profiles), DNS Leak Test , and Tor Check to check Tor's functionality.
You can't "protect yourself from everything." First, clearly define who exactly you want to hide what data from and why. Advertising networks? Your ISP and employer? Criminals? Government agencies? Each scenario requires a different set of measures.
Next, determine the adversary's resources: time, money, legal leverage. If you're defending yourself against ad tracking, browser hygiene is sufficient. If you're a journalist in an authoritarian country, a completely different level of discipline is required.
- Consumer level: tracker blockers, profile isolation, be careful with app permissions.
- Advanced: separate devices for different roles, Tor for sensitive tasks, minimizing payment traces.
- Critical: surgical hygiene, cool head, independent communication channels, specialist consultations.
For sensitive tasks, use specialized tools. The Tor browser builds routes through several nodes and strictly averages parameters to help you blend in. There's also an approach to "masquerading as a regular user," such as Mullvad Browser , developed jointly by Mullvad VPN and the Tor Project with an emphasis on fingerprinting protection. For browsing, Firefox with containers , uBlock Origin , and Privacy Badger are good options . For the web, consider Tor ( official website ) for sensitive sessions and proven VPNs with no-logs policies and transparent policies. Among messengers, consider Signal , which blocks screenshots and hides your IP in calls. For files, use EXIF cleaning via ExifTool before publishing.
A VPN isn't magic, it's just another internet connection. Questions worth asking include: where the company is registered, what are its sources of income, have independent audits been published, how is DNS structured, and what about WebRTC and IPv6 leaks? Suspiciously cheap solutions are often monetized differently—guess how.
Don't forget about "gluing": if you log in to your old account through a VPN, the site will remember you even without your IP address. If you purchased a subscription with a card in your own name, the payment trail will link the account to that person. The more important privacy is, the fewer end-to-end connections there are.
Important: VPNs and proxies are tools, not indulgences. Using anonymization tools does not absolve you of responsibility for your online activities. Laws apply equally whether you hide your IP address or not. Moreover, in some countries, using a VPN to bypass blocks or conceal illegal activity can itself be a violation. Use these technologies responsibly and for legitimate purposes: protecting personal data, working safely on public networks, and accessing blocked content within the law.
Security policies are in place at work: corporate proxies, logs, telemetry agents. Even if you're confident, a device managed by the IT department is no place for personal anonymity. Separate devices and accounts.
At home, explain basic principles to children: don't forward documents and photos to strangers, don't install "free boosters," and carefully read app permissions. One innocent game can easily leak the entire family's contact list and geolocation.
Knowledge of deanonymization is not a license to "hunt" others. Don't violate other people's privacy or the laws of your country. The main point of this article is to learn to manage your data carefully and understand where exactly you leave a trace.
If you feel like no one cares about you, remember: data is the currency of the digital world. It is hoarded, resold, and analyzed. The less you "give away" by default, the better off you will be.
You don't have to go to extremes. A few simple habits can significantly reduce the "noise" around you and break up the direct connections between roles and devices.
- Separate browsers or profiles by roles: work, personal, sensitive.
- Use tracker blockers and site containers.
- Check for DNS and WebRTC leaks after any network changes.
- Don't log into personal accounts through the same profiles where you want privacy.
- Clean metadata from photos and documents before publishing.
- Check your email for leaks via HIBP and change your passwords.
- Disable unnecessary permissions for apps, especially geolocation.
Online anonymity isn't a sacred artifact, but a set of disciplines. Everything leaves its mark: your browser, your payments, your habits. Complete invisibility isn't possible, but reasonable hygiene can dramatically reduce the amount of data available to outsiders. Develop a threat model, eliminate unnecessary information, and separate roles—and many "magical" deanonymization methods will lose their effectiveness.
The key is curiosity and common sense. Know how systems see you and use this knowledge to your advantage. Then the internet will no longer be a one-sided mirror.
A quick start guide. These aren't "silver bullets," but rather handy aids in your daily privacy hygiene.
- uBlock Origin and Privacy Badger — block tracking.
- BrowserLeaks and Cover Your Tracks - fingerprint verification.
- DNS Leak Test — DNS leak test.
- Have I Been Pwned - Check for leaked credentials.
- ExifTool - metadata cleaning.
- Signal is a privacy-focused messenger.
- Shodan and Censys - to understand "what is visible" about your devices from the outside.