Completely Anonymous Internet Shopping -Cybur Netiks, 2008 -=cyburnetiks@gmail.com=- Introduction: We live in a world where the internet is king. It's become the primary communication carrier, entertainment and education hub, and even virtual shopping mall. But along with the convenience and vast resources granted by accessing the 'net, there is also the concern over the very real loss of privacy. Even if you use a false name and send an email from a false email address, the knowledgeable assailant can track down your physical location using your IP address (granted, they would need some level of cooperation from the ISP). Of course this can be defeated with proxies and programs such as tor, however, what about internet banking? No matter how secure and anonymous your computer system is, the money can always be tracked back to your bank account or credit card. The focus of this article will be on filling this security gap and further protect you from various villains bent on obtaining your information. Step 1: Planning Of course, like any endeavor, this requires a bit of planning. At this stage of the game, you found an online retailer and they have a product or service you wish to purchase, but for whatever reason you would like to remain anonymous in this transaction. The easiest thing to do would be to hop on paypal and fork over some cash, but this would erase all hope of anonymity, as with this method, at the very least, paypal, your bank, and the merchant would all see your information. So to go about this, you need to do some recon. The first thing you need to do here, is find out what kind of electronic payment methods they take. Pay special attention to credit cards and verious internet payment methods (such as paypal, paystone) and interac-based methods. Also check and see what various sources the internet payment methods can draw from. Make a note of all of these various sources, but the primary ones you will be looking at will be the credit cards, and large banks. After determining the various payment methods, look into each of the providers (credit card companies/banks) and see what sort of 'prepaid credit card' or 'gift credit cards' they offer. The gift ones are best as they are almost always not linked with your bank account, and you can buy them without too much scrutiny as to why you want an anonymous credit card. In my experiment I used a $100 'Visa MyTreat' Gift gard, Which is supposed to work exactly like a visa card, but only has $100 on it. I got it from a safeay customer service desk but you can get them alot of places. Mastercard offers one as well. UberParanoid tip: If you pay in cash, there is no way to track this back to you. Step 2: accounts The next thing your going to need, is your various accounts, You likely will need at least 2. The first one is almost invariably your email. For the email go with something extremely common and mainstream, something that no one will think twice about if they see it. Something such as hotmail, yahoo, gmail, etc. you can make up all sorts of details, you can find valid zip/postal codes by looking up the state/province on google. If you add a street address, Use something that looks real, but doesn't exist in whatever provice/city you've chosen. The email is definately the first thing to get because nearly all other web based services require it. If you are using a prepaid credit card directly, You can probably skip straight to making an account with whatever merchant you plan to buy from, If using an internet payment method, make an account with them first and then move on to the merchant. In my example I Made a hotmail account, and then made an ebay account UberParanoid tip: If you really feel someones out to get you, use an anonymous proxy, tor, or better yet, use one of the above from a public wifi hotspot or cybercafe. Most Internet services keep logs of all their activity, if nothing else to prevent spam, and a resourceful assailant may be able to obtain those records. Step 3: the purchase This part is relatively straightforward, simply log into your account on the merchant website, use whatever setup they have to specify your payment method, and shop away. In my example I made a few small Ebay purchases. Here shipping is the killer. UberParanoid tip: Once again, anonymous proxies, tor, and wifi hotspots are your friend. Step 4: shipping This is probably the hardest, and arguably most crucial, chink in the armour of all. If whatever you are buying is a physical object, It will need to be sent to you somehow, But if you have it shipped to your place of residence, you have Just given your address to anyone who wants to know so how to go about this? Well, if the option is available and pheasable, you could do local pickup. But, as is the case with internet shopping, this is a rarity. Another option is to get a P.O. box. P.O. boxes are fairly cheap, inconspicuous, and can be found damn near anywhere. The major con to this method is that most places are going to want some form of ID when you rent one of these boxes, so a good snoop could probably find out who leased the box at the time of the delivery. Another option is to have it shipped to an unnoccupied home. you could use an abandoned home, but the UPS or whatever employee who delivers it may question why the home is delapidated/boarded up/has 4 foot grass. Although most won't care, it's just their job to get it from point a to point b. The other option is homes for sale, This, while more reliable, is more risky as there will be people comming and going from time to time, and it is impossible to tell when the next batch of potential homeowners will show up. Of course, you can't be in the home to answer the door in either case, so give instructions to the shipping company. Tell them to use the back door (often, in the case of homes for sale, this door is used less), and if the package does not need to be signed for, just leave it on the back step. Of course, most packages need to be signed for, so most shipping companies will leave a card on the doorknob stating you were not home and saying where to pick it up. **WARNING: I believe signing a false name may be illegal, so I would advise against this unless you are uber paranoid. In my example, I was not concerned about anonymity very much, so I had the items shipped to a P.O. box. they were also small enough that they did not need to be signed for. UberParanoid tip: If you are completely insane/the mafia is out to get you/etc. you could potentially find someone to pick up the package for you, then deliver it to a specified location. You could probably even give some homeless guy or deadbeat teenager some cash to do the parcel run for you. extra: large purchases If you are wanting to make a large purchase (large monetarily wise) , but are unable to get a prepaid card in the needed quantity (the visa in my example was available in $200, $100, $50 and $25) You could potentially buy multiple of some card, and use a Paypal or similar account to sponge up the funds. A major warning though, completely draining 4 or more visas would probably throw up red flags over at paypal, so watch yourself. Extra: legitimate reasons for doing this Now while this all may seem kind of shady, there are legitimate uses for this type of system -Preventing Identity theft/Credit card fraud. This is taking a proactive preventative approach to protecting your identity and money in online banking. Your overall loss is limited to the ammount you have on the cards/in the account and since no real information is given, the potential con artist would have no way of coming after you later for more. -Stopping those "evil hackers" from obtaining your personal information. You see it all the time on the news, evil hackers do this, evil hackers do that. Fuck evil hackers, they got nothing on you with this method. -Protecting yourself from paypal fraud and bogus websites. Sometimes, when dealing with a newly formed company or various less than ethical organisations, it's nice to have just that added level of fraud prevention. They can only steal as much as you decide to put in. You maintain control of your money In my example, I was simply doing it to see how anonymous one could become when handling cash on the internet. the answe: completely. UberParanoid tip: if all else fails, law enforcement is not going to like the 'the government is out to get me' rationalle. Think of a better excuse. -Cybur Netiks, 2008.