{"id":655,"date":"2015-02-18T20:12:43","date_gmt":"2015-02-18T20:12:43","guid":{"rendered":"https:\/\/amerares.com\/blogs\/?p=147"},"modified":"2023-10-11T04:20:53","modified_gmt":"2023-10-11T09:20:53","slug":"confcommblog-147","status":"publish","type":"post","link":"https:\/\/amerares.com\/blogs\/confcommblog-147\/","title":{"rendered":"Digital Identity and Metadata"},"content":{"rendered":"<div id=\"pl-655\"  class=\"panel-layout\" >\n<div id=\"pg-655-0\"  class=\"panel-grid panel-no-style\" >\n<div id=\"pgc-655-0-0\"  class=\"panel-grid-cell panel-grid-cell-empty\"  data-weight=\"0.10018073844565\" ><\/div>\n<div id=\"pgc-655-0-1\"  class=\"panel-grid-cell panel-grid-cell-mobile-last\"  data-weight=\"0.7996385231087\" >\n<div id=\"panel-655-0-1-0\" class=\"so-panel widget widget_black-studio-tinymce widget_black_studio_tinymce panel-first-child panel-last-child\" data-index=\"0\" data-style=\"{&quot;padding&quot;:&quot;5px&quot;,&quot;background_image_attachment&quot;:false,&quot;background_display&quot;:&quot;tile&quot;}\" >\n<div class=\"panel-widget-style panel-widget-style-for-655-0-1-0\" >\n<div class=\"textwidget\">\n<h3><strong>\u00a0<em>The fight to stay anonymous<\/em><\/strong><\/h3>\n<div class=\"WordSection1\">\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">People by nature want to keep certain aspects of their life private, anonymous; others because their jobs require to stay anonymous and others because what they are doing could lead to repercussions in their professional and personal lives. The funny thing is that most people think that just because they are seated in front of a computer, it automatically grants them anonymity, and that is far from the truth. In this article I will try to explain some issues that any person using the Internet should be aware in order to look for mechanisms to help maintain his\/her anonymity.<\/h4>\n<h3 class=\"MsoNormal\" style=\"text-align: justify;\"><strong><em>Digital identity<\/em><\/strong><\/h3>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">The first issue is our digital identity; this is formed by our usernames, email addresses, and accounts across<br \/> the Internet. Given the impressive power of search engines such as Google one should pay more attention of our digital identity and how we use it.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">When was the last time you posted\/sent\/signed in with your email account? All those logins, accounts, etc usually are linked to an email and they become a trail pointing back in your direction and if you add to all this the use of social networks, well, let me tell you that the person behind the keyboard is no longer anonymous as he\/she once thought. In fact a skillful adversary with enough resources will be able to identify a user including a nice photo from his last birthday party that was posted on Facebook.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">If you are planning to achieve certain degree of anonymity, the first step is to <b>create a second virtual id<\/b>, one that is going to be <b><i>used only for those activities that will require anonymity<\/i><\/b>.\u00a0 [Editor\u2019s note: a virtual ID is one form of <b>alias<\/b> or <b>pseudonym<\/b>. We will have a separate post on the history of aliases, pen names, handles, and similar concepts.]<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">It is important not to mix both identities. Sounds simple but human beings are lazy so you need to think like a<br \/> super hero, you have two IDs, one that is being used for your everyday activities and the other one that for that activity that requires you to maintain anonymity.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Now <b>having two IDs is not enough to maintain anonymity<\/b>, but is the first step; in reality to maintain anonymity you will require several technical and procedural measures in order to avoid being tracked or at least make it very difficult for a potential adversary.\u00a0 Some of the measures that you will need to maintain anonymity are:<\/h4>\n<ul>\n<li>\n<h4>Changing as much as possible your physical location to access the Internet<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Using software that improve anonymity such as TOR<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Use of encryption and secure communications channels<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Become a little bit paranoid.<\/h4>\n<\/li>\n<\/ul>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Also your chances will improve if you understand that <b>there is no 100% guarantee<\/b> that you will maintain anonymity and in order to decrease the risk of being identified the use of several technologies is recommended.\u00a0 In security this concept of layers of several security mechanisms is known as <b>defense in depth<\/b> and should be something you must look for.<\/h4>\n<h3 class=\"MsoNormal\" style=\"text-align: justify;\"><strong><em>Metadata<\/em><\/strong><\/h3>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Metadata is defined as \u201c<b><i>Data that provides information about other data<\/i><\/b>\u201d (Merriam-Webster.com). All our technological wonders that we use in our daily lives have embedded plenty of metadata. A photo taken from your smart phone, a Word file report, the email you send to exchange greetings with friend; all of them have these tiny bits of information that could allow an attacker to track you and pinpoint your identity.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">The following is a clear example regarding metadata that will help enlighten you about what kind of information about yourself could be revealed without you being aware. Photos in jpg format like the ones taken with the camera of a smart phone stores its metadata in a standard format known as <b>exif<\/b> (exchangeable image file format) and can contain the following information:<\/h4>\n<ul>\n<li>\n<h4>Date and time when the picture was taken<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>GPS data: if the device has this future active it will add this information in the image, with the current trend with social media apps usually this feature is on and most users are not aware or don\u2019t mind<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Make and model of the device: An attacker could use this info to prepare a more specific attack and try to gain access of your device either remotely or physically<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Serial number of the device: Allows identifying a particular camera or Smartphone<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Image Unique ID string for each picture: The string allows a resourceful investigator to link the photo to a specific camera or Smartphone<\/h4>\n<\/li>\n<\/ul>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Some tools that you could use to check the exif information in an image are <a href=\"http:\/\/www.imageforensic.org\/\">http:\/\/www.imageforensic.org\/ <\/a>and Jeffrey&#8217;s Exif Viewer at <a href=\"http:\/\/regex.info\/exif.cgi\">http:\/\/regex.info\/exif.cgi <\/a>both offer a very simple interface and will let you see what kind of information that images\u00a0 has about you, your location or device that was used to take the picture. The following picture shows what imageforensic.org online tool will reveal:<\/h4>\n<p class=\"MsoNormal\" style=\"text-align: center;\" align=\"center\"><!-- [if gte vml 1]&gt;--><\/p>\n<p><img decoding=\"async\" class=\" aligncenter\" src=\"https:\/\/amerares.com\/blogs\/wp-content\/uploads\/2015\/02\/exif-image-for-anon-post.png\" alt=\"exif\" \/><\/p>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Now, the example shows what metadata is embedded in a photograph taken with a Smartphone, but that is not the only source of metadata. Almost all applications running in a computer or the Internet creates metadata and add it to our files. For example:<\/h4>\n<ul>\n<li>\n<h4>Office applications can embed metadata in any document about the author that could reveal his identity, when was created, if it was modified and in some cases the changes the document have<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Image manipulation software also could include metadata with our location (i.e. Photoshop)<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Most email clients include metadata in all the emails we send that could include our IP address, computer information and in some cases the real identity of the user.<\/h4>\n<\/li>\n<\/ul>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">So in order to maintain anonymity <b>a user must sanitize the information he\/she plans to share<\/b> to avoid giving up information that could be harmful in the future. There are several tools available in the Internet that will help in removing personal or identifiable information from a file. Keep in mind that most tools specialize in only one type of file (images, Office, Documents, PDF files, etc) so it\u2019s impossible in a brief space to discuss all of them. In the case of images tools such as Batch Purifier LTE (<a href=\"http:\/\/www.digitalconfidence.com\/downloads.html\">http:\/\/www.digitalconfidence.com\/downloads.html<\/a>) and JPEG and PNG Stripper (<a href=\"http:\/\/www.steelbytes.com\/?mid=30\">http:\/\/www.steelbytes.com\/?mid=30<\/a>) are free and very easy to use in order to remove metadata from images.<\/h4>\n<h3 class=\"MsoNormal\"><strong><em>Web Beacons\/Web Bugs<\/em><\/strong><\/h3>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">Web Beacon is a method that goes by several different name such as \u201cweb bug\u201d, \u201cpixel tag\u201d, \u201cclear GIF\u201d, \u201cinvisible GIF\u201d originally designed to pass information from the user\u2019s computer to a third party web site while the user navigates thru a web page. Now this kind of technology allows several other uses, such as tracking <b>when a user has opened a document or an email<\/b>. Usually a web bug is <b>a one pixel transparent image<\/b> object (GIF is the most common format) that is defined by HTML code and that code to a specific site.\u00a0 In order to see web bugs and other tracking methods in action the user can install a plug-in called <span class=\"SpellE\"><b>Ghostery<\/b><\/span> (<a href=\"https:\/\/www.ghostery.com\/en\/download\">https:\/\/www.ghostery.com\/en\/download<\/a>) available for most browsers. Once configured you will receive a small pop-up that indicates who is trying to track you, and it\u2019s amazing the number of trackers some web sites have.<\/h4>\n<h4 class=\"MsoNormal\">The following screen shoot shows Ghostery in action:<\/h4>\n<p class=\"MsoNormal\" style=\"text-align: center;\" align=\"center\"><!-- [if gte vml 1]&gt;--><\/p>\n<p><img decoding=\"async\" class=\" aligncenter\" src=\"https:\/\/amerares.com\/blogs\/wp-content\/uploads\/2015\/02\/Ghostery-image-for-anon-post.png\" alt=\"Ghostery\" \/><\/p>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">In the screen shot we can observe <span class=\"SpellE\">Ghostery<\/span> is displaying the websites trying to track you the moment you visit <a href=\"http:\/\/www.amazon.com\">www.amazon.com<\/a>. <span class=\"SpellE\">Ghostery<\/span> has the option to block the websites trying to use any of the following devices for tracking:<\/h4>\n<ul>\n<li>\n<h4>Analytics Object<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>&lt;Beacons<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Cookies<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Widgets<\/h4>\n<\/li>\n<\/ul>\n<ul>\n<li>\n<h4>Advertising objects<\/h4>\n<\/li>\n<\/ul>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\"><span class=\"SpellE\">Ghostery <\/span>has a database that is constantly updated improving the blocking of the tracking objects that a web page might contain, but is not 100% effective. Unfortunately Web beacons and related technologies such as cookies, scripting languages, etc. <span class=\"GramE\">makes<\/span> it very difficult to maintain your anonymity.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">A good defense against Web beacons and similar technologies is the use of several mechanisms (remember defense in depth?), such as <b>TOR<\/b> (<a href=\"https:\/\/www.torproject.org\/\">https:\/\/www.torproject.org\/<\/a>), use of specialized environments optimized for secure operations like <b>Tails<\/b> (<a href=\"https:\/\/tails.boum.org\/\">https:\/\/tails.boum.org\/<\/a>), secure communications and encryption (<a href=\"https:\/\/www.gnupg.org\/\">https:\/\/www.gnupg.org\/<\/a>), opening attachments or documents in an isolated machine not connected to any network (\u201cair gap\u201d) and finally taking into consideration the points discussed about your digital identity and metadata.<\/h4>\n<h4 class=\"MsoNormal\" style=\"text-align: justify;\">I hope this article serve to open your eyes and become aware of what is required to attain true anonymity so, the next time you login, open, send, or browse something in the internet ask yourself this: \u201cWhat information about myself I\u2019m revealing without knowing?\u201d<\/h4>\n<\/div>\n<h4>\u00a0<\/h4>\n<p>\u00a0<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"pgc-655-0-2\"  class=\"panel-grid-cell panel-grid-cell-empty\"  data-weight=\"0.10018073844565\" ><\/div>\n<\/div>\n<\/div>\n<style type=\"text\/css\" class=\"panels-style\" data-panels-style-for-post=\"655\">@import url(https:\/\/amerares.com\/blogs\/wp-content\/plugins\/siteorigin-panels\/css\/front-flex.min.css); #pgc-655-0-0 , #pgc-655-0-2 { width:10.0181%;width:calc(10.0181% - ( 0.89981926155435 * 30px ) ) } #pgc-655-0-1 { width:79.9639%;width:calc(79.9639% - ( 0.2003614768913 * 30px ) ) } #pl-655 .so-panel { margin-bottom:35px } #pl-655 .so-panel:last-of-type { margin-bottom:0px } #panel-655-0-1-0> .panel-widget-style { padding:5px } @media (max-width:1024px) and (min-width:781px) { #pg-655-0.panel-no-style, #pg-655-0.panel-has-style > .panel-row-style { -ms-flex-wrap:wrap;-webkit-flex-wrap:wrap;flex-wrap:wrap } #pg-655-0 > .panel-grid-cell , #pg-655-0 > .panel-row-style > .panel-grid-cell { -ms-flex:0 1 50%;-webkit-flex:0 1 50%;flex:0 1 50%;margin-right:0;margin-bottom:35px } #pg-655-0 > .panel-grid-cell , #pg-655-0 > .panel-row-style > .panel-grid-cell:nth-child(even) { padding-left:15px } #pg-655-0 > .panel-grid-cell , #pg-655-0 > .panel-row-style > .panel-grid-cell:nth-child(odd) { padding-right:15px }  } @media (max-width:780px){ #pg-655-0.panel-no-style, #pg-655-0.panel-has-style > .panel-row-style, #pg-655-0 { -webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column } #pg-655-0 > .panel-grid-cell , #pg-655-0 > .panel-row-style > .panel-grid-cell { width:100%;margin-right:0 } #pgc-655-0-0 , #pgc-655-0-1 { margin-bottom:35px } #pl-655 .panel-grid-cell { padding:0 } #pl-655 .panel-grid .panel-grid-cell-empty { display:none } #pl-655 .panel-grid .panel-grid-cell-mobile-last { margin-bottom:0px }  } <\/style>\n","protected":false},"excerpt":{"rendered":"<p>\u00a0The fight to stay anonymous People by nature want to keep certain aspects of their life private, anonymous; others because their jobs require to stay anonymous and others because what they are doing could lead to repercussions in their professional and personal lives. The funny thing is that most people think that just because they [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":556,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,8],"tags":[],"_links":{"self":[{"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/posts\/655"}],"collection":[{"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/comments?post=655"}],"version-history":[{"count":1,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/posts\/655\/revisions"}],"predecessor-version":[{"id":663,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/posts\/655\/revisions\/663"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/media\/556"}],"wp:attachment":[{"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/media?parent=655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/categories?post=655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/amerares.com\/blogs\/wp-json\/wp\/v2\/tags?post=655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}