How to Create a Convincing Persona to Hide Your Identity Online
Peter Steiner’s cartoon “On the internet, nobody knows you’re a dog” is The New Yorker’s most reprinted drawing since they first published it in 1993.
Forget the expertly illustrated political sketches, cutting cartoons, and lampoons of Americana — what has appealed most to readers and meme recyclers for the last 30 years has been the concept of online anonymity.
Sure, this cartoon is a visually entertaining piece of artwork — a dog sitting on a swivel chair and operating a computer while talking to another dog is delightfully absurd. But the sketch captured an essential truth about online communications, even back in the internet’s infancy.
When you encounter someone online, you have no idea if the person whose posts you’re reading is actually who they appear to be.
For example, click on my byline above this article, and you’ll see a picture of a White guy with a shaved head and a scruffy beard who appears to be in his early 40s. You’ll also see a name: David Rutland.
Search for me on Google, and you may find some scraps of this identity here and there… but is that really who I am?
There are some biographical details scattered online, and you’ll find my name on other tech sites and various social media outlets, but that’s no guarantee of anything. In the decade or so I’ve been a freelance writer, never once have I been asked to confirm my identity.
I’m on the internet, and nobody knows I’m a dog.
Trust is a Rare Commodity Online (But Not Rare Enough)
The need for identity verification is older than the internet — a lot older. Confidence tricksters have been operating since at least as early as the 19th century, telling tall tales and using false identities to defraud their victims of money, dignity, and livelihood.
One of the earliest known examples is the Spanish Prisoner Swindle, which saw fraudsters posing as wrongfully imprisoned gentlemen promising vast rewards in return for a little cash up front to help secure their release. Later variations included the well-known “Nigerian prince”, who promised six-figure cash gifts in exchange for help to get a huge sum of money out of his country.
I remember one time being contacted by a person purporting to be Bill Gates (of Microsoft), intent on distributing his wealth to the poor and deserving but requiring the recipients to cough up a “transfer fee” of a few tens of dollars. I obviously didn’t fall for it, but I don’t doubt that some poor sucker lost their rent money to this imposter.
Every year we read of lonely people who fall in love online and end up parting with their retirement funds to help the career of their long distance lover — who many times don’t even exist. The victim is left lonely, poor, and ashamed.
Scammers can pose as family members, IRS officials, or even representatives for well-known companies, and the perpetrators who carry out the scams can be anybody — even someone the victim knows in real life.
Consequences of this anonymity are often dire. Catfishing doesn’t only lead to financial losses and embarrassment, but it has also been linked to cases of blackmail, murder, and an alarming number of suicides.
Fake identities are often used for malicious purposes, and it’s not surprising that few people are willing to take a supposed identity at face value.
Identity and The Need For Privacy
The flip side of this is that the more information information is known about you, the more vulnerable you are — not only to catfishing, but also to identity theft, doxxing, swatting, and other real-life dangers.
Few people are careful with the information they post online. One afternoon’s worth of searching can easily reveal an individual’s mother’s maiden name (Hi Uncle Dave!), the name of their first pet, what schools they went to, and probably even the street they grew up on.
An enticing email with an innocuous-looking link delivered at the right time of day can trick someone into revealing their home IP address, which will often reveal the area where they live — sometimes to within a few streets.
With enough of this kind of information, you can steal someone’s life. It’s serious business, and any sensible person would go to some effort to leave as little personally identifying information online as possible.
Aside from the risks to your bank account and mental health, there are plenty of other reasons to create and maintain a separate online persona. For instance, you may want to keep your professional life completely divorced from your private life, or at least certain aspects of it.
In addition to my work with PIA, I maintain a fistful of websites around the internet, covering vastly different areas irrelevant to my activities here. I don’t want them to be connected to my real identity, and I don’t want them linked to each other. At the same time, they need the credibility of a genuine author with a byline, photograph, and enough ancillary detail to convince readers they’re reading the views of an authoritative writer (which, of course, I am).
Other people may prefer to maintain privacy for the sake of it, with the attitude that “it’s nobody’s business who I am”.
These are all valid reasons for constructing an online persona (or three or four). Here’s how to go about it.
Constructing a Persona
In the image above, there are six portraits. Among them are a bank teller, an anthropologist, three children, and a PhD psychology student. Their ethnic backgrounds are diverse, and they hail from five different continents.
They have only one thing in common — they don’t exist.
The individuals pictured above have never existed. They were generated by This Person Does Not Exist, which uses a kind of machine learning known as a Generative Adversarial Network (GAN).
How Does it Work?
A GAN, in its simplest terms, is a pair of neural networks engaged in a zero-sum game, meaning one network’s gain is the other’s loss. The networks are “adversaries”. One network creates new data from analyzing and reproducing patterns identified within an existing dataset, and the other tries to guess whether the new data is real or was created by its adversary.
In this instance, the GAN’s neural networks are trained to recognize images from a set of pictures.
You know how you occasionally need to click on fire hydrants or cats in CAPTCHAs? That’s one of the ways in which datasets of images are generated.
Another way is to get people to click on photos of themselves and their friends, which creates data that neural networks can use to learn what a face is supposed to look like.
A common analogy is that the generator and discriminator are like the counterfeiter producing forged banknotes and the cop who detects them, respectively.
Both counterfeiter and cop are learning from their mistakes — and each side comes to learn the other’s methods in a constant escalation.
As time goes on, and millions of images are detected as fake or real, the discriminator gets better at working out the image’s origin, while the generator improves the quality of the fakes.
Eventually, the “adversaries” reach a point where the produced images are indistinguishable from the real thing.
Can I Create My Own Generative Adversarial Network?
Maybe. I certainly couldn’t. Training an AI to produce realistic looking faces takes a tremendous amount of computing power in the form of high-end graphics cards and a lot of memory. Developers of styleGAN — the software used by thispersondoesnotexist.com — recommend the “NVIDIA DGX-1 with 8 Tesla V100 GPUs”. At the time of writing, Nvidia is offering a 25% discount — bringing the cost down to a mere $49,900.
If you don’t have that kind of cash in your pants pocket, you may be able to get away with “One or more high-end NVIDIA GPUs with at least 11GB of DRAM”. I tried out the software on my trusty GTX 1050 with 3GB RAM, and it failed hard — with fans in overdrive and dangerously high temperatures.
Should you happen to have a spare crypto mining rig laying about, styleGAN can be run on either Linux or Windows machines — although Linux is preferred. Be warned though, the training may take several weeks to complete, even if you have high-powered machines at your disposal.
The easiest way for you to generate a face never before seen in the history of the world is to visit This Person Does Not Exist. The website generates a new face every time you visit or refresh the page. There you go. That’s your new head shot.
Ancillary Details Make Your Persona More Real
A fake face is a good start to hiding your real identity behind a made-up persona, but it’s only part of the picture. The more details you can add, the more convincing your fake persona will be, making it less likely that your real identity will be uncovered.
You Need a Web Presence
A real person leaves traces of themselves around the internet. Sometimes, it’s in the form of comments on blogs, and more often, it’s social media.
However, setting up a phony social media profile is out of the question because there is nothing quite as suspect as a freshly minted account with no friends and only one picture. If anything, it will make your new persona even less convincing.
Websites directly under your control are a different matter entirely. With your own website (or websites), you can flesh out the legend and bring your persona to life. One of my own websites, davidrutland.com, is a great example. It contains dated posts going back for nine months, book reviews for the same period, a number of links, various documents, and two pictures of my face but only one actual photograph — a blurry black-and-white shot taken from a magazine. It could be anyone.
A number of my other websites link back to davidrutland.com, and you may notice that the site is enrolled in a number of clubs and webrings, which despite this being the cusp of 2022, are still a thing.
Google my name and you’ll find my site on the front page. That might not be enough for instant trust, but it does add validity to my claim that I am who I say I am.
You can easily create your own website inside of a day. Domain names are cheap, and you can get free, no-strings-attached static hosting from GitHub Pages. And always remember, the dates for post entries are something that you can easily set yourself.
A Real Bank Account For a Non-existent Person
In most of the world, including the US, it’s illegal — and virtually impossible — to open a bank account using a fake name. It’s fraud, and at no point would I suggest anyone do such a thing. (Disclaimer: Forging a persona for the sake of financial deception is a felony, and you will get caught.)
But you can open a business account with whatever name you choose — even if you don’t have a business. You’ll need to prove your identity to the bank first, and normally, you will need to have a checking account with them, but then it’s usually a trivial matter to open a business account with the name of your ‘business’ on it.
If you choose to call your business account “Joe Bloggs”, you’ll have a bank card with Joe Bloggs emblazoned across the front, those payments will show on the recipients’ statement as coming from Joe Bloggs, and if people wire money to your account number with Joe Bloggs as the name of the recipient, it will appear in your account.
Hide Your Location
You knew this part was coming — PIA is a VPN company after all. So it needs to be mentioned that one of the quickest ways a persona can fall apart is for it to be traceable to your IP address.
Let’s say you’ve built up an identity as a furniture restoration expert in an Alaskan fishing village. And it’s utterly convincing. Any photos (apart from the headshot that GAN generated) are taken from behind as you work on your lathe. You’ve even joined various trade associations to add to the illusion, and you proudly list those affiliations on your site.
But you’re communicating from a location with an IP address shows that you are actually located in Texas, where you make your living as an itinerant blues guitarist. This is where things start to crumble…
It’s actually pretty easy to find out someone’s IP address. Every website you visit has a log with your IP address attached to your site activity, and your IP address is often found in the metadata that gets sent with your emails (depending on how you send emails). Website owners are capable of seeing and logging the IP addresses of everyone that visits their site. And finding out an approximate physical location of an IP address is as simple as visiting search.censys.io and typing it into the search box. If you live in a sparsely populated area, it’s sometimes possible to pin down your location with a shocking degree of precision.
By using a VPN, all of your internet traffic passes through a VPN server in a different location — one which you choose. Any website you visit will log the VPN’s IP address address rather than yours, and if your email provider includes sender IP in the email metadata, that will be the VPN’s IP, too.
It’s Difficult to Tell When You’re Dealing with a Fake
Nobody likes being fooled, and these techniques can be used to by bad actors and criminals with the aim of defrauding you — although usually, they’ll simply hijack someone’s social media accounts or directly steal data.
But if you’re like most regular people, all you want is to be left alone to conduct your internet affairs while minimizing the chances of someone spying on you.
Machine learning isn’t perfect, and certain aspects of generated photographs are often subtly wrong in the details. The eyes, nose, and mouth may be perfect, but what about the ears? Are there any items of jewelry which just look… wrong?
The person in the image above looks like he might exist, but look closer and you’ll see that the earring hooks are dangling below his ears — they aren’t attached. They are wrong. And take a look at the shoulders — there’s definitely something not quite right there. A neural net might not see anything wrong, but a careful human being can.
My personal website looks real because I am a real human being and my name is David Rutland; my other online presences also look real and have the same level of detail, but they are fake. And it’s hard to tell.
Ultimately it comes down to being able to pick up details — such as floating earrings and the suspiciousness of having only one front-facing photograph.
But you can never, ever be sure.
