Why PIA Is Not Enough to Protect Your Real IP Address

ebikesrc

I am the victim of extreme criminal abuse that involved somehow spoofing my real IP address by using it "remotely" [by remote control or by other means] to commit serious crimes, and, also, it was done to avoid being traced back to the real criminal hacker's IP address that committed these Federal crimes. Had my real IP address remained truly hidden from this criminal attack, then I would not be facing this kind of "nightmare attack" and be involved in a criminal investigation too. This happened in February 2015.

I was using at the time a free "volunteer service" of VPN servers that was also attempting to protect my IP too. It was not 100% effective, because the VPN servers were part of a volunteer effort and you could be dropped off the server without being reconnected securely onto another VPN server.

I have no idea exactly how I was hacked, BUT I believe it was very possibly done by someone that is connected to a Forum where I participated. I think this criminal had access to the Forum software for that website either directly [as a moderator] or indirectly, so they could obtain my real IP address information and use it to commit these serious crimes. The reason I believe this is the source of these criminal acts is that I was only back online for a very short time with a new Internet ISP, and I was posting constantly just at this one Forum when these crimes happened. I'm not going to get into the details about this criminal case here, but let's just say you NEVER want to be put at risk for such criminal abuse. Never!

After getting PIA installed and working I thought I would check-out the Forum here to learn more about the service, etc. I came across the recent thread about WebRTC that can bypass the PIA VPN/IP protection to reveal your real IP address to someone using this method. That thread is here:  How to Stop WebRTC Local IP Address Leaks on Google Chrome and Mozilla Firefox While Using Private I

What that thread reveals to me is that there are also more 'knowable threats' out there now too. So called "legit scripts" or known programming that is usually getting your IP info for the weather or to give directions, but then it could be used deceptively as malware too to reveal your IP info by using these "accepted" location programming methods too. That is NOT an unknown.

I suggested some organization should be tracking what these scripting IP reveal "programs" can do. PIA or some VPN group or EFF.org or ???

OmniNegro Wrote:

Are you even remotely aware just how many things we would have to list to cover even 1% of the threats out there? If I started right now, and managed to document one every second, it would be a hundred years of non stop work to cover the problems that exist right now, and more are made/discovered each day.

Your best bet is to use the user contributed plugins that minimize the problems that are known. Ghostery, Ad-Block Edge, NoScript, RequestPolicy,  and Privacy Badger are together a good start for Firefox. They cover a great many of these problems. But as I implied, there is no perfect solution.

Disable Geolocation too. It is enabled by default in every browser I am aware of. But it is easily disabled in Firefox. Your search engine of choice will tell you how to do it. Be certain to check that geolocation is still disabled every once in a while. It does turn itself back on from time to time. (Usually after an update.)

My follow-up to those excellent suggestions "just above" from OmniNegro are as follows:

You do understand I'm limiting my concept to legit scripting or programming tools [add-ons] that can give away one's IP as a "reveal" bypassing the encryption and VPN/IP "protections" ? These would be produced by companies like Google, Microsoft, Apple, and all the other legit supplier software companies that develop for their OS's.

So, OmniNegro, are you saying 'just' that one type of threat ->the IP reveal<- is "impossible" to keep-up with? Certainly this type of IP "reveal" threat is not nearly as complicated as tracking the thousands of existing virus's and trying to eliminate these from a target computer. Imo.

For PIA to be a useful tool it should be ensuring that your IP remains anonymous as "job one", and that won't mean "jack" if your IP is easily obtained by other means that websites can use to probe your browser for that IP info simply bypassing what PIA can do.

I think the main point I'm trying to make is WebRTC may just be one of dozens [or more?] programs or browser scripting plug-ins that can ALREADY bypass PIA's IP protections to reveal your true IP information. If that is true, then we need a more organized effort to eliminate these threats as much as possible. The model is similar to what anti-virus and firewall companies can do.

I think it's obvious that using IE or Chrome or Safari is just a plan for disaster if you truly are trying to protect your real IP address from criminal abuse, as I am. So, that leaves Firefox, since I tried Opera only to learn it is already vulnerable to WebRTC.

I hope this thread can be a starting point to begin to document what you really need to do to protect your real IP address as completely as is possible. PIA is only part of that protection, but you will need far more "protection" than that to truly protect your IP address. For starters, it seems you must be using Firefox with certain add-ons and features disabled to have a chance at doing this correctly.

Please use this thread to list out what needs to be done to protect your IP from websites probing your browser to get that IP information.

OmniNegro

You asked for all possible vulnerabilities, Not just if the one being discussed in the thread had other possible attack vectors. And now you come asking if I meant something completely different from what I said?

The VPN is not the problem. Your childish idea of a one size fits all solution is half the problem, and your OS and applications themselves are the other half.

There is no fix for all problems. And even if you use the VPN and it does everything it should, the OS can still give away data that can be used against you. That is not something the VPN is supposed to protect you from. The VPN does only one thing, and does it well.

But a lighter does it's job well too, and you can set yourself on fire with it and scream how defective it is and ask people if they meant that the lighter cannot be kept from burning you too. And I would have to answer that if you are dumb enough to continue being burned, you probably did it yourself.

You do not know "jack" and your attitude does not make me inclined to even try to help you.

Right now you have a choice. You can choose to stop being confrontational and we can try to figure out what you need and want of the software currently available, or you can choose to be aggressive and we will see who is better at arguing to no benefit. If you choose to move on and try to figure out what you need and want, then I will gladly forget this post and we can probably figure out what is best for you.

So decide and if you choose right, tell me what software you currently use on what OS, and I will tell you what I know that may help. And you will soon find that many here know a great deal about this subject.

Khariz

Here is a good article: http://dimitritholen.nl/how-to-reclaim-your-privacy-on-the-internet/

Ignore the ZenMate part. That's why we use PIA. It's a good general article and talks about some useful plugins.

I'd also ignore the adblock part a use ublock instead.

ebikesrc

You asked for all possible vulnerabilities, Not just if the one being discussed in the thread had other possible attack vectors. And now you come asking if I meant something completely different from what I said?

The VPN is not the problem. Your childish idea of a one size fits all solution is half the problem, and your OS and applications themselves are the other half.

There is no fix for all problems. And even if you use the VPN and it does everything it should, the OS can still give away data that can be used against you. That is not something the VPN is supposed to protect you from. The VPN does only one thing, and does it well.

But a lighter does it's job well too, and you can set yourself on fire with it and scream how defective it is and ask people if they meant that the lighter cannot be kept from burning you too. And I would have to answer that if you are dumb enough to continue being burned, you probably did it yourself.

You do not know "jack" and your attitude does not make me inclined to even try to help you.

Please do not take any offense, but based on what you wrote above, I think English may not be your primary first language. You seem to believe I'm posting to be confrontational towards you and that I have a "childish" POV or "attitude", because I don't understand the complexity of this situation, etc. Honestly, it is quite the opposite. I quoted your suggestions too in the OP, and I merely asked you a question. I did not seek to imply you meant something you did not intend to mean. That was the point of asking those questions. Just to clarify the situation, so we understand what we're driving at. To save time I posted what I was getting at, but I think you believe I'm being critical towards you by doing so? That's just a mistake.

My point of starting this thread is so you and others can offer constructive ideas to solve these IP "reveal" problems for everyone that will read this thread. This is for everyone's benefit. You're not just helping me by any means. I'm sorry for our misunderstandings, and I hope we can move on to be constructive here.

I am frustrated that we are all so vulnerable to these online abuses wherein serious crimes can be committed against you just for participating at an online Forum where someone can obtain your real IP information bypassing the VPN and IP protection too.

The OS I was using was Windows 7 with one of the latest versions of Firefox [about 34.x-35.x] and NoScript. The criminal likely bypassed my VPN/IP protection by using some method to run "something" inside the browser to get the IP information. I don't know how it was done, obviously, but I did probably allow NoScript to not block for that website Forum. That is probably "where" I made the mistake, but maybe I was hacked by a totally different method. The police have that computer in their crime lab now, so I have no access to it anymore. I live in a large high-tech city, so it's possible the crime lab MIGHT be able to figure-out what happened.

In the meantime, I've got to protect myself online to not allow this to happen ever again.

Osborne_Cox

Though I have used free VPN in the past I would not now. There is more to gain for those running such servers in return for ones trust. The VPN server could have been compromised leading to infection of your system. Every entity you trust is potentially another attack vector.

OmniNegro

Fair enough.

I also use Windows 7 x64. I use Firefox 36.0.1 with all the extensions I mentioned, and the very first thing I did upon installing the OS was to kill off all IPv6 pseudo interfaces.

And while my choice of words is certainly odd, English is the only language I ever knew. (I understand why you may presume otherwise. I do not use conjunctions by choice, not because I do not understand how to use them.)

The odds are that no-one will find what happened that caused you to be victimized. But if they do figure it out, so long as telling us does not provide a tip for others to do the same thing, we would all like to hear about it. I would guess a trojan was somehow planted on your system. This requires either direct access to the system, or for you to run a program that is going to infect your system.

In truth I did take your original post as being aggressive. But as I promised, I will simply forget it. It seems very clear that was not your intent. I apologize for my aggressive response.

So let us figure out what you need. You have the browser and extensions figured out. Now for some general advise. I suggest not installing anything you do not need. If you do not need Java, do not install Java. Even if you do need Java, if you do not need it to be used in your browser, set it to not activate except manually in Firefox.  (Set it to "Ask to activate" mode in the addons menu.)

Literally anything that you do not need is a potential avenue of an attacker. So think before enabling stuff that is useless to you. Fill us in on the other applications you use that need Internet access and we may be able to help tell you how we do things and why we use our methods. I hope some of this is useful, and I look forward to contributing more.

catcher749

Surely you did not think the solution to internet security involved nothing more than the use of a VPN, lol.

UltraHumanite

@ebikesrc You seem to be confused about the basics of how networks work perhaps that's something you should investigate and educate yourself about, doing so will perhaps help you protect yourself in the future. Also it's somewhat difficult to discuss these subjects with you since you lack the basic knowledge and understanding, that's why your ideas are being called childish and you're being told that you don't know jack. I do not claim to be an expert but even to me it's clear that you lack the basics.

Your particular situation. Based on what you said there is no way to know how you were exploited. The attacker does not need to know your ip address to exploit you. Sure it might help if they do but that's just one of the avenues of attack. VPN does not make you exploit proof, it's a privacy tool. From your statements it's clear you left yourself open to being exploited by using what sounds like a not so great(bad or even possibly malicious) VPN("volunteer service"!? What does that even mean? Who's volunteering what?) this would be a great platform for among other a MITM style attack, but that's just one of many possibilities.

There is no solving what you call ip "reveal" issue/exploit/whatever and what you propose is from it's basis a pointless and ridiculous undertaking. You state that the scope of this project should be limited to "legit scripting or programming tools"(whatever this means) an attacker would never do that so what's the point, it's like plugging one hole in the bottom of your leaky boat and watching the water rush in thru dozens more. There already are websites and forums dedicated to discussing and researching exploits, they are ran and frequented by experts and far surpass anything that could ever be accomplished here. This is a complex issue that requires very specific technical knowledge and constant vigilance as the "problem" is ongoing and will remain as such, there is no solution no silver bullet.

VPN

I'm using PIA's servers with OpenVPN (not PIA Manager!). I feel confident that only errors in the virtualization or networking stacks in the involved operating systems can lead to a leak or reveal of my ISP assigned IP address.

Applications I run over the VPN connection may choose to leak further data. Preventing that CANNOT be and never has been the purpose of a VPN connection. It is only a network connection, you can think of it as a virtual ISP that doesn't keep customer data.

Staying anonymous on the net requires more than a few browser plugins and registry hacks or firewall settings. For example, after installing Tor Browser you see a page featuring a warning box which reminds you to think about habits and directs you to a list of warnings[1] - these warnings are specific to Tor but mostly apply to VPNs, too. Tor Browser has been patched from vanilla Firefox to behave differently, in a more unanimous way across installations, to make its users all appear identical. Still, if you use it to log into your Facebook account or your banking account, you give up your anonymity instantly.

Check your behavior before you fret over attacks or exploits.

[1] https://www.torproject.org/download/download.html.en#warning

ebikesrc

Surely you did not think the solution to internet security involved nothing more than the use of a VPN, lol.

If you carefully read through my posts here and on the WebRTC thread, then you would already know I took steps to alter Firefox to protect against WebRTC. I uninstalled Chrome, removed as much as IE as is possible, know not to use Opera or Safari too, and I have been using NoScript for years.

Yes, I fully understand, all of the above is nowhere near enough to protect my IP from some criminal abuse at a Forum I participated at. I'm here to learn "the basics" to try and prevent this from happening again, and I admit I'm not a network or torrent expert. I know full well that my computer may have been infected by some exploit in the OS, or possibly by some video download I did using uTorrent. I have opened some of the Text.txt files that describe the TV show's details. I never download torrent software.

I was only using the Windows Firewall, and I'm certain some ports were opened to share media/files with two other computers I had on a home network. One computer was WHS (Windows Home Server that is built on the 2003 server OS), and the other computer was Windows 8.1. Both of these computers were offline and never turned on when these crimes took place. The crimes happened within 3 days, when all 3 of my computers were removed by search warrant to a crime lab. I never knew my computer's IP was hacked somehow. 

Because these crimes happened so fast and my IP was known somehow, within 3 days from start to finish, I think it is related to my participation on a Forum. I was only posting there online for about 99% of my online time. I was not really roaming the Internet going to unknown websites. I was online for only a few weeks with a new ISP (Time Warner). I had been offline entirely for 6 months using a different ISP.

I was not using a wireless router, and the cable modem was connected directly to my network card (no router). Remember, the other 2 computers were never online or even turned on, since I started online again with the new ISP. These computers were never hacked by someone breaking in the home. This was an online criminal effort that involved hacking the one Windows 7 Home Premimum 64bit computer.

ebikesrc

Osborne_Cox Wrote: "Though I have used free VPN in the past I would not now. There is more to gain for those running such servers in return for ones trust. The VPN server could have been compromised leading to infection of your system. Every entity you trust is potentially another attack vector."

Yes, this is an excellent point. It's why I'm paying to use PIA now.

FYI, I was using this free service when these crimes happened:

http://www.vpngate.net/en/about_us.aspx

http://www.softether.org/

UltraHumanite Wrote: "From your statements it's clear you left yourself open to being exploited by using what sounds like a not so great(bad or even possibly malicious) VPN("volunteer service"!? What does that even mean? Who's volunteering what?) this would be a great platform for among other a MITM style attack, but that's just one of many possibilities."

==============

Please "see above" links in this post. I was connecting to volunteer VPN/IP servers mostly in Japan and some in Korea too. This is because these were much higher speed connections. Typically, 30-100mbs shared by usually much less than 10 other connections. The problem is you can get dropped off the VPN without warning, and then you have to manually connect to another VPN server. I'm certain this exposed my real IP address when this happened too.

Khariz

Okay, I apologize ahead of time, but I have to speak what is on my mind here, @ebikesrc

Everything you are saying about what happened to you is mighty fantastical. The odds of something going down the way you have this situation in your mind are so slim that it is hard to even quantify the chances. Frankly, people just aren't interesting enough to go after them and spoof their ip to commit felonies with, no matter how annoying you might have been on a message board.

In my career of hearing stories like yours, I've gotten very jaded. I often find myself explaining to my clients that it doesn't really matter what the truth actually is, it really only matters what you can make it appear to be in the courtroom.

Do not put your faith in your state's computer forensic skills. If your fantastical scenario is true, you need to have a damn good lawyer, and some damn expensive computer forensics of your own performed on those computers after the state is done with them (and some damn fine expert witnesses).

Unfortunately though, it is much easier to believe that it was in fact you that did something stupid on your computer yourself, and that the purpose of this thread on this message board is actually a fishing expedition for ideas related to your defense. Like, hmmm, what can these Internet security/privacy people think up that are holes in Internet security that I could use to pin my crime on? Something somebody says is bound to sound good in court.

Note: I'm not explicitly accusing you of this, as I have nothing more than my own personal conjecture to accuse you with. Frankly, even if that's exactly what you are doing, you are more than welcome to do it. Hopefully these discussions and your use of computers doesn't violate any terms of your bail/bond. And hopefully your questions and discussions here don't end up being used against you by the prosecution.

OmniNegro

As @Khariz already implied, you should talk with your legal counsel before pursuing this thread.

There is nothing wrong with trying to be safe from malicious hackers, but be aware that the actions a guilty party would take may appear identical to the actions an innocent party may take. And a prosecutor may not give a damn if you are innocent or guilty, but rather will care what they can make you look.

If you have not already discussed this thread with legal counsel, then please do yourself a favor and abandon it. You can always find it again later after this mess blows over. But for now, prioritize staying out of sight.

ebikesrc

I feel fairly confident the detective investigating these crimes understands I would never commit such crimes, and IF, I say again, IF, I was stupid and insane enough to do this, then I would NEVER use my computers from home. I have enough of a computer background that the police would understand I'm not a complete fool to attempt such an insane act from any computer I might own.

Anyway, there has to be a motive to commit a crime. People don't just randomly commit this type of crime without some motive to do so. In my case, there is no motive or reason for me to do this.

Khariz Wrote: "Okay, I apologize ahead of time, but I have to speak what is on my mind here, @ebikesrc Everything you are saying about what happened to you is mighty fantastical. The odds of something going down the way you have this situation in your mind are so slim that it is hard to even quantify the chances. Frankly, people just aren't interesting enough to go after them and spoof their ip to commit felonies with, no matter how annoying you might have been on a message board. In my career of hearing stories like yours, I've gotten very jaded."

Well, the truth is it will not be hard to prove I was very controversial at that Forum. I was mentioned at least two times on the radio show's introduction that I was very controversial, and I was probably needing to tone it down a bit too. Some people on a thread actually posted they wanted to get my IP address too, so that's when I got really concerned about protecting my IP address. The owner of the radio show and Forum has helped me to log as evidence I was using the free VPN and IP protection online too.

These 2 Federal crimes, which are very serious "threat crimes", were likely "prank" "swat" crimes. By that I mean crimes that were committed by criminals to set-up a victim or victims to involve the police "to swat" the intended target and victim(s). I have no connection whatsoever to any of the targets where the police were involved also. It was only my IP that somehow was "spoofed" or used "to swat" the intended targets.

I was never under arrest, and the Fed detective told me about 2 weeks later that he does not think I committed these crimes. I certainly could never even contemplate doing such an insane thing, nor am I incredibly stupid enough to do such things from traceable computers. (I have a verifiable computer background that lends evidence to the idea I know enough to never use my own computer equipment to do such things.)

It may be fantastical that some people wanted to "get me" from the Forum. But I was mentioned as a controversial person on the radio show for the Forum, and people there publicly posted they wanted to know my IP address too. I was posting often in debate "there" the entire time I was back online too, so that is the logical reasoning I'm using as to why "the trouble" may have begun there.

I may have never been the intended "swat target". Why? The "threat targets" were in a far away State I have no connection with whatsoever over my entire lifetime. The threats named names, so it is likely someone is connected to that person(s) and place that is far away with no connection to me personally. Only my IP was somehow connected to this. That's why I focus back to the Forum I was posting to.

I am paranoid now that someone could use my IP again to commit crimes. I have no idea how I was hacked or why. I am the victim of serious crimes too. I want to protect myself from this ever happening again. If I'm being targeted for some reason, then I need to actively protect myself as best I can.

This is truly why I started this thread.

Khariz

No offense, but if I was your detective, I wouldn't have much faith in much of anything right now. I would have discovered by now that you are a Roswell ET/Alien conspiracy theorist that is deeply involved in such conspiracies as to know the "power players" or "dream team" on a first name basis.

In fact, you seem to get your hacking idea from the story of Tony Bragalia getting his computer hacked by some unknown schmuck using the code name "A Glass Darkly" in The "Roswell Slides" conspiracy.

If anyone wants to know what I am taking about: http://mysteriousuniverse.org/2015/02/spying-on-the-roswell-slides/

So yeah, if I was your detective, I'm not sure how much of the benefit of a doubt I would be giving you right now. Sorry.

http://ufocon.blogspot.com/2015/02/adan-dew-provided-this-update-and.html

http://nickredfernfortean.blogspot.com/2015/02/more-roswell-slides-info.html

ebikesrc

Khariz Wrote: "No offense, but if I was your detective, I wouldn't have much faith in much of anything right now. I would have discovered by now that you are a Roswell ET/Alien conspiracy theorist that is deeply involved in such conspiracies as to know the "power players" or "dream team" on a first name basis.[...]"

I post as a skeptic about such things. I don't know the "power players" or "dream team" on a first name basis. My ideas about hacking do not come from Tony B. Etc.

You're putting forward a critical attitude towards someone [me] that is a crime victim too! Why do you "get off" being so confrontational about this??? You don't know any of the details about what happened to me, but you are attempting "to color" my posts from what appears to be a hostile and negative approach towards not helping me. In fact, you seem to be very accusatory in many respects, as if I'm being disingenuous and essentially lying in my posts here.

Why are you doing this?

catcher749

No offense, but if I was your detective, I wouldn't have much faith in much of anything right now. I would have discovered by now that you are a Roswell ET/Alien conspiracy theorist that is deeply involved in such conspiracies as to know the "power players" or "dream team" on a first name basis.

In fact, you seem to get your hacking idea from the story of Tony Bragalia getting his computer hacked by some unknown schmuck using the code name "A Glass Darkly" in The "Roswell Slides" conspiracy.

If anyone wants to know what I am taking about: http://mysteriousuniverse.org/2015/02/spying-on-the-roswell-slides/

So yeah, if I was your detective, I'm not sure how much of the benefit of a doubt I would be giving you right now. Sorry.

This may not be the best place to bring up aliens/roswell...

Khariz

Yeah...I'm done. Sorry to all involved. I got a bit carried away. I originally had this benevolent intention in mind where I was going to show you how easy it is to twist a few facts into meaning something much more than they appear to on the surface, but then I just turned into a jerk instead. I see that now.

Just be wary of what you say, why you say it, and how you say it when you might be under heightened scrutiny at the time. Your motives may be questioned at every turn.

ebikesrc

Fortunately, the ebikesrc user name you searched on is not directly connected to the Forum I was posting at. Your searches will not link ebikesrc to the Forum or my user name there.

However, I did not realize these Forum posts "here" were going into the search engines too until now.

Khariz

Good point. It's kind of disturbing that PIA doesn't simply put a robots.txt file on their server. It's odd considering what this place is all about.

OmniNegro

You did not come here for legal counsel, so I for one will stop trying to give it. I am certainly not competent to give legal counsel anyway.

One tough thing you do need to face is that you were tricked before, and nothing you knew about computers meant anything to whomever did this. So it would be a good idea to stop thinking it will next time.

I never even attended high school, much less college, yet I know for a fact that I have better knowledge on some subjects than Doctors do. The point of this is that different people have different knowledge and no degree makes a person know anything at all, not even if they study it day and night for years.

So for your own sake, please presume you know exactly nothing at all about computers. And there is a way to cheat and make this much easier. But it requires specific conditions.

Firstly do you need Windows? If you play games, or have some other applications that can only run on Windows, this option may not work.

Second if you are unwilling to start anew with something that will make you a hardened computer user that no hacker can readily do anything to, then this will not work.

But if you are able to, use Linux. In full. Do not go halfway. Use Linux for anything and everything you can, and only use Windows in a VM if you must.

My suggestion is to install and use Linux Mint as your OS. It will place you at the newbie stage of computer literacy, but by doing so, you will be shedding any possible holes in your knowledge, and all bad habits like logging in under a username with administrative clearances.

The difficulty of making you someones Internet victim will rise exponentially as you leave Windows and Mac and all these sorts of nightmares behind. Linux is the M1Abrams tank of the Internet world.

But ultimately it is your choice. We will help you with whatever OS and applications we can.

ebikesrc

@ebikesrc

You should not be talking publicly about the details of the "crime" of which you are supposedly a "victim" while such a "crime" is under investigation, if such really happened. If such really happened the federal investigator would have told you this, its one of the first things they tell such "victims".

However, there is something odd with your story. It has a certain combined rehearsed - scripted - story telling tone to it, seems intentionally contrived overall, develops incrementally to fit, has elements of disingenuous statement and/or structure, and has a mixture of past and present tense pattern combined in 'story telling' (as written word) which always accompanies deception.

To be honest, I am NOT sharing enough of the details of this crime to identify it, nor do I intend to here. Your post is a perfect example of why I will never do that here. You're not helping here by casting suspicions and doubt, as if I'm intentionally misleading people here. I have shared enough just to give some ideas about how this MIGHT have happened, it's only my best guess, which I freely admit I may have been "hacked" for other unknown reasons or methods.

Also, I really was not necessarily the direct target of these two crimes. Two other targets were "named", and these targets were likely the intended direct victims. I don't pretend to understand the motives or reasons why anyone would commit such insane acts, but it often will involve a disturbed younger male that does this sort of thing. I'm not going to waste time here trying "to profile" the type of person that will do this, but I have some pretty good ideas about it.

I'm am innocent of any participation in what happened. Somehow my "IP address" is associated indirectly in how these crimes were carried out. I do not know exactly how/when that was determined, so I have no idea how accurate any of that may be. It is very likely I was logged onto the free VPN service, when these crimes happened. IF that is true, then it will be very interesting "how" my real IP was somehow implicated.

Let's move on beyond trying to analyze whether or not I can be trusted with my story. I'm telling the truth, as best as I can recount it without revealing enough details to identify it precisely. I do want to maintain my privacy about this here too! Your type of post is not helping me to protect myself and other people from this type of criminal abuse.

ebikesrc

One tough thing you do need to face is that you were tricked before, and nothing you knew about computers meant anything to whomever did this. So it would be a good idea to stop thinking it will next time.

[...]

So for your own sake, please presume you know exactly nothing at all about computers. And there is a way to cheat and make this much easier. But it requires specific conditions.

First, I want to say I do appreciate very much your suggestions and willingness to help too. I have no history or experience with hacking, so I'm wide-open to being infiltrated. For example, I haven't mentioned this before, but the Windows 7 version I used was Home Premimum. It did not come with Remote Desktop. I found someone online that offered free software to add RDP back to the OS to enable the Remote Desktop feature. It worked. BUT. Did I open a doorway into my computer from this free RDP mod I got online???

I have too much of an investment in time with Windows that I don't want to switch over to any other OS. I just don't have the time or interest to switch over to a new OS, so I will learn how to minimize its security risk online when possible.

1) I'm surprised no one has mentioned using a really good Firewall beyond what Windows offers. Has anyone experimented with these? I tried Comodo's Firewall. It has powerful reporting and logging features, so one could at least gather "evidence" of what is happening with your Internet and network connections.

2) Also, what about using a router with DD-WRT that is also compatible with the PIA service? Is that going to offer an extra layer of security that will protect my IP information or protect my computer from being hacked at a much higher level of difficulty?

3) I noticed the Comodo software also offers a sandbox feature. I think that means it will run programs in a virtual mode when launched from that sandbox. Should I be running Firefox in VM mode from that sandbox too? What else should be run in VM mode? uTorrent or ?

4) If I download a torrent mkv or mp4 or other video or audio file, then are these safe to play in a media player without containing any virus too?  What about opening a text file associated with this in Windows notepad? I assume a virus scan can check if a text file will be infected? What about just opening the text file in VM mode? Is that safe to not be able to attack outside its VM?

ebikesrc

I've had many years of legal experience dealing with clients who were not honest for what ever reason, your story (as written) has all the elements of dishonesty in story telling. So, maybe you might reconsider outing yourself in such posts.

Imho, you have no way of knowing anything by what I've written in all my posts here. You have formed your opinions that expresses how you think, but I am certain you are mistaken by your methods of analysis and experience you say you have. Why? You're trying to implicate me as someone that has done what? You fill in the details, because I can't read your mind or know your motives.

You want to blame the victim? That is what you're doing with these kinds of posts. It is how you think, and I've not made you decide how to think and judge my situation. This thread has nothing to do with the subject matter you keep turning to. You're essentially derailing the topic of this thread based on some very "limited information", but you can "sense" the truth about my situation.

Please don't post to this thread unless you have some security suggestions to offer here for readers to further protect their IP address, etc. from similar types of criminal activity. Stay On Topic! You are off-topic with your previous posts.

OmniNegro

Here is the firewall I use.
http://privacyware.com/personal_firewall.html

RDP is a bad idea, and adding a third party version of it is a terrible idea.

Text files are innocuous even if they are trojans. There is no application that can open a text file as an executable.

And so long as the associated media player is safe, no media files are dangerous. If you are not sure what to trust, grab a copy of VLC player from here.
https://www.videolan.org/

I am trying not to insult you, but some of the questions you ask make me wonder if this is all a show, or if you really know fuck all about computers. So @Irryie is not bluffing when he says part of what you say sounds rehearsed. In a previous post you say "I have enough of a computer background" and all I can think of is that you do NOT have enough of a background to know that text files are never executables on Windows?...

Different people have different knowledge. So I will stop trying to figure it out. But understand that the more you talk, the harder it is to believe you. Just let it be.

As for virtualization, VMware is probably the best you can get. And you can resort to Sandboxie if you want to try that as a solution, but it does not offer the same level of protection.

I would not use a Sandbox built into another program. I always prefer a program built to do one singular task, since they tend to always do it better than catch all programs with a million uses. It is like comparing a real screwdriver to the screwdriver part on one of those expanded swiss army tools.

DD-WRT can be very good, but unless you have a good router, it will greatly slow the overall speed due to encryption overhead.

ebikesrc

I've had many years of legal experience dealing with clients who were not honest for what ever reason, your story (as written) has all the elements of dishonesty in story telling. So, maybe you might reconsider outing yourself in such posts.

Imho, you have no way of knowing anything by what I've written in all my posts here. You have formed your opinions that expresses how you think, but I am certain you are mistaken by your methods of analysis and experience you say you have. Why? You're trying to implicate me as someone that has done what? You fill in the details, because I can't read your mind or know your motives.

You want to blame the victim? That is what you're doing with these kinds of posts. It is how you think, and I've not made you decide how to think and judge my situation. This thread has nothing to do with the subject matter you keep turning to. You're essentially derailing the topic of this thread based on some very "limited information", but you can "sense" the truth about my situation.

Please don't post to this thread unless you have some security suggestions to offer here for readers to further protect their IP address, etc. from similar types of criminal activity. Stay On Topic! You are off-topic with your previous posts.

Oh stop it. Don't blame it on me or anyone else who doubts your story, its you who pointed the finger at you and not me or anyone else, you made this a topic of discussion from the very first words in your very first post that started this thread, and you set the tone and subject matter then continued it. If you do not want it discussed or mentioned or disclosed then don't post it.

I'll post to any thread I choose. What I posted was 'On Topic', a topic you established and continued, unless of course you are now going to claim that someone here "spoofed" your forum login and posted it.

You are continuing to post Off-Topic according to the OP I made.

Quoting myself from the OP:

 I hope this thread can be a starting point to begin to document what you
really need to do to protect your real IP address as completely as is
possible. PIA is only part of that protection, but you will need far
more "protection" than that to truly protect your IP address. For
starters, it seems you must be using Firefox with certain add-ons and
features disabled to have a chance at doing this correctly.

 Please use this thread to list out what needs to be done to protect your IP
from websites probing your browser to get that IP information.

Khariz

I agree that these discussions aren't off topic.  I only thought to begin discussing them in the first place particularly BECAUSE of what was contained in the OP.  The OP struck me as very disingenuous.  I believe my own exact words were "a fishing expedition".  I just don't believe that this thread was actually meant to be a serious discussion on how to protect oneself on the internet. 

All of the red flags that are going off in Irryie's mind due to his experience with his clients is going off in my mind for the same reasons.  It's possible that we are both unfairly judging this guy, but we'll probably never know for sure.  I just can't bring myself to take this thread seriously. 

My initial accusatory post was heavily edited a few minutes after I posted it.  I initially was much more bold in my calling BS on eBikesRC.  I scaled it back because I was being almost cruel with insufficient evidence to back up what I was saying.  

A healthy skepticism of everything my clients tell me ends up helping them out in the long wrong.  If I doubt them, and challenge them, and force them to prove themselves right to me, it usually ends up helping them down the road, especially if we have to go to trial.

This entire discussion is just giving me that "shyster vibe".  Maybe that's unfair.  It's hard to read tone and intent into works on a page of a forum.  But I noticed the same inconsistencies and oddities that Irryie noticed.  Had I not edited out my initial comment, it would have been eerie how similar Irryie's first post and mine were.

ebikesrc

My posts were not 'Off Topic'.

Someone posts about what you posted and you don't like it so you cry "Booo Hoooo, Whaaaaaa... you are Off Topic... Are you like five years old? Its bad enough that you post things dishonestly but do you need to be dishonest with your self also?

I'll post to any thread I choose, so take that little temper tantrum and shove it.

Your posts are OT according to the OP, and I am the OP that requested the type of information I'm looking for that has nothing to do with your hostility and nutty ideas to continually post and suggest I'm not telling the truth. Why? What's your agenda here? To destroy the purpose of this thread? That is what your posts are continuously doing.

Do you think anyone cares about "the help" you are definitely not offering anyone here now or in the future too? Again, I posted in the OP for the following information in reply to my OP. You obviously are totally abusing that request over and over being "a troll" about this. That's your doing and your thinking.

This is the information that should be posted about in this thread. It is my request from the original OP as follows:

 I hope this thread can be a starting point to begin to document what you
really need to do to protect your real IP address as completely as is
possible. PIA is only part of that protection, but you will need far
more "protection" than that to truly protect your IP address. For
starters, it seems you must be using Firefox with certain add-ons and
features disabled to have a chance at doing this correctly.

 Please use this thread to list out what needs to be done to protect your IP
from websites probing your browser to get that IP information.

==========================

If you can't respect my OP request and choose to ignore it to pontificate over and over about my alleged dishonesty, or whatever you're driving at, then I think you're not being helpful to anyone else reading this thread that wants to use good security measures beyond PIA to prevent criminal abuse. I'm the OP, so I'm calling you a troll on this account. You've helped no one here, imo. You certainly have not helped me either. Why keep posting your hostility and false allegations?

As I said before, imho, you have no way of knowing anything by what I've written in all my
posts here. You have formed your opinions that expresses how you think,
but I am certain you are mistaken by your methods of analysis and
experience you say you have. Why? You're trying to implicate me as
someone that has done what? You fill in the details, because I can't
read your mind or know your motives.

Please respond to the direct questions I've asked you in this post, or, better yet, please just stop posting to this thread. I'm am the OP, and I think you've become "a troll" here by not being helpful or constructive to this thread, IMO.

ebikesrc

lrryie Wrote: Oh stop it. Don't further enshrine your dishonesty, stupidity, ignorance, and disingenuous activity and nature and stop your childish temper tantrum demands. You posted it and it became fair game, the dishonesty in your posts got pointed out and now you cry about it with "boooo hoooo, off topic, off topic, trolling".

I don't see anyone else posting to this thread to state flatly I'm being dishonest and disingenuous with the nature of this thread, and that I'm throwing childish temper tantrum demands, etc.

You come across as someone that has hijacked the purpose and intent of this thread and have derailed it OT for the information I am still asking for. You will not provide any of that On Topic information by your very replies that are ALL Off-Topic to the requested information from the OP.

You've only proven to me that you're a trouble maker here, and you've proven to me you definitely can not discern the truth by any means with anything I've posted. It's pretty laughable that you've even attempted to do this on a forum where I already admitted I'm limiting what information I'm able to share here. I say "nuts". You know nothing, really.

ebikesrc

lrryie Wrote: Oh stop it. Don't further enshrine your dishonesty, stupidity, ignorance, and disingenuous activity and nature and stop your childish temper tantrum demands. You posted it and it became fair game, your dishonesty got pointed out and now you cry about it with "boooo hoooo, off topic, off topic, trolling". You can't even be honest with yourself. Yet, here you are continuing with your dishonesty and disingenuous activity and nature.

You truly are the one being dishonest, because you have no way to know the truth here, period. You repeat your false allegations that comes across as having OCD and a nutty inability to stop posting the same paragraph over and over.

Khariz is smart enough to stop posting and not keep posting a cut-n-paste opinion over and over that you are continuously doing destroying the purpose of the OP. Why? Because it is not offering new information that the OP is requesting. You, on the other hand, seem to be filled with all kinds of judgments that you have no basis "in fact" to make any of the assertions you are making except that it's your obvious uninformed opinion. As I said, it's pretty laughable that you've even attempted to do this on a forum
where I already admitted I'm limiting what information I'm able to share
here. I say you are "nuts". You know nothing, really.

ebikesrc

Staying anonymous on the net requires more than a few browser plugins and registry hacks or firewall settings. For example, after installing Tor Browser you see a page featuring a warning box which reminds you to think about habits and directs you to a list of warnings[1] - these warnings are specific to Tor but mostly apply to VPNs, too. Tor Browser has been patched from vanilla Firefox to behave differently, in a more unanimous way across installations, to make its users all appear identical. Still, if you use it to log into your Facebook account or your banking account, you give up your anonymity instantly.

Check your behavior before you fret over attacks or exploits.

[1] https://www.torproject.org/download/download.html.en#warning

You make some excellent points. Can you explain more about what Windows registry hacks are needed? Also, I take it that using Tor Browser for its "networking traffic" abilities is more "hidden" than posting at a Forum using just PIA and Firefox with correct settings and plugins, so that it would somehow hide my IP even better? Usually, at a Forum you have to register and login to post, and then each post is logged often with some IP information too. At least the Forum login is usually logged with an IP address if not each post too.

Thanks for your post and ideas.