The Art of Not Being There: Anonymity and Plausible Deniability

The Art of Not Being There: Anonymity and Plausible Deniability

In the magical circus of the Internet, when people talk about "privacy", most think of hiding their browser history from their spouse or employer. Cheap stuff. Amateur hour.

If we level up and start talking about serious cryptography and digital rights, we run into two concepts that give any government agency a stomach ache and represent the true cornerstones of digital defense: anonymity and plausible deniability.

Let's break down these concepts without the math to understand why we should care.

Anonymity vs Pseudonymity (Or: no, nicknames won't save us)

Let's start with the basics, because there is a gigantic misunderstanding floating around forums.

If we create an account on a platform calling ourselves HackerPippo99 and write wild posts against the establishment, we are not anonymous. We are pseudonymous.

Pseudonymity associates all actions with a fictional identity (the nickname). The problem is that if HackerPippo99 posts three times a day, always connects from the same IP address block, has a recognizable writing style, and exchanges messages with the same people, it won't take long for the analyst on duty to trace it back to our real face. Pseudonymity creates a thread that links all of our behaviors.

True anonymity, on the other hand, means that any single action or message cannot be linked back to us, to a fixed alter-ego of ours, or to any prior action. It is the total absence of connecting threads.

On the normal web, anonymity is almost impossible to achieve because browsers and operating systems spit out telemetry like fountains. That's why we use the Tor network or specific routing systems: to break the link between the source and destination of every single data packet.

Plausible Deniability: Cryptography's Secret Weapon

But let's move on to the main attraction: plausible deniability.

Simply put, it is the ability to mathematically and logically deny having performed an action, written a message, or possessed data, in such a way that no one can prove otherwise.

It's not about lying and saying "it wasn't me" hoping they'll believe you. It's about ensuring that mathematics itself makes your denial perfectly plausible and unprovable.

Let's see how it works in the two main scenarios.

1. On the Hard Drive (Deniable Encryption)

Imagine the classic spy movie scene: a coercive authority captures us, confiscates our encrypted laptop, and shines a light in our face (or threatens us with jail) to force us to enter the password. If we refuse, we're done. If we enter the password, they see our secret files.

This is where deniable encryption (made famous by software like VeraCrypt) comes into play. The system allows you to create a hidden volume inside another encrypted volume.

• We create an encrypted container with password A containing harmless files (cat photos, grandma's recipes).
• Inside the seemingly empty space of this container, we create a second hidden volume with password B containing the sensitive files.

If they force us to give up the password, we provide password A. The system unlocks, displays grandma's recipes, and the sensitive data remains indistinguishable from the random background noise that fills the empty disk space. Mathematically, it is impossible for anyone to prove that password B or a second hidden volume exists. We can plausibly deny having other data.

2. In Chats (Symmetric MACs vs Digital Signatures)

In the physical world, if we sign a contract with a pen, that signature binds us to that document. No one else could have made it. In cryptography, asymmetric digital signatures (like GPG) work the same way: if we sign a file with our private key, anyone with our public key can prove to a judge that we wrote that file. Zero deniability.

But when it comes to private chats, we want the exact opposite. We want to be sure that the person we are talking to is who they say they are (authentication), but we also want that person to not be able to go to a judge and prove that we were the one who wrote those messages.

Modern protocols (like OTR, Signal, or SimpleX) solve this paradox using symmetric keys and MACs (Message Authentication Codes).

• When Alice writes to Bob, the message is authenticated with a secret key shared only by Alice and Bob.
• Bob knows the message came from Alice because he didn't write it, and only the two of them have that key.
• But if Bob goes to a judge to show the chat, Alice can say: "Bob had that key too. He could have easily generated that message himself to frame me."

Bob knows the truth, but he cannot prove it to third parties. Mathematical plausible deniability applied to conversation.

Why is all this vital?

There's always that smart-aleck who says: "But I do nothing wrong, why should I care about plausible deniability?".

We should care, and a lot. In many countries, simple political dissent or investigative journalism are considered crimes. Without anonymity and plausible deniability, whistleblowers could not exist, journalists' sources would be arrested after five minutes, and personal communications would be constantly used as evidence in show trials.

These tools are not built for criminals; they are built to protect human integrity against asymmetric powers. They are the mathematical barriers separating a free society from a total surveillance dystopia.

[May the Talpone be with you]

Discussion & Support

Discussion and support channel. To discuss configurations or other topics, join us on fluxer.dreadful.work.