Step One: say goodbye
The first step in establishing digital anonymity is to immediately ditch any account that was created or even used with your actual exposed IP address. Every website is different but most keep the registration IP address linked to your account for life. If you log in to any previous accounts with your new IP, assumed that new IP is compromised as well.
Step Two: isolate activity
Continuing that last point is step two. Ensure that ANY time you use the web your VPN is connected. This is where you have to be extremely careful. The last thing you want to do is access your websites or services only to realize that your VPN was disconnected the entire time. There are several ways you can do this, the easiest solution being use a VPN that offers a kill switch. The slightly more advanced method is to use a live OS such as TAILS on a thumb drive. Wireless routers with the ability to utilize protocols such as WireGuard and OpenVPN are increasingly common. The point is, to verify and never assume.
Step Three: cash is king
The third step, while an excellent idea, may not be for everyone safe for the ultra paranoid. Consider buying used devices with cash from Craigslist, pawn shops, it doesn’t matter really, just use cash, Monero, or prepaid gift cards. That device you buy should then forever be your dedicated “dark” device that NEVER intermingles with any device that could be linked to your identity.
Step 4: don’t get complacent
The fourth step is not really a step, but more of a principle. After taking all of the aforementioned steps, your primary responsibility from there on out is to maintain digital hygiene. Your new anonymous persona is like an actor maintaining character. The more clues you leave the easier it is for someone to put together the puzzle pieces that may lead to your identification. See: correlation attacks.
VPN – stick to a VPN that allows payment through non identifiable methods such as gift cards or crypto. My personal recommendation is to use several different VPNs, some free, some paid. Change them at random intervals throughout the day. While not a necessity, this adds a layer of obfuscation and avoids putting all your eggs in one basket.
Email – use an email service that requires the least amount of information possible to register. Many providers require a phone number to register, obviously don’t use one of those. For an added layer of security you can use an email forwarding service such as Duck.com, AnonAddy, or SimpleLogin. If you absolutely have to use a service that requires a phone number, use cash to buy a prepaid burner phone from Walmart.
Messaging – if you must message with someone in real time, again – skip any service that requires a phone number like Signal. Stick to apps like Session, Matrix, Threema, or Briar. I get asked all the time if you can use discord and be anonymous. The short answer is sort of – at some point you’ll be asked to provide a phone number to verify your account. There are sms verification services but those are going to be additional hoops to jump through. The easiest method would be to buy a pre activated burner phone from Walmart with cash.
Browser – this doesn’t need to be overly complicated. Since you are not going to be divulging any personal information, it really doesn’t matter. Install whatever you like and install one or two privacy enhancing plugins.
Usernames – this is actually pretty important. Always use randomized usernames any time you register for something. When I say random, I mean completely random. No “84” at the end to indicate birth year. No common theme i.e names of Star Wars characters. I mean truly random. I can’t tell you the amount of people who have been doxxed because they use the alias “soccerlover1984” on every single website. Bonus points for using the same profile picture, as well.
If your identity is revealed, even partially, the speeds at which groups of people can start gathering data about you is astonishing. I’m talking archived links, screenshots, pastebins, etc. I learned this the hard way in 2013. They will aggregate everything even remotely linked to you and your family and start piecing together your life. They will analyze for clues like punctuation, grammar, tone of voice, and find more data. And frequently these people are just average citizens, not even specialists in this field.
Appendix
Buying with cash in person is a good way to reduce your digital footprint, but it’s not always practical. Here’s a couple tips to ensure that you don’t inadvertently reveal your identity on a shopping trip:
Don’t park your vehicle in the parking lot of the store you’re going to. Parking lots and entrances to stores are covered in video cameras, some of which are advanced enough to track individuals. My recommendation is to park with enough distance that creates a 5 – 10 minute walk. A great alternative would be to use a bike and park even further away.
Don’t make any other purchases while in the store, ESPECIALLY with a debit or credit card. Many retailers are installing videos cameras directly in front of cash registers, and transaction logs are preserved. They can be easily cross referenced to the time and date of surveillance footage.
Leave your smart devices at home. Your phone, smart watch, etc are literal tracking devices with pinpoint GPS accuracy. Yes, this is risky. If you get in an accident or get a flat tire, you may be screwed. Another option would be to enable airplane mode, disable location services, and turn the phone off. Leave the phone in the car when you go in the store. Don’t turn the phone back on until you get home. Next time you need a new burner phone you can leave your primary phone at home and bring the burner with you.
Disguise yourself. This can be as simple or complex as your heart desires. Remove piercings and cover any tattoos or birthmarks. Consider getting a spray tan or wearing shoulder pads. Change your facial hair, wear a hat, wear fake glasses or sunglasses, and burn the outfit you wear in to the store. Yes, literally burn it. You can get disposable shoes, pants, and a shirt from goodwill for cheap.
It is important to note that complete anonymity on the internet is difficult to achieve, and even with these measures in place, your online activity can still be tracked or traced back to you in some cases. It is also important to carefully consider the potential risks and drawbacks of anonymity, as it can also be used for malicious purposes.