I think you might have a point, honestly. I'm getting dangerously close to putting on my tinfoil hat over here (no offence to anyone who actually wears one, please
). But jokes aside, that's partly why I was asking. These days, it feels like almost every trace we leave online can be collected, archived, analysed or fed into some AI system, especially now that everyone's burning tokens on AI for practically everything.
'm less concerned about someone specifically watching a niche occult forum and more curious about how much of our digital footprint is being gathered and what might eventually be done with it. Maybe nobody cares about our little corner of the internet right now, but the data is still out there.
If you're concerned about being monitored, then I can tell you this:
Online tracking isn't magic, it's based largely on combining facts to pinpoint unique users and build data sets from that. That's not an issue as long as said data never gets linked to your real identity.
This is largely done based on:
- Shared logins (if you log into everything with Google, then yeah, putting the pieces together isn't hard)
- IP address, which shows your rough location
- Any identifying information you share, which is now really easy to track down thanks to AI summarizing big heaps of text very efficiently
- Browser metadata
- Cookies
Anyway, I typed out this whole post explaining digital fingerprinting but I realized I don't know your familiarity with the matter. This could be me over-explaining things you already know, so sorry if that is the case. Feel free to skip if so. Anyway, goes.
When you visit a website, your browser sends all of this information to the computer(s) hosting the website. Most of this information is only available to the recipient thanks to TLS. Outside of that, the information needs to be routed to said recipient, which requires knowing your IP address as well as the recipient's IP address. As such, anyone along the way can see you talked to that person, which includes your internet service provider.
There is a hidden asterisk here though, which is that the modern internet is more interlinked than ever. When I login to a website using a Google account, that website asks Google to do the login process, and Google then comes back with the email address afterwards. This is called OAuth, which is good for password security, but bad for privacy, as it means the authorization server (Google in this case) knows you logged into that website.
Cookies are pieces of text/numbers and their associated labels that a website can store for itself. They are stored locally on your device, as you probably know. However, they cannot be shared between websites directly. This is to prevent hackers from just reading your bank's cookies to steal your login tokens. That being said, websites can use cookies to identify you on repeated visits, and the owners of websites can share cookies and associated information behind the scenes.
In the case of WF, this all means that your privacy is largely dependent on whoever hosts the website. They can see your browser metadata, your cookies, your IP address and your shared private info.
Additionally, your physical device can be impounded by the police. If this happens, they will scrape your history and most visited websites from the browser. These are just stored in an unencrypted file. In order to gain access to your device, the police can use your face or fingerprint to unlock it, but you are not legally required to provide them your password. As such I recommend everyone who cares about their privacy to use actual passwords/codes to lock their devices.
All that being said, if you really want your activity on WF to remain private, your goal is effectively to prevent your activity on the website to be linked with other places and eventually your real identity. To do this, you can hide your IP address via a VPN. You can use a privacy-focused browser like librewolf to prevent fingerprinting based on your settings and metadata, as well as to clear your history after leaving a website. Avoid sharing personal information (which is good practice regardless).
WF uses its own login system so you won't be linked through a shared Google account on that front.
If you do those things, the hosts of WF will see your VPN's IP instead of yours. They'll see your browser metadata, but it will be so generic as to be untraceable. They'll see your cookies, but they'll only be the ones that they create and they won't be linked to anything else. They'll see what you post, but not have anything to link it back to.
When hackers or targets of interest get traced, 9 times out of 10 it's because they did something obvious like failing to hide their IP, logging into an account that they're associated with (i.e. connecting to a website with cookies that contain their identity)
from their hidden IP, or just generally having something unique to them in their browser settings/metadata.
A famous example is Ross Ulbricht, who was the owner of the silk road and was caught because he used the email
[email protected] with his clients. Using your full, real name is in fact a good way to get traced to your real life identity.
Or if you trust the WF owners, you can just stick to the VPN because none of the other stuff matters. Still, anyone can get hacked.
