Learn
All Basics Text and content URL tracking Metadata Network Accounts and operation Behavioral correlation Past information and search Past information and removal Journalists Whistleblowers Activists Individuals By situation Publishing workflow Final checks
284 articles Category: All
What is anonymity? What Is DNS? What Is an IP Address? What Is a Protocol? Anonymity for Whistleblowers How Whistleblowers Should Think About Anonymity What to Check Before Whistleblowing Anonymity Check Before Whistleblowing Author Information in Documents, PDFs, and Office Files Posting Times to Avoid in Whistleblowing Pre-Publication Checklist for Whistleblowers What Whistleblowers Should Check Before Using Information Submission Tools The Threat Model to Think About First in Whistleblowing Hiding your IP is not enough for anonymity Five correlation patterns that break anonymity What is URL tracking? Unknown URL Parameters How URLs Can Break Anonymity UTM Parameters Removing image metadata How to Think About Identification Risk How Images Can Break Anonymity Risk of Identity Inference From Backgrounds, Reflections, and Text in Images When Your Photo Is Used on a Company Site or Someone Else's Site Risks From Image Search, Face Images, and Icons How to Check Past Information With Image Search Pre-Publication Checklist for Individuals How to Inspect Documents Before Publishing IP address basics Reply risks and post-publication handling after reporting How journalists should think about anonymity Anonymity for journalists Contact methods and account separation for journalists Communication traces left by contact with sources Pre-publication checks for photos, video, and audio materials Checking metadata in reporting notes, recordings, and photos Pre-Publication Checklist for Journalists What Journalists Should Check Before Publishing Risks From Publication Timing and Location Information Publication Workflow for Protecting Sources and Yourself Risk of Source Inference From Published Stories Anonymity for Protecting Sources Threat Model for Protecting Sources Why personal stories, timelines, and expertise can reveal identity Metadata left in submissions and file sharing Checking SVG metadata SVGO and manual XML checks What Is Tails? What Is Whonix? Differences Between Whonix, Tails, and Qubes OS TCP/IP Basics The Difference Between TCP and UDP What Is Technical Information Correlation? What Is a Trust Model? What Is TLS? Basics for Making Routine Places Harder to Infer Risks From Location Information and Routine Places Why login state breaks anonymity How to Review URLs Manually What Is Metadata? Basics of EXIF and GPS Information What is a mixnet? How to Think About Mixnets and NymVPN Cautions About Mobile Networks and Anonymity Correlation Risk When Posting Across Multiple Sites Network Basics to Know Before Thinking About Anonymity What Is a Network Layer Model? Correlation Between Communication Time and Behavior Patterns Correlation Between Posting Time and Daily Rhythm Time Zone and Language Setting Risks Timing Correlation Between Events and Logs Packet and Routing Basics What Is NymVPN? What Is NymVPN?: Differences From VPNs and Tor Risks From Location Information, Movement History, and Routine Places What Is Place Correlation? Place and Time Clues How to Blur Place Names, Workplaces, Schools, and Routine Places Risk of Identity Inference From Past Social Media Posts Cases Where Past Posts Connect to Current Anonymous Activity Checking Old Blogs and Old Profiles How to Deal With Past Personal Information You Do Not Want Known Risks From Old Handles and Search Results How Old Images Affect Current Anonymity Anonymity for Ordinary Individuals Past Information Ordinary Individuals Should Check First Leakage of Personal Information Personal Information Left in Filenames How to Check Personal Information Left in Search Results Steps to Reduce Past Information Search Behavior Risks Cases Where Search Terms or Personal Information Remain in URLs Information Left in Translation URLs and Search URLs Checking Personal Information Left in Search Results How to Think About Reducing Information From Search Results What Is the Wayback Machine? Risks From the Wayback Machine and Archives Risks From Information You Cannot Delete After Publishing What to Pause and Check Before Anonymous Activity PDF Metadata Risks Invisible Risks Left in PDFs Preparation for People Starting to Post Anonymously Removing PDF metadata Metadata in Office files Video and audio metadata Identification risk from writing style Identification From Occupation and Affiliation Author Information in Office Files Metadata Risks in Office and PDF Files When Offline Protection Is Strong for Online Activity What Is OPSEC? Risks From Organization-Specific Language The OSI Reference Model and the TCP/IP Model How OSINT Breaks Anonymity What Is OSINT? What Are Port Numbers and Sockets? How to use Anonymity Sense The difference between HTTP and HTTPS Risks of reusing icons and profile images ID3 tag risks What is account correlation? Account separation basics What is account separation? Reply, backlash, and tracking risks after publishing Anonymity for activists How activists should think about anonymity Activist anonymity check Behavioral correlation activists should watch for Separating devices, browsers, and network environments Separating activist accounts and personal accounts Pre-publication checklist for activists Social media operation and account separation Surrounding information visible in photos and videos After posting Identification risk from replies after publication Why personal information becomes dangerous in the AI surveillance era Information that remains in AI-generated images Why the barrier to identification is lower in the AI surveillance era Text Anonymization in the AI Era Clues in Text That Can Suggest Identity How Text and Speech Can Break Anonymity Why Identity Can Be Inferred From Writing Style Topic Correlation What Is Tor? Tor Browser Basics What Is a VPN? Checks When Using a VPN Cautions When Using a VPN Why VPNs and Tor Alone Are Not Enough for Anonymity Differences Between VPN, Tor, and Proxy The Difference Between VPNs and Tor What Is a WebRTC Leak? What Can a Website See When You Access It? What to check if you are already posting anonymously Anonymity is not a "hiding technique," but judgment that reduces correlation Causes of anonymity failure The history of anonymity How to protect anonymity in a surveillance society Anonymity is determined by practice, not technology alone Anonymity is determined by services and practice The principles of anonymity Anonymity is not a tool for wrongdoing, but a technology that protects people Final Go/No-Go Check Before Publishing How to Choose Anonymous Communication Tools Cautions When Sharing Files Anonymously What Is Anonymous Practice? Final Checklist Before Anonymous Activity Operational rules for continuing anonymous activity Long-term operational habits Why One Mistake Can Break Long-Term Operation What is a browser fingerprint? Browser fingerprint defenses Browser fingerprinting basics How a browser displays a web page What Are Servers and Clients? Risks of Shortened URLs and Redirects Signs You Should Pause Before Publishing Risks From Social Media Posts and Search Results Risks from comments and tracked changes Common patterns that break anonymity Common failures What are communication logs? Basic Principles of Anonymous Practice How to Choose an OS or Environment for Anonymous Use Time Rules for Anonymous Posting Risks of Reusing the Same Image or Username Risks of Repeating the Same Posting Time Risks of Continuing to Use the Same Writing Style How to Separate Writing Style Between Real-Name and Anonymous Accounts Risks From Screenshots and Archives Risks From Screenshots, Screen Sharing, and Notifications Overview of services that support anonymity Overview of anonymous submission tools What Is OnionShare? Cautions When Passing Files With OnionShare What Is SecureDrop? What to Check Before Using SecureDrop What to check before choosing a username for an anonymous account Information that remains on archive sites and removal requests Anonymity checks when you have no plan to publish now What not to do after posting Precautions to avoid exposing family and friends What to check before transferring files anonymously Before posting Before sharing a link Before uploading a file Before writing Threat models for beginners Threat Models and Trust Models How to generalize proper nouns safely How to generalize region, workplace, and school information Risks of bringing real-name information into an anonymous environment Metadata that browsers can and cannot remove Identification risk from cameras, microphones, and notifications What is a CDN? What to check before publishing photos Children's photos and AI-era risks Cautions when choosing where to consult or submit How to clean a URL before sharing What to check before cleaning up old accounts Risks of cloud history and file sharing Cloud history and file creation environments Risks of cloud history, sharing history, and edit history Risks of cloud sharing links Risks of sending files through Google Drive, Dropbox, and social media DMs What is content correlation? Risk that a whistleblower can be inferred from the content Differences between cookies, sessionStorage, and localStorage Risks of cookies, localStorage, and IndexedDB Crossposting risk Data broker risk What is a deepfake? How PCs and smartphones communicate Device and browser separation Direct identifiers in personal information What is a DNS leak? Author and organization information left in document files Separating email addresses, phone numbers, and recovery methods Risks of event participation and posting time EXIF and GPS checks before publishing photos What is ExifTool? How to check metadata with ExifTool Why face photos, voices, and routine places can be misused Checking information that links to family, work, and school Thinking about metadata removal with FFmpeg GPS and Time Risks in Videos Risks From Voice, Ambient Sound, and Background Sound Metadata in PDF, Office, video, and audio files What to check first after an anonymity failure What is GlobaLeaks? Group chat and contact risks Hidden text and XML comments What does it mean to hide a network route? How the internet connects Specific Clues in Post Content Pre-Publish Checklist Checklist for Reviewing Text Before Posting Risks in Printouts, Scanned Images, and Photos The difference between anonymity, privacy, and security Why Anonymity Cannot Be Guaranteed Why Anonymity Literacy Is Needed Now Why You Must Not Leave "Not sure" Unresolved Why Information Is Hard to Remove Once Published What are private IP addresses and NAT? What is profiling? Digital checks before protests and civic activity How Routine Places Are Inferred From Public Information Public Wi-Fi and Anonymity qpdf / MAT2 Guide What Is Qubes OS? Risks of Searching for Anonymous Activity From a Real-Name Account Why Separate Real-Name and Anonymous Environments Why Separate a Browser for Anonymous Use Operating Without Mixing Real-Name and Anonymous Personas Why You Must Not Mix Real-Name Login and Anonymous Activity Checking Metadata in Files You Receive Why Replies and DMs Can Break Anonymity What to Do When You Notice a Risk After Publishing How to Review Old Posts The Roles of Wi-Fi, Routers, and ISPs How to Recheck Metadata After Removal Anonymity Is Never Perfect, But You Can Reduce the Gaps Regular Review Regular Self-OSINT Checks
Metadata
GPS and Time Risks in Videos Videos contain more information than photos.
Inside the file, the capture time, creation app, device information, and sometimes location information may remain.
In addition, the video itself contains backgrounds, signs, reflections, clothing, movement routes, voices, and ambient sounds.
When publishing a video anonymously, it is insufficient to think "I hid the face, so it is fine" or "I converted the file, so it is fine."
This article organizes GPS and time information contained in videos, and the clues that remain in video and audio.
Information left in videos Video files may contain metadata separate from the video itself.
Information Content Anonymity caution Capture time Time when it was shot or created Connects to event participation or movement time Location information GPS, shooting location Shows the shooting location or routine places Device information Smartphone, camera, app Clue to owned devices or work environment Editing information Editing software, encoding information Trace of work environment or re-creation File name Shooting date, place, case name Personal information remains on the outside
Videos are large files, and services often re-encode them.
However, you need to check for yourself what remained in the original file before upload.
When capture time becomes dangerous Capture time does not show a real name by itself.
However, when it connects to real-world events, it becomes a strong clue.
Scene What can be learned Video immediately after an event Possibility that the person was there Video during commute or school-commute hours Life rhythm and movement route Video at a workplace or school Affiliation and activity range Video at night or on days off Life pattern Capture time close to posting time Possibility of posting from the scene
Time is especially important in videos related to activity, reporting, whistleblowing, workplaces, or schools.
When capture time, posting time, local events, transportation records, and surveillance cameras overlap, the candidate pool narrows.
Location information and places inside the video Even if GPS is not left in the file, the place can be inferred from the video.
Signs, roads, station names, store names, buildings, views outside windows, in-vehicle announcements, and school or workplace notices become clues.
Clue Example Text Signs, station names, store names, notices Buildings Exterior, windows, entrances Transportation Trains, buses, road signs, announcements Indoors Whiteboards, documents, name tags, seating layout Reflections Glass, mirrors, vehicles, screens
A video has many frames.
Even text or reflections visible for only a moment may be paused and checked.
Before publication, check from beginning to end.
Voice and ambient sound Audio is also important in videos.
Voices, dialects, surrounding conversations, in-store announcements, station announcements, school or workplace sounds, and family voices may be included.
Even if the video is blurred, the audio may reveal a place or relationship.
Sound Anonymity caution Your voice Voice quality and speaking style become identifying material Surrounding conversation Names of people involved or places may be included Announcements Stations, stores, and facilities become identifiable Notification sounds App or device environment may be inferred Ambient sound Clues to workplace, school, home, and transportation
You may also need to decide to remove the audio, replace it with different audio, or not publish it.
Watch videos as if they will be paused Because videos flow over time, posters tend to underestimate brief appearances.
However, published videos are paused, enlarged, clipped, and checked frame by frame.
Momentary information What can be learned View outside a window Buildings, roads, area Documents on a desk Names, company names, case names Screen notifications Account names, contact details, two-factor authentication codes Name tags and uniforms Affiliation, school, workplace Reflections Shooter's face, device, room
When checking a video, do not look only at the overall impression.
In important scenes, watch while pausing.
Check backgrounds, reflections, text, notifications, faces, clothing, and belongings.
Correlation between video and posting time Video risk does not end inside the file.
It also connects to posting time and account operation.
Combination What happens Shooting time + posting time Suggests the possibility of posting immediately from the scene Event time + video content Narrows possible participants Background + life rhythm Commute or school route can be inferred Audio + place A station, store, or workplace becomes identifiable Account + posting pattern Becomes long-term behavioral correlation
Because videos contain a large amount of information, they also provide many materials for correlation.
For anonymity, do not look only at the video file. Also check the timing of publication.
Pre-publication check Before publishing a video, check in the following order.
Order Check Reason 1 Look at metadata Check capture time, location information, and device information 2 Look at the file name Check whether a date, place, or name remains 3 Watch the video through Check backgrounds, text, reflections, and people 4 Listen to the audio Check voices, conversations, and ambient sound 5 Recheck after re-encoding Look for new metadata and remaining information 6 Think about posting time Check whether it connects to presence at the scene or action time
Because videos take time to process, they are files where checking can easily become rough.
For high-risk videos, also consider options such as cutting them shorter, removing audio, using still images, or not publishing.
Videos that may be better not to publish Some videos cannot have their risk reduced enough even after editing.
Video content Reason Many participants' faces appear Involves people other than yourself Inside a workplace or school appears Affiliation and people involved can be inferred The area around home is identifiable Routine places are directly visible Internal materials or screens appear Document names, notifications, and account names remain Audio contains many proper nouns Even after processing, the content can be inferred
For anonymity, processing and publishing is not the only correct answer.
There are options such as not publishing, using still images, explaining in text, waiting, or having a third party check it.
In high-risk activity or reporting, handle the publication decision itself carefully.
Usable tools and limits ExifTool is sometimes used to check metadata.
URL : https://exiftool.org/
FFmpeg is used for video re-encoding and metadata processing.
URL: https://ffmpeg.org/
With online conversion services and online preview services, the video file, source IP address, check time, and account state may remain. For high-risk videos, prioritize local checking instead of uploading to external services.
However, tools do not judge the meaning inside the video.
Even if you re-encode with FFmpeg, background signs and your voice do not disappear. Even if you check metadata with ExifTool, name tags and notifications visible inside the video need to be checked separately.
Summary Videos may retain metadata such as capture time, location information, device information, and editing information.
In addition, backgrounds, reflections, text, people, voices, and ambient sounds inside the video are also strong clues.
Even if GPS is removed, station names in the video or in-store announcements may reveal the place.
Even if capture time is removed, participation may be inferred if it connects to posting time or event time.
Before publishing a video, check metadata, file name, video, audio, and posting time separately.
For high-risk videos, deciding not to publish is also important.
Related tools Reverse image search
Google Lens An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://lens.google/
Metadata inspection
ExifTool An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://exiftool.org/
Metadata removal
MAT2 An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://0xacab.org/jvoisin/mat2
Audio and video
FFmpeg An external resource related to this article. Open it only when it fits your situation and threat model.
Why it is listed: It can help with the article topic, but it is outside Anonymity Sense and should be checked before use.
URL : https://ffmpeg.org/
Related articles Metadata Video and audio metadata Metadata Thinking about metadata removal with FFmpeg Metadata Removing image metadata Metadata How Images Can Break Anonymity Metadata Risk of Identity Inference From Backgrounds, Reflections, and Text in Images Metadata Metadata left in submissions and file sharing
Back to article list