# In a world with a single operating system, how can we avoid user tracking?

This is a world where all devices run on the same OS and which requires a unique login of everyone using the device. That is, each person has a single account and all devices log in with the same user id and password with iris or fingerprint-like unique login also. It won't be possible to log in with another user id.

So all devices get personalized according to users, like themes, ads, etc. according to that user.

In that scenario, how can we avoid or mislead the data tracking of the user?

• Comments are not for extended discussion; this conversation has been moved to chat.
– L.Dutch
Jul 13 '20 at 12:07
• The solution depends on the problem. Is the World OS so good that everyone uses it voluntarily? Does its producer make interoperability a nightmare, so it effectively prevents the creation of alternatives? Does the government force everyone to use the World OS? And who is doing the tracking - the government, or corporations? These scenarios are vastly different. Jul 13 '20 at 13:36
• What is it you dont want to get tracked? Not having your login logged is something different from not having your application level network traffic logged Jul 15 '20 at 9:09
• Maybe read Ready Player One? The OASIS can operate without severe data tracking because of severe encryption on GGS’s end (all servers are located in one city). Jul 19 '20 at 8:46
• As much as I like this question, I had to -1 (can't VTC:ND/C due to bounty). The problem isn't a one-OS-environment. I can compartmentalize any existing OS and ask about just that one OS (how to keep Microsoft from tracking you?) and the answers would be conceptually (if not actually) identical. Without knowing what the OS builders can do (can they detect and stop the development of independent encryption? How about detecting/modifying user-extensions to the OS, better known as "programs?") there is no legitimate answer. What would stop someone from hacking the OS to spoof/null the tracking? Jul 31 '20 at 6:02

Create a Bunch of Useless Data

Install a software on your device so it creates a bunch of useless and incorrect tracking data. The tracker gets your data but mixed up with a heck of a lot more data, and they cannot tell which is real and which is fake.

For example suppose you want to hide the list of websites you visited. While you are not browsing yourself, the software just browses websites at random. While you are browsing yourself it keeps a second window open and continues to browse at random.

Of course this leads to an arms race, where the tracker tries to decode by finding the least random part of the data-set, and the victim makes more sophisticated auto-browsing algorithms, that are not completely random, but have a bunch of less random parts thrown in to distract the tracker.

This has a lot of leeway for story potential. These software might be technically illegal but widespread enough that there is very little the government can do about it. I would imagine they occasionally crack down on someone either to make an example, or when it is particularly convenient for other reasons.

• Typically users who are trying to hide from or mislead a government that goes a bit overboard with the citizen monitoring want to draw as little attention to themselves as possible, and such governments typically aren't afraid to make examples of people (which is also quite effective at stopping 99.99% of the population from doing something, with those remaining having a fairly large target on their back). Jul 12 '20 at 9:39
• Assuming the government wants to prevent people from visiting certain websites, or discussing certain topics, unless the user's traffic is encrypted, the law enforcers can scan every request made by the user's device for the red flag keywords. So even if user's device provides tons of fake data transfers, the one time they searched for prohibited topic would still be recorded. In other words, if the trackers know what are they looking for, they will find it. Fake data transfers would only work if the trackers wanted to profile the user (for customer segmentation, for example). Jul 12 '20 at 10:02
• Relevant XKCD: xkcd.com/1223 Jul 12 '20 at 15:14
• @NotThatGuy The validity of this answer depends on the details of the world in question. For example who has access to the account and how evil are they? The question doesn't specify. Jul 12 '20 at 17:05
• There are already simple tools for that! adnauseam.io Jul 13 '20 at 13:25

In a world where all devices run on the same OS ... how to avoid or mislead the data tracking of the user?

Uh... Don't use the OS?

You've created your own inescapable scenario. There will always be free-thinkers, renegades, and round pegs in square holes (R.I.P. Steve Jobs). Developers and engineers would create private networks, protocols, devices, the whole kit and caboodle. The monopoly you've established would attempt to hunt them down and dismantle such things, I assume. Then the next idea would come, and the next, each more cunning, catchy, and clever than the last, until the system they create is too powerful for the God-Like OS (and organization behind it) in your world to control.

Heck, get an Enigma Machine and a pen.

## Voluntary identity theft

People in the lower class of society would be willing to unlock a computer (or sell the credentials) in exchange for money.

A stereotype-full example: person A needs to do an operation anonymously. A asks courier C to get an unlocked computer. C travels to a shady part of town, finds beggar B who doesn't use computers and doesn't have anything to lose. C gives B 10 bucks and puts B's retina in front of computer and unlocks it. C goes into settings, configures the OS so the screensaver never activates, attaches a fake keyboard that keeps the computer active, blocks input devices (camera, fingerprint reader) that can gather identity. Courier C goes back to A, sells unlocked computer for 1000$. A uses the computer with B's account. Granted, B's account would be a mess, but who cares. • It wouldn't take a lot of those machines in the wild, before a forced updated is introduced that disables not having periodically having your credential checked + random raids based on location. If you really want to put the lock down, force having some piece of hardware installed that will be able to uniquely identify you (say a camera and a microphone) and terminate the machine if either fails. Jul 12 '20 at 20:43 • "Hello friendly beggar. Would you mind accompanying me for a few hours in exchange of a sandwich and putting your finger in a fingerprint reader exactly every 2.5 hours?" Jul 12 '20 at 20:46 • and if measures get so draconic that beggars refuse the job, they will do it involuntarily, that's the nice thing about biometric data, you have no say in whether you supply them if there is someone that is stronger and meaner than you standing next to you. Jul 13 '20 at 1:27 • Reminded me of xkcd.com/538 Jul 13 '20 at 2:28 Identity theft Unless surveillance is total or the system is foolproof you can steal or fake another's credentials. Usual methods include not reporting a death to use the deceased's profiles or intimidating another user for their log in details. Hacking Similar to identity theft but more software orientated. Trick the system into thinking that you have submitted details other than your own or bypass the security system entirely. Alternatively prevent your computer from broadcasting any details of your activity. Again depends on the system having some technical vulnerabilities to exploit. Off the grid An extreme solution but very effective. If you have no contact with the system it cannot track you through direct methods. Difficult in systems where births/immigration are logged unless you have assistance or are somehow able to delete your existing data. • No digital system is foolproof; the best you can do is making the opportunity cost insanely high. However, doing so is usually impractical; it's equivalent to building a high-security bunker to store a single (non-collectible)$10 bill. Jul 11 '20 at 17:20
• Good point - although one would hope they wouldn't introduce a global information network without fairly decent security! Jul 12 '20 at 13:18

Is there any alternative to the omnipresent OS?

Privacy-aware technologists will allways try to produce devices that protect their users. These solutions will be able to compete with the ones provided by business or government. For example, there are:

So much of today's core technology is produced openly - there are public standards the manufacturers and developers adhere, so it might be possible for someone technologically knowledgeable to create a device that is able to connect to network infrastructure and yet to stay off the record. If the core technology design was not public to at least certain degree, its development would be close to impossible - the technological marvel we live at was only possible to reach through international open cooperation.

Some independent developers might promote privacy in technology for the sake of liberty, while corporate businesses might offer privacy as part of their business model. If the corporate business, or their client are powerful enough, they might even get an exception from whoever provides the omnipresent OS.

Also, even if the design was top secret and yet somehow the system was able to thrive (probably only possible in single-government autoritarian world), think of espionage and whistleblowing - some engineers developing the omnipresent OS might leak the design for whatever purpose, Rogue One style.

If the omnipresent OS was forced on all users only recently, there might still be some old legacy devices around. The technology is always build with some level of backward compatibility in mind, so chances are, old devices would still remain functional as they are working on infrastructure which is also necessary for the omnipresent OS. For example, banking systems and other core infrastructure systems are still running on COBOL, a 61 year old language : "Reuters reported in 2017 that 43% of banking systems still used COBOL (...) Efforts to rewrite systems in newer languages have proven expensive and problematic (...)").

If for some reason, alternative may not come to existence... Is it possible to fool the omnipresent OS?

If the login to the OS is performed trough fingerprint, or iris scanning, the people might devise a fake ones - for example copies of their own fingerprints (3D printed finger models) and exchange them. That way, if a group of people were carrying multiple "keys" and used random ones to log in, it would cause massive chaos in the data (the more fake copies were issued and the farther they were distributed, the bigger mess). I know you mentioned that it shouldn't be possible to login with others credentials, but I cannot see a reason why not - from technological point of view, any device can be fooled.

Implement end-to-end encryption.

If the person has to log in with their own ID, the least they could do is to implement end-to-end encryption. If the data is encrypted by sender and only receiver is able to decrypt it, there is no way the omnipresent OS developer would be able to read and manipulate the data, since, during the transmission, the data are incomprehensible mess. The location of user's log in and their ID would still be recorded, but at least contents of their communications would be safe. If asymetrical encryption is not an option - it is safer, but would require technology assistance, which might not be able to archieve in the omnipresent OS - the users may always encrypt and decrypt their messages manually as during the old days.

EDIT: As Vincent T. Mossman correctly suggested, if the encryption software is running within the OS, the message might leak before the enryption SW has a chance to process it (Keyloggers). But there are options to fool the omnipresent OS once more.

For sender, I can imagine external device that works as keyboard, but encrypts the messages before it mocks typing the encrypted message. Assuming the fictional world has USB, imagine an external keybord that has extra keys "start encryption" and "end encryption". Once first one is pushed, the keyboard stops sending the characters to the OS and starts storing them in memory (it might even display it on some mounted monitor). Once second one is pushed, the keyboard encrypts the message and starts typing it (sending characters to the OS) on its own. Therefore, not even low level keyloggers can detect the original message.

As for receiver, the process is trickier, but there might be device that also poses as peripheral device (monitor, printer), but performs the decryption and displays the original message on mounted monitor. The problem is that I cannot think of external peripheral that would receive character input - rather than graphical one - from the OS. The monitor and printer would most likely require some sort of OCR in place to detect what message should be decrypted in first place, but that's not unsolvable issue.

Therefore, the OS would percieve these devices as "dumb" peripherals and would have no way of knowing that they perform extra tasks - a keyboard that writes strongly encrypted messages on its own and a monitor that decrypts it. These smart peripherals would likely require a regular CPU and RAM, which might be hard to come by in your fictional world. In our world, such tasks would be performed by microcomputers such as Raspberry Pi, or Arduino.

Extra thought - if these devices were manufactured to look like the ones used elsewhere, the users might use them in plain sight: while working at their desk in the office, for example.

In case anything like this was not possible to achieve, that's why I suggested old fashioned encryption as backup plan.

Another option to hide the message from AI message scanners is hiding it in other transmittable data. The users might hide the message in a picture, or audio message in a way that it is not detected unless the file is manipulated in certain way (the receiver might filter out certain wavelengths etc).

Also, some dissidents were reported to have communicated by pictures of hand written messages, as handwriting is difficult to read by optical character recognition

Sadly, these options still leave the user exposed - if the world is authoritarian regime, the law enforcers might not need to get any actual evidence (i.e. decrypt the communication) in order to punish the citizen. If the suspicion is enough, then these methods only draw attention.

When all other means are out of question... Switch to pen and paper.

Pen and paper are digitally untraceable. They are traceable by DNA and fingerprints - CSI style - but if most of the people operate online, the old fashioned methods might go unnoticed, as law enforcers focus on more online communications. Such messages might be exchanged via dead drops.

Writing the messages provide physical evidence (which might be intercepted by law enforcers), but avoids recording by hidden microphones (which might be placed everywhere), so even if the people are meeting in person, they might choose to write the messages, rather than to speak.

Also, don't print the messages, but rather write them down by hand, since the printers print watermarks that makes the print traceable. If there was some underground resistance that needed to produce materials en masse, old fashioned Gutenberg print comes to mind.

Security cameras could capture the person's identity, so if they either meet in person, or use dead drop, they still need to cover their faces. There even has been some research on possibility to distort facial recognition by wearing extensive makeup. Even so, there might be motion recognition systems in place that would identify the people based on their movement patterns (walking etc.).

Most importantly, when going offline, don't even carry devices such as smartphone. Even if they seem to be turned off, they might be traceable.

• For further reading I reccomend Bruce Schneier: Data and Goliath, Julia Angwin: Dragnet Nation, Frank Ahearn, Eileen Horan: How to Disappear, Michael Bazzel: Hiding from the internet & Personal Data Security or Graham Day: Security in the Digital World. Jul 11 '20 at 15:13
• The problem I have with end-to-end encryption is the fact that the software used for such encryption is run within an Operating System. If one types a plaintext message in a word processor, encrypts it, and sends the message to have it decrypted by the recipient, then a leak could occur both at the sender and the recipients end due to the fact that they both must display human-readable text within the OS itself. Only transmission over the network is secure due to the encryption. You can only trust encryption as much as you trust the software that enables encryption. Jul 12 '20 at 0:05
• Good point, I tried to hint that, but I did not specify it enough, so thanks for follow-up. I added extra thoughts to that part. Jul 12 '20 at 9:13
• I'd argue that the Fairphone and Pinephone are better examples than the Librem, because Librem has a cloud ecosystem too; that wouldn't go very well with OP's premise. Jul 12 '20 at 11:22
• Sorry, but no. Please, don't use Caesar's cipher (or anything similar) in any modern-world-like (or even future) scenario. It's simply too easy to break, ridiculously easy, even. A rule of thumb is that if you can do it by hand with pen&paper, it's too weak. Similarly, if you've invented it yourself (not based on known maths), it's too weak, too. Jul 13 '20 at 15:01

Since the question is very vague, here are a few thoughts:

# Same OS?

"All devices run on the same OS" is a pretty naive statement. The main reason why we have tons of different operating systems (apart from business, ideological or preference reasons) is that different devices have different use cases, capabilities, user interfaces, ... so they all need different approaches.

For example, the OS of a car does very different things in very different ways than the OS in a smartphone. Sharing the same OS would be plain stupid in many cases.

So I think you mean something else:

# Everything runs on the same platform

The difference between OS and platform is that the OS is what runs your hardware, while platforms can work across OSes. For example, take Google. The Google platform works with an Android smartphone, Windows PCs, games consoles, fitness trackers and even smart fridges and whatnot. It even runs on lots of devices made by direct competitors, e.g. Google Maps runs on iPhones.

Also, your description of everyone having to login with their unique account is something that makes much more sense on platforms than on OSes.

Now, with that cleared up, why does everyone use this platform? The reason determines what can be done about it.

# Like Google, people use it because it works well

In this case, all you need to do to not be tracked by this platform is to not use it. Might be inconvenient, but there is nothing stopping you from not using their services. If your world is anything like the real world, there will be still tons of alternatives (because people like to make alternatives) but they will be rather small, due to the network effect. But again, nothing stops you from using alternatives.

Things are different if:

# The government enforces usage of that platform

If the government enforces usage of the platform, escaping it is a bit harder than just using alternatives. But there are still ways. But more on that later.

Another thing that the question does not clear up is this:

# Who actually wants to avoid the tracking, and who is doing the tracking?

Is it a Facebook situation where the platform itself is doing the tracking and the user wants to stop the tracking? Or is it a Cambridge Analytica situation, where some third party tries to track users using the platform while the platform owner wants to give only anonymized tracking data? The answers to those questions determine what to do against tracking.

### Platform wants to prohibit tracking

If the platform itself does not want the tracking, the answer is easy: don't track, or if you do, use something like differential privacy to thwart too evil data analysis.

### User wants to stop tracking

I am guessing, this is the question you actually wanted to be answered, but the OP wasn't clear.

There are a list of things that can be done here:

• Encryption in a higher layer.

Implement something like TOR, which sends user data over encrypted network within user data. So when they want to track, all they see is a ton of encrypted data sent to random targets.

• Bugusing

A huge platform like the one you envision has a lot of code and a lot of interconnected systems. Meaning: also a lot of bugs. Have a look at phreaking if you want some inspiration. Phreaking is quite retro, but the concepts are easy to understand and similar issues still exist nowadays.

• Identity theft

Since you have billions of users, you also have 100s of millions of rather technologically challenged users. Stealing their identities, at least for short periods of times, should not be that hard. Adding to that, since you rely only on rudimentary biometric login information, that isn't hard to fake at all. Unless you go for DNA matching, biometrics are comparatively easy to fake. And even if you go for DNA, hacking a sensor on a local device where the hacker has unrestricted physical access to it isn't that hard.

Hide important information in tons of unimportant garbage. Possibly combine this with a TOR-like network so that your hidden information is not plainly visible as such, but instead a stream of nice cat videos.

Related: Have a look at this video. It pretty much sums it up quite well.

That world would be a cash cow for pro hackers.

By either stealing personal data from the servers or by fooling the system (and ALL systems can be fooled) they could sell identities on the Deep Web. People with motives would pay a lot to log into the system with someone else accounts so they would not be accountable for their actions from the despotic government (that is despotic is pretty much clear or it would not allow a system like that).

Stealing data would be possible because:

• the hackers are the very same programmers who built the system. Or maybe have received valuable information from them
• no system is 100% secure, no matter what. The more complex it gets the harder it is to keep it safe. Usually the most unsafe element of the system is it's users. Click on this link darling and am going to be yours tonight.
• hackers may do criminal activities to get personal login data: burglary, blackmail, murder... imagine the scene: the hacker leaves the apartment with goldie's bowl. In it not the little fish but half a dozen floating eye bulbs.

Drag from the top of the screen, then tap the winged sex toy.

This will disconnect your device from Bluetooth, wifi, NFC etc.

When you do this, no hackers will be able to do any kind of deep inspection on your network traffic. They also won't be able to spoof your IP address, and they will be unable to get any data from keyloggers you may have installed.

Trust me, I'm an IT professional ;)

Some people are commenting that iPhones and other devices will still send info home even if you have disabled communication in all forms through the OS's regular operation. You would do yourself an extra favor then by discarding the SIM card and messing up the device antennas. Keep it in a small Faraday cage as well. That way you can play Candy Crush without government surveillance.

• This wouldn't work; hackers would cope by caching data until you turn the WiFi back on again. Jul 11 '20 at 17:14
• @TheDaleks I never mentioned turning it back on ;) Jul 11 '20 at 18:52
• This would be fairly easy to prevent by requiring you to be online to do anything. If this does work, one has to wonder how useful the device even would be at that point (presumably even more apps would require a connection than those that do today) and why you aren't just leaving it at home. Jul 12 '20 at 9:34
• Ironically, you chose a screenshot from an OS that's known to still communicate even with flight mode turned on, and that's known to automatically turn WiFi back on every day... Jul 12 '20 at 11:00
• If it's a dystopian world where the OS is used by the government to spy on you, then as soon as you click on that "disable communication", it will only stop user-initiated communication. The comm hardware won't stop, it will only lie to you that it has been stopped. Your account will be flagged as one who wants to be sneaky, so they will focus more on you. (this has been done with some smart TVs. On default, it scans every usb drive you plug in and sends the file names to the manufacturer. You can "turn this feature off", but it will only set a parameter, and will still send the file list)
– vsz
Jul 12 '20 at 11:44

Introduction

Let's first ask ourselves how such circumstances could have occurred. I know for sure that if my OS had tracking software built into it, I wouldn't use that OS. I would use and preserve alternate options (like the open-source Ubuntu). So if all devices use the same OS, and everyone is fine with it, then people like me would have to be satisfied that it's privacy-conscious. (Or we have no choice, but that's not the scenario this answer is working in.)

Since this is a long answer, containing a bit of real-world background information on how certain steps are accomplished, this answer is split into sections.

1. Introduction elaborates on the answer itself for the purpose of readability, and gives some justification as to this answer.
2. The Operating System restates the properties of the operating system, and also reiterates the question: "How to avoid data tracking".
3. How to Keep My Privacy While My Data is On Someone Else's Computer(s) describes how I can keep my personal data secure while it is stored somewhere publicly accessible, through use of encryption. It also introduces the concept of the encryption key, which is utilized throughout this answer
4. How to Store My Data describes two methods of how the OS might store my encrypted personal data where it would be accessible from any device, as well as the downsides to one method. It also provides hints as to how the other method would work.
5. How To Prove That I Know the Key describes a method to verify that I know the encryption key (as introduced in section 3 "the section with the obnoxiously-long title").
6. How This System Would Work describes the back-and-forth between the client and server to obtain my personal information (given that the client knows my password).
7. Vulnerabilities points out two key vulnerabilities of the client, as well as how these vulnerabilities can be mitigated. It also notes that one of these vulnerabilities still is problematic.
8. This Answer is Incomplete describes in what way this answer fails to completely fulfill the requirement (remote biometric authentication doesn't seem to be a solved problem)
9. Conclusion wraps up this answer, and summaries this answer, so that this answer is a proper essay that first tells you what it's about to tell you, tells you the thing, then tells you what it told you.

The Operating System

Let's consider the properties of the operating system you've described:

1. Each user has a universally unique user account.
2. User accounts can be accessed using the password, or by biometrics.
3. Each user account has associated data accessible from every hardware device.

Given these three properties, you want to prevent data tracking.

My answer is this: these three properties do not necessarily mean that the OS needs to do things leading to.

How to Keep My Privacy While My Data is On Someone Else's Computer(s)

First, let's talk about encryption. If all of the personal data that leaves my computer is encrypted with a proper encryption method (such as AES with a 256 bit key), then it will be nearly impossible for my data to be read. The hardest problem is remembering this key. Of course, I already have a piece of unique secret information: my password!

However, a password is usually a piece of very structured data (good passwords from password managers are not, but they aren't easy for me to remember). This makes it unsuited as as an encryption key. However, there's a technique called "key stretching" which would transform the password into something more suitable as a key. Here's how it works:

I take a cryptographic hash function (let's say, SHA256, or "SHA" for short) and apply it to my password. That would make my password SHA(password). This would be good, except for one thing: everyone who uses, for example, "password1", as their password would have the same encryption key, and so they would be able to access the data.

To combat this problem, we'll introduce the concept of a cryptographic salt. This is a few dozen random characters that are attached to my account. If I run SHA on the password combined with the salt, I'll get a key that would be more unique. It would be SHA(password + salt) rather than SHA(password).

As an example, if my password was "password1", and the salt of my account was "dQw4w9WgXcQ", then my cryptographic key would be SHA("password1dQw4w9WgXcQ"), or 0x4ed2e22de84841eea0ccb02efb8d3ce2c7dfe092c4ef96c25aa0d3fa816b0a05.

With this key, I can encrypt my user data, and feel safe that unless someone knows both my password and my salt, they won't be able to read my user data even if they had all of it.

How to Store My Data

Now that I have my encrypted personal data, I need a way to store it so that I can get it from any computer. There's two ways we might accomplish this for the OS:

1. We can store all the data on one big computer.
2. We can store a little bit of the data on lots of small computers.

There's multiple reasons to favor one option above the other. Storing all the data on one big computer has the advantage of simplicity. It's really easy to wrap your head around this. However, it comes with some downsides. For example, if the big computer (aka. the "server") breaks, then we either have to hope we have a backup, or everyone's personal data is completely gone. Or, if the owner of the server decides to hold your data for ransom, they can do so.

However, either option will fulfill the requirement that I can access all my user information from any device. So, while I might not elaborate on how it would be possible to store my data by putting a little bit of it on lots of small computers (or "a peer-to-peer network"), rest assured that it is possible. (Note: this is how torrenting works.)

How To Prove That I Know the Key

My account, on top of having a salt and user data, has two additional pieces of privileged data: a public and private key pair. The private key, of course, is encrypted behind my encryption key. The public key, being public, is accessible to the public.

So, I have four pieces of user data:

1. My salt, which is public,
2. My public key, which is public
3. My private key, which is encrypted, and
4. My user data, which is encrypted separately from my private key.

If I encrypt something using my private key, it can be decrypted by the public key. This may not seem useful, since everyone theoretically might have my public key. However, I could have only encrypted the message if I had the private key. So, if someone who knows my public key sends me a random number, I can encrypt it using my private key and send it back to them. They would then be able to decrypt it, and verify that I have the private key.

But private keys have very specific properties, and so I can't just get a random 256-bit number and call it a private key. And how does having the correct private key prove that I have the encryption key, anyways?

The solution is that if everyone knows what my private key looks like when encrypted, they can send it to me, and I can decrypt it, and use it to sign a random number. They verify the signed random number. Thus, they know that I knew the private key. Since the private key is not known except for the encrypted version, that also proves I could decrypt the private key (or the private key is known to me, which is a more secure state than using passwords to protect my data), and thus that I have the encryption key.

This was a bit complicated, so we'll just call the entire procedure "verifying my identity", and if you didn't understand or read the procedure, you can take it on faith that it works.

How This System Would Work

The "me and my computer" system is called the "client". For simplicity, we'll call the place that stores all my data the "server", even if it's a peer-to-peer network.

2. The server sends me the account's salt, encrypted private key, and a random string of characters.
3. The client computes my encryption key using the salt and the password I entered.
4. The client verifies my identity.
5. The server sends me my personal information.
6. The client decrypts this information.

And now I have my data accessible on any device, but only if I know my password.

Vulnerabilities

There are two major vulnerabilities of this method. First, if your password is easily guessable, then someone could guess it and gain access to all your personal data. This is solved with modern techniques: either have a really random password, or use a password manager. The second is more insidious:

An attacker could create a device that looks like it has the OS loaded on it, but it secretly reports my username and password to the attacker when I use it. This is similar to a web attack where a website is made to be completely identical to the genuine website, and has a URL like "google.com-[something].com" in hopes of someone logging in to steal their passwords. However, unlike that attack, this vulnerability can't be detected by reading the URL of the webpage.

Unfortunately, I can't give a good solution to this second vulnerability (perhaps some sort of "makers' mark", or an anti-counterfeiting mark on genuine devices which cannot have the OS modified might work, but they aren't good solutions, and seem like they might be easily bypassed).

This system as described doesn't really have the ability to use biometrics to sign in. If you're alright with that, then that's fine. Biometrics are really insecure, anyways.

But if the feel of the setting really requires biometrics, then a RFID implant might fit the feel just as well or perhaps better, while still maintaining security.

Conclusion

First, I began with a reading of the question as "How can a universal OS with certain specific characteristics prevent data tracking above and beyond what we already have today?" rather than the more prevalent "How can I fool a universal OS to prevent data tracking if the OS itself is doing data tracking?"

Second, I introduced essential concepts, and outlined how an OS could be designed.

Third, I pointed out two key flaws in this design, and highlighted where this answer does not completely cover the question.

Fourth, I explained how to mitigate one of the key flaws, and how to make an analogous replacement, changing "biometric authentication" to "RFID-based authentication" for the purpose of maintaining the feel of the setting.

• +1 for the rickroll and technical knowledge Jul 13 '20 at 17:38

# If the OS is controller by a central authority you can't

If someone has absolute control over your OS, the first thing they would do is make it impossible for you to write your own software; the only software that's running on that machine is sanctioned by the central authority and you're screwed for life.

Unless... Of course there's an unless. If there's some flaw in the system that makes it possible to fake the credentials of the central authority, it would be possible to write software of your own and install that. That's reasonably easy to make useless, by simply replacing the central authority credential often and banning anyone from the network, that doesn't have the right keys installed (which only the central authority can generate).

So, if your OS is controlled by a central authority, you're screwed.

• Well, the only people who ever really have control over your OS are the people who wrote it. They own your device. They can make it do anything they want, and they can install any software they want. They can make you believe that the device is yours, but in reality, it's theirs. (Do I still need to mention stuff like "secure boot", "locked bootloader", "trusted software", etc?) Jul 13 '20 at 8:51
• You also have to take into account the typical personalities of programmers. They enjoy challenges and puzzles. Trying to prevent them from writing software will be seen as a personal challenge, if not an outright competition. People will return to punch-card machines, writing assembly code by hand in a hex editor. Heck, I've even seen people write C code using MSPaint. All a lockdown will do is make people really, really good at finding code injection vulnerabilities.
– bta
Jul 13 '20 at 20:12

Raw Intimidation

The bad guys can just use enough brute force or external pressure to make people log themselves into the OS. Someone can threaten a victim's family to get what they want - access to the person's account. Or they could threaten them with physical violence. It's simple, but effective.

Every global system has administrators. Threaten them!

• First you have to identify whom to threaten. The whole point of this operation is to prevent their knowing.
– Mary
Jul 13 '20 at 21:28
• @Mary i'm afraid i don't see that in the wording of the question, where would that be? Jul 14 '20 at 1:44
• This idea works well if the user trying to avoid tracking is not a chaotic-good dissident working to overthrow the dystopian surviellance, but rather a lawful-evil mobster, which is a case that no other answer seemed to consider. Jul 14 '20 at 17:15

What you describe is not a technical problem. It's a social problem. You have created a society where this behavior is so desirable that nobody defects, and everybody just works with their one ID. The social problem is what has to be remedied.

Consider that you just created one number which uniquely identifies each person in the world. In the US, we have an equivalent of this: the Social Security number (SSN). Just look at how much trouble we have with this already, and SSNs are universally treated with tremendous privacy and security concerns. A universal ID which every gumball machine needs to have is going to create a nightmare.

So basically, you will have security problems out the wazoo, and the privacy of your browsing history will be far from the largest of them. When the commenters mention dystopia, they are right. Imagine being the target of a present-day credit fraud every day of the week. That's the kind of concerns you will have.

Also, what if you lose this key? Now you are in a life threatening situation where 100% of computers think you should be able to identify yourself, and you can't. This could be a terrible thing indeed!

This is as social problem, and you will have to solve it within the social structure for your world. However, there is one particular technology which might be useful for you: Zero-knowledge proofs (ZKPs). ZKPs are fascinating proofs which permit you do do things like identify yourself as part of a group of users without having to reveal any other information, such as who you are. There's a classic example of how such a proof can be done:

There's a mountain with two cave entrances. I claim that there's a path between them, but you don't believe me. We decide that this is worth \$1000, but how can I prove that I actually know the path without showing you, and you following me (so that now you can choose not to give me the \$1000 because you already know the path).

In a ZKP, you could close your eyes, and I go into one of the entrances (randomly chosen is best for the proof, but not essential). Once I am in the caves, you open your eyes, and shout to me which cave entrance I should come out of. If I have a path through the cave, I can do this 100% of the time. If I do not, I can only do this 50% of the time. This process is repeated until an arbitrary certainty threshold is met.

You might hold onto a device which you trust more than other devices which knows your identity. It is responsible for negotiating with the other devices to give you access without revealing your personally identifiable information. It's only a part of the solution; the solution has to be social. But it could be a useful way to start un-painting yourself out of this dystopian corner!

• Dystopia or Utopia really depends on the point of view and the details. If it works in that world with most people happily using the system without explicit pressure, then maybe it mastered most pitfalls and actually provides benefit rather than drawback. Speaking of the SSN, there are countries that have individual passports and people are just doing fine, even retaining all their democratic rights (at least from their point of view) and not running into fraud problems. Think of Star Trek; it seems - at least within star fleet - they have such a system (except for the ads). Jul 13 '20 at 1:37

That is, each person has a single account and all devices log in with the same user id and password with iris or fingerprint-like unique login also. It won't be possible to log in with another user id.

Easy to say, nearly impossible to implement with a zero chance of work around.

Anyone who has watched a spy movie knows there are multiple work arounds for 'iris or fingerprint-like unique login's

The simple work around is taking a password, finger and/or eye from a dead person who has not been listed as dead.

## Exploit the backdoors

They aren't meant for you, of course, they are meant for top-secret government agencies such that even other government agencies aren't allowed to know about them without need. But they will be there, if only for the government to be able to have agents that check up on those who are tracking without being caught themselves.

• Great idea. Hack the hackers trough their own hacks. I would only add that finding those backdoors would require some knowledge of the system (leaked design), or reverse engineering, which could draw attention - if someone is trying to penetrate the system, the unsuccessful attempts would likely leave noticable tracks, leading to punishment of those hackers before they can successfully document the backdoors, let alone exploit them. But in general, the backdoors exists and are exploited, so it's not unreasonable idea. Jul 14 '20 at 17:07

This is a world where all devices run on the same OS and which requires a unique login of everyone using the device. That is, each person has a single account and all devices log in with the same user id and password with iris or fingerprint-like unique login also. It won't be possible to log in with another user id.

There is always another way to log in as someone else. Biometrics are actually a bad password method because of the fact that they can't be changed.

Thumbprint and iris scanner take an image and convert that into numbers. Now imagine I take a thumbprint or iris scanner and mod it so it records said numbers as it passes through. I can then make a fake scanner that always returns the same numbers. I can now log in using your thumbprint and you can't change it.

Alternatively for a low tech solution I can extract your thumbprint from a scanner you just used and transfer to a glove and now I can access your account.

There is no such thing as perfect security. Every system can be exploited.

The world is full of what are often called "embedded devices" or "Internet of things" devices. These are special-purpose computer systems that are a sub-component of a larger machine. Your microwave is controlled by one, there's one inside your monitor that converts a video signal to dot patterns, there are several inside your car, etc. These systems have no interface. There's no way to sign in (can you imagine trying to log into a pacemaker or satellite?). Therefore, your "universal OS" can't actually be the only option. Either there are other, less-common OSes available that you could switch to, or the "universal OS" has a stand-alone mode with no telemetry or login requirements that you could leverage.

Heck, you don't technically even need an operating system in the first place. They make things a lot easier, but you could run completely bare-metal and code your device to do whatever you wanted it to do.

If for some reason you have some sort of platform restriction that makes it unreasonably difficult to replace the OS, you can avoid tracking using the same sort of techniques you use in the real world. Do everything inside a virtual machine that encrypts all data streams and provides minimal (or falsified) information to the host OS. Inject a software layer on top of the OS that intercepts and blocks or falsifies requests for tracking-related information (like PMP or xPrivacy does for Android). Set up a firewall that intercepts and blocks all traffic to the telemetry servers (like a PiHole). Point your device to a fake telemetry server that looks real enough for the end device to function, but doesn't actually log or track anything.

I have a few ideas, but most of them probably won't work. Here they are anyway-

1- Steal another users device after he logs in past the security checks. if it has a camera, cover it up so it can't say 'new user detected, logging out now' or something like that. stay away from the id-ing whatever sensor so it doesn't log you out automatically. of course, the police might come after you for stealing the device, but depending on your story they might already have that problem. Also beware any tracking devices it may have.

2- Kill a guy, steal his finger/eye/login stuff, and use his account as the one you don't want being tracked. Will probably only work until the admin AI or whatever realizes the guy is dead and shuts off his account, then it might look into what that account has been looking at, and then the whole plan could come down.

3- If your characters are/know a hacker, maybe they can jailbreak the device or account so that it can receive information(internet, view websites, etc), but not send. This might raise severe difficulties, as you won't be able to post anything on the web. to use effectively, you would first have to open every website to allow the device to send the initial query, then let the website send the information and other stuff. Once it's open, cut off the outgoing data so you can't be monitored. You can keep the sites open as long as you want, assuming your device isn't lagging from all the new tabs, and browse all the opened tabs without being tracked.

EDIT- a few new ideas I had, also stupid, but here it is.

4- find an old OS from somewhere(Rasbian, whatever chromebooks use, Windows, etc. )and use that. archive.org, if its around in your story, might have at least one. if you can't get one, make one or have a hacker make one. even if its very primitive, the only thing it needs to do is stop the tracking.

5- find wherever the data is being stored, break into the server farm, add one of those convenient little hacking usb sticks from basically any movie programmed to delete all data linked to X account, and bam- untrackable until the usb stick is taken out.