Privacy Guide

[piratemonkey]

"Arguing you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about freedom of speech because you have nothing to say."

Edward Snowden

 

In this day and age, privacy is a joke. Literally. I've joked about it with friends, family, and random people from the internet. It's become an expectation to be spied on by the government, companies, and random people.

 

This guide will help you be more private, anonymous and secure online

I want to help you make it harder for people to spy, keep records, target you etc. on you. 

 

If you have anything to say about this, don't be afraid to say something. I'm a big boy who can take CONSTRUCTIVE criticism. Don't complain without saying how it could be better

4 Notes

1: There will be links to videos and websites, I am not affiliated with these people or companies. They are another resource, to fact check, go into more detail, or be presented in a way that you prefer or like better.

2: The idea of privacy being a right, and privacy in general, can be political. My belief is that privacy is for everyone, regardless of who they are.

3: No solution is 100% bullet proof. The way you type, the way you talk, the way you use a mouse, what you search for, can all be traced back to you. I wouldn't worry about those micro things, unless you're Snowden.

4: Privacy is not always convenient. It's up to you if you want to be completely anonymous (or almost) online. Even if you just stop using some of Google's services, that reduces your online foot print and creation of data.

 

Network connections (VPNs, Tor)

Spoiler

There are a lot of misconceptions with VPNs and Tor. This is a big problem if you want to be anonymous

 

VPNs:

Most people think that VPNs are this amazing thing that you'd be stupid not to use. That's wrong, for the most part

 

Some things to consider about using a VPN is:

• Your ISP can't keep records of your traffic, but the VPN provider can
• You still log into a VPN with your IP address
• More recognized VPN providers will have IP addresses that can be recognized, which will tell services you use that you're using a VPN making you more identifiable
• Traffic is only encrypted from your device to the VPN servers, then it's on the web broswer, app, etc. to encrypt
• There are other reasons too, covered in this GitHub post: https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Unless you are on a public Wifi network, you want to not be tracked by your ISP, or get past firewalls, or using Tor (info below) don't use a VPN

Some of the only times you should use a VPN is:

• On public Wi-Fi
• On a Wi-Fi network with firewalls (school, work networks for example)
• Using Tor
• Don't want to be tracked by your ISP*

*You can circumvent ISP tracking using a VPN, but it can make it easier for agencies like the NSA to target you, as criminals usually use a VPN. It's up to what you want to achieve

Your ISP can also see you made a request to a certain VPN, but due to encryption won't be able to know what you requested. If the VPN doesn't track, no ISP will be able to see any requests

 

As for recommendations, preferably one that is audited.

I use ProtonVPN. It is open source. There are paid tiers, but you can use it for free, with acceptable performance. It has been independently audited by SEC consult, and Mozilla has reviewed their infrastructure. They do not log data. They are based in Switzerland. 

For PIA, the VPN that sponsors LTT, they are open source and claim they do not log, although I could not find an independent security audit done. It's worth noting that they have been subpoenaed several times, but all they produced was very basic info relating to the VPN server. That backs up their claims of no logging. They are based in the U.S.

 

Using HTTPS, and TLS/SSL will encrypt traffic
 

Tor:

Tor is thought of as this perfect, holy grail, unicorn tool that will make you anonymous online. By itself, it does not. In fact it can help identify you more than anything else

 

Vulnerabilities and weaknesses include:

• Multiple exploits to de-anonymize users
• Close ties with the U.S government
• Nodes can collect IP addresses, bytes of info, etc. by the people who set it up
• (Obviously) no warrant is needed to spy

This article by Restore Privacy goes into more detail about that: https://restoreprivacy.com/tor/

Using a VPN though, will prevent nearly all those concerns.
You'll want to connect a VPN first, then connect to Tor. That way it will be much harder to track you with an IP address.

Tor is used by Snowden, and he has said he recommended it to those he worked with at the NSA when they needed to have a very secure connection

Tor also hosts 'Dark web' websites.

Despite what you may hear, some of these are very good (but there are some very bad sites, just more rare than what may think). You can look at Bitcoin's Blockchain, anonymous news, etc. Always be very careful though when finding random .onion sites (dark web sites). You need the Tor browser to access these.

 

Browser and Search Engine

Spoiler

Your browsing and search habits can reveal a lot about you. This is your biggest maker of data. Luckily there are privacy respecting services

 

Browsers:

If you are using Edge or Chrome, be aware that both track you, like a lot

 

If you are using Tor, use the Tor browser.
If you are only using Tor sometimes, use Firefox.

Setting up Firefox so that it's truly private is beyond the scope of this guide.

• A video guide by The Hated One can be found here : https://www.youtube.com/watch?v=tQhWdsFMc24
• Mozilla's article for config tweaks can be found here: https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks

I do recommend doing all those tweaks as default Firefox is more private than Chrome, but can be enhanced a bunch
I currently use both Firefox and Chrome, the latter mainly for websites where I use accounts (youtube, this forum)
While it isn't ideal, it's ok for me. 

Making the switch to Firefox may be hard, as if you do want to be private, you lose a lot of creature comforts. In that case, use Chrome for only what you absolutely need.

 

Search Engines:

Chrome manipulates search results, and I'd imagine Bing and Yahoo! do too
DuckDuckGo doesn't, in addition to not tracking you.

I'd recommend using:

• DuckDuckGo
• Searx
• Startpage.com

I'd recommend using all of those to diversify your sources. I have found everything I needed just fine with those

Social Media

Spoiler

Chances are you have at least one account, and while there isn't anyway you can opt-out of their tracking, you can outsmart it.

 

On mobile, use PWA (progressive web app) versions. That means using your browser (Chrome, Safari, Firefox etc.) to use the service. This cuts down on how much the service can access everything (literally, everything) on your phone.

Because how insecure these platforms are, you can use Chrome or Safari for PWAs. Only use those browsers for the PWAs though

 

You can use a throw away email address for each service to reduce the chance of linking you and the data you produce elsewhere (Facebook has analytic type services on some websites; they have data about you even if you never used FB)

 

If you don't need an account, don't use one. This is mostly if you just use it to look at stuff, and not create stuff.

 

DON'T USE FACEBOOK, EVER

Phone Security

Spoiler

Despite marketing, both Google and Apple track you. Even if they don't, any apps you use can, and probably will.

There's a video by The Hated One that covers this: https://www.youtube.com/watch?v=tkY9dhOF2WU

 

Use PWAs for social media. They can't access as much info like a native app can.

 

App firewalls can go a long way. Use Netguard for Android, and Lockdown for iOS. It takes up a VPN slot for Android, but don't do anything private on a phone, unless absolutely needed.

 

Always presume apps can track your location. GPS, cellular, and even WiFi can give your location away. 
 

Decide if you want your bio-metric data shared with Google and Apple. Your fingerprint cannot be spoofed, or stolen (at least reliably) like a password, but you're sharing that info with Google and Apple.
 

Encrypt your phone. That prevents it from physical vulnerabilities, like theft. 
 

Don't use auto sign in. It's more convenient, but is less secure
 

Disable all telemetry. Even if you think that data sent is anonymous, it can be de-anonymized easily
 

Uninstall apps you don't need. It helps to identify you more easily, and those apps can collect data
 

Don't rely on a phone. I trust that regulars here use a laptop or desktop more, so good on you.
 

Use Signal instead of the default messaging app. It's easy to use. It encrypts messages between you and other.

Computer security (desktops and laptops)

Spoiler

Computers are so much more secure than phones. If you are doing anything private, do it on a computer. Please.
 

Don't use Edge or Chrome. Firefox, and Tor, are the way to go. See the Browser and search engine topics for more.
 

If you can, use Linux. Even if you use something like Ubuntu or Mint, it makes a difference.

The best distros are Tails OS for absolute security, and Whonix if you are using Windows, as it needs to be set up in a virtual machine.
If you can't, (and you're on windows 10) make some registry tweaks to disable telemetry. This article by The Windows Club shows how: https://www.thewindowsclub.com/windows-10-telemetry/
 

Where available use open source alternatives. Don't use Microsoft Office. Use LibreOffice For example.
 

When installing freeware, always do a custom install. You don't want to install anything except for what you want.
 

Encrypt your drive. This prevents anyone from getting at your stuff, if your computer was stolen, or if you live with other people for example.

Additional resources

Spoiler

These are cool peoples or sites if you're interested

The Hated One (youtube): https://www.youtube.com/channel/UCjr2bPAyPV7t35MvcgT3W8Q

Freedom of Press: https://freedom.press/

Restore Privacy: https://restoreprivacy.com/

DuckDuckGo's blog: https://spreadprivacy.com/

This is a work in progress. I encourage feedback. I want this to be the ultimate written privacy and anonymity guide.

I will continue adding onto this in the future. 

[wall03]

11 minutes ago, piratemonkey said:

snip

good guide

 

12 minutes ago, piratemonkey said:

Phone Security

  Reveal hidden contents

Despite marketing, both Google and Apple track you. Even if they don't, any apps you use can, and probably will.

There's a video by The Hated One that covers this: https://www.youtube.com/watch?v=tkY9dhOF2WU

 

Use PWAs for social media. They can't access as much info like a native app can.

 

App firewalls can go a long way. Use Netguard for Android, and Lockdown for iOS. It takes up a VPN slot for Android, but don't do anything private on a phone, unless absolutely needed.

 

Always presume apps can track your location. GPS, cellular, and even WiFi can give your location away. 
 

Decide if you want your bio-metric data shared with Google and Apple. Your fingerprint cannot be spoofed, or stolen (at least reliably) like a password, but you're sharing that info with Google and Apple.
 

Encrypt your phone. That prevents it from physical vulnerabilities, like theft. 
 

Don't use auto sign in. It's more convenient, but is less secure
 

Disable all telemetry. Even if you think that data sent is anonymous, it can be de-anonymized easily
 

Uninstall apps you don't need. It helps to identify you more easily, and those apps can collect data
 

Don't rely on a phone. I trust that regulars here use a laptop or desktop more, so good on you.
 

Use Signal instead of the default messaging app. It's easy to use. It encrypts messages between you and other.

 

ha i dont have a phone it turns out its much more secure that way

 

13 minutes ago, piratemonkey said:

Social Media

  Reveal hidden contents

Chances are you have at least one account, and while there isn't anyway you can opt-out of their tracking, you can outsmart it.

 

On mobile, use PWA (progressive web app) versions. That means using your browser (Chrome, Safari, Firefox etc.) to use the service. This cuts down on how much the service can access everything (literally, everything) on your phone.

Because how insecure these platforms are, you can use Chrome or Safari for PWAs. Only use those browsers for the PWAs though

 

You can use a throw away email address for each service to reduce the chance of linking you and the data you produce elsewhere (Facebook has analytic type services on some websites; they have data about you even if you never used FB)

 

If you don't need an account, don't use one. This is mostly if you just use it to look at stuff, and not create stuff.

 

DON'T USE FACEBOOK, EVER

 

Does LTT sell your info? @LinusTech legit wondering

14 minutes ago, piratemonkey said:

 

Additional resources

 

  Reveal hidden contents

These are cool peoples or sites if you're interested

The Hated One (youtube): https://www.youtube.com/channel/UCjr2bPAyPV7t35MvcgT3W8Q

Freedom of Press: https://freedom.press/

Restore Privacy: https://restoreprivacy.com/

spreadprivacy.com is DuckDuckGo's blog

[Statik]

This is a good post, but one thing that I think deserves to be mentioned about Tor.

 

While it's the "safest" method, it's kind of a pain in the ass. It's recommended in Tor that you disable Javascript, which breaks a lot of common websites, and it's also recommended that you never put any personal information relating to yourself in any way whatsoever into Tor (i.e. usernames, emails, real names, real stories, any personal info whatsoever), which greatly reduces ones online experience. So while Tor is nice, I feel it should be mentioned that it's almost impractical as an everyday browser due to it's possible security risks, slow load times, and breaking normal websites. I feel it's just something you have to tread carefully with.

 

I also feel you hit VPNs pretty well, but people should be aware that the vast majority of free VPNs will sell your information (gotta make money somehow), so once should take your advice and find a reputable company.

 

I also find that browser addons can be great. I use:

- DuckDuckGo (rates websites security, says they encrypt your data, and also blocks trackers)

- Addblocker Ultimate

- Privacy Badger (detects various trackers and after it encounters the same one on 3 websites, blocks it. You also have the option to manually block/whitelist certain trackers).

 

 

As well on my iPhone, I have the "Lockdown" app, which comes with a free Firewall that blocks adds and trackers (says it's blocked 2k trackers on my phone in the last 24 hours).

 

 

On a side note I also agree with your Facebook remarks, and made the decision that I'm going to delete my FB in the New Year, after I get back from some travels.

[piratemonkey]

Just now, wall03 said:

good guide

Thanks

1 minute ago, wall03 said:

Does LTT sell your info

Their privacy policy says they use Google analytics. They don't mention selling anything. Google most likely stores the data generated, cuz it's google

 

2 minutes ago, wall03 said:

spreadprivacy.com is DuckDuckGo's blog

I'll add it

[Statik]

2 minutes ago, wall03 said:

 

 

ha i dont have a phone it turns out its much more secure that way

 

It's funny because you're right on so many levels. It's actually insane how your cellphone is your entire life crammed into a small box that you take with you every where you go. I think that smartphones have ruined everything from peoples personal security, all the way to military OPSEC, for probably the rest of time.

[wall03]

Just now, Statik said:

It's funny because you're right on so many levels. It's actually insane how your cellphone is your entire life crammed into a small box that you take with you every where you go. I think that smartphones have ruined everything from peoples personal security, all the way to military OPSEC, for probably the rest of time.

its also not 100% necessary

[wall03]

3 minutes ago, Statik said:

 

I also find that browser addons can be great. I use:

- DuckDuckGo (rates websites security, says they encrypt your data, and also blocks trackers)

- Addblocker Ultimate

- Privacy Badger (detects various trackers and after it encounters the same one on 3 websites, blocks it. You also have the option to manually block/whitelist certain trackers).

this is funny

 

I have Ad block Ultimate, DuckDuckGo Privacy, U block Origin, and Ghostery

[Statik]

Just now, wall03 said:

its also not 100% necessary

No it's really not, but I feel society is moving in a direction that they are going to become 100% necessary. It's at the point where refugees are given smartphones when they arrive here, or at the point where homeless people have smartphones because they need them. It's almost a necessity at this point.

 

that being said, I could never get rid of my phone for my day to day life. However I definitely want to take the step to deleting Facebook like I said. I don't think I'll miss it once it's gone either.

[wall03]

23 minutes ago, piratemonkey said:

Computer security (desktops and laptops)

  Reveal hidden contents

Computers are so much more secure than phones. If you are doing anything private, do it on a computer. Please.
 

Don't use Edge or Chrome. Firefox, and Tor, are the way to go. See the Browser and search engine topics for more.
 

If you can, use Linux. Even if you use something like Ubuntu or Mint, it makes a difference.
If you can't, (and you're on windows 10) make some registry tweaks to disable telemetry. This article by The Windows Club shows how: https://www.thewindowsclub.com/windows-10-telemetry/
 

Where available use open source alternatives. Don't use Microsoft Office. Use LibreOffice For example.
 

When installing freeware, always do a custom install. You don't want to install anything except for what you want.
 

Encrypt your drive. This prevents anyone from getting at your stuff, if your computer was stolen, or if you live with other people for example.

 

Can you give me a tutorial on encypting my SSD in Linux? That would be useful

[piratemonkey]

3 minutes ago, Statik said:

This is a good post, but one thing that I think deserves to be mentioned about Tor.

I do agree with your points on Tor. With a VPN, and with https encryption, you should be fine if you're a normal person. I put a sort of disclaimer that for exact privacy, it isn't convenient. A lot of websites do rely on Javascript sadly, as it can reveal a lot of info about you if used maliciously. Even this website uses js for the typing of posts. just hover over the quote button or spoiler element and it'll say javascript. 

As for the add ons and duckduckgo, I have that under the browser section, and I linked to guides that showed how to set stuff up. It's beyond the scope of the guide

[Spotty]

5 minutes ago, Statik said:

I think that smartphones have ruined everything from peoples personal security, all the way to military OPSEC, for probably the rest of time.

That reminds me of when a fitness tracker app revealed locations of military bases overseas and the patrol routes of soldiers around the base.

 

https://www.bbc.com/news/amp/technology-42853072

[piratemonkey]

2 minutes ago, wall03 said:

Can you give me a tutorial on encypting my SSD in Linux? That would be useful

I know, I'm a hypocrite or whatever, I actually don't use Linux. That's because stuff I need to use is not on Linux. I will probably switch to it later in the year.

I'll see if there's some sort of open source tool

[Statik]

1 minute ago, piratemonkey said:

I do agree with your points on Tor. With a VPN, and with https encryption, you should be fine if you're a normal person. I put a sort of disclaimer that for exact privacy, it isn't convenient. A lot of websites do rely on Javascript sadly, as it can reveal a lot of info about you if used maliciously. Even this website uses js for the typing of posts. just hover over the quote button or spoiler element and it'll say javascript. 

As for the add ons and duckduckgo, I have that under the browser section, and I linked to guides that showed how to set stuff up. It's beyond the scope of the guide

Oh I missed that. Right on man!

 

10 minutes ago, wall03 said:

Does LTT sell your info? @LinusTech legit wondering

 

I don't think that LTT as a company is selling data, but trackers from google are everywhere.

[wall03]

Just now, piratemonkey said:

I know, I'm a hypocrite or whatever, I actually don't use Linux. That's because stuff I need to use is not on Linux. I will probably switch to it later in the year

maybe we could try to turn this into a mini wiki here where people could contribute info and edit it.

 

the feature would laos be useful in a computer guide I am working on

[Spotty]

26 minutes ago, piratemonkey said:

If you can, use Linux. Even if you use something like Ubuntu or Mint, it makes a difference.

I'm not too familiar with it, but I would throw out a special mention for Tails OS. It's a privacy focused Linux based operating system. Might be worth doing some research in to if that's the sort of thing you're after. 

[piratemonkey]

Just now, wall03 said:

maybe we could try to turn this into a mini wiki here where people could contribute info and edit it.

Maybe not an actual wiki where everyone can edit it, but I do want to continually update this.

The reason why I wouldn't want everyone to edit is because not everything is right. There's a lot of misconceptions about VPNs for example. 

[wall03]

1 minute ago, piratemonkey said:

Maybe not an actual wiki where everyone can edit it, but I do want to continually update this.

The reason why I wouldn't want everyone to edit is because not everything is right. There's a lot of misconceptions about VPNs for example. 

yes.

 

but if there was something like approving changes

 

sometimes I dont have the time or want to spend time doing it and other people say stuff is not accurate, it would be so much easier (example:

just see the comments)

[piratemonkey]

1 minute ago, Spotty said:

I'm not too familiar with it, but I would throw out a special mention for Tails OS. It's a privacy focused Linux based operating system. Might be worth doing some research in to if that's the sort of thing you're after. 

I forgot to mention what distros are the best. Tails is the best, and I think Whonix is also good, but only for a vm I think

[Spotty]

15 minutes ago, wall03 said:

Does LTT sell your info? @LinusTech legit wondering

The privacy policy explains what information is collected and why.

 

https://linustechtips.com/main/privacy/

Quote

Summary

In short, we collect information for the following purposes:

• To display publicly, because that’s the whole point of a public forum

• To help us understand how the site is being used, so that we can make it better for you

• To assist with moderation, because nobody wants the site to be filled with spam and abuse

• If you opt in, to send you updates about what Linus Media Group Inc is up to

 

We do not use information that we store to target advertisements, although advertisements may be targeted to you based on information collected by our advertisement partners on other websites.

 

We also do not share your information with third party companies, except where necessary to provide the services, as explained in section (3).

Quote

3. Information We Share

We do not sell, trade or rent your information to any third parties. However, in order to provide our services we have to share some of that information with third parties.

[...]

 

[Statik]

2 minutes ago, Spotty said:

That reminds me of when a fitness tracker app revealed locations of military bases overseas and the patrol routes of soldiers around the base.

 

https://www.bbc.com/news/amp/technology-42853072

I've never read that, that is actually insane, especially in a community where damn near everyone has some form of Fitness Tracker/Fitbit, etc. Not to mention the majority of people in the military aren't really tech conscious, so there's plenty of people who probably have location services on, their snapchat on public with SnapMap on, etc, etc. it's crazy.

 

I specifically remember when the Russia/Crimea issue kicked off, there was a photo leaked of a Russian solider who put a selfie online, and his location services automatically tagged his location, and it was in an area that the Russian government stated they had no personnel.

 

 

I also was told a story of how "Pro Russian" hackers gained the personal info of a Ukrainian Battalion, called their families telling them their sons had been killed/wounded, their first reaction was to call their sons/husbands, and all the incoming calls lit up their area like a Christmas tree, where they were subsequently rocket attacked.

 

It's absolutely mind boggling how big of a liability our phones and personal electronics can actually be/

[Drama Lama]

I don’t know if that was already mentioned 

no matter what vpn and tor and whatever else you use your internet provider always knows what you are doing

[piratemonkey]

7 hours ago, Drama Lama said:

I don’t know if that was already mentioned 

no matter what vpn and tor and whatever else you use your internet provider always knows what you are doing

I will make sure of these claims (almost every VPN's marketing revolves around this) then add it if I feel it's appropriate

[piratemonkey]

Updated a section of VPN (06/29/20)

[Energycore]

Yup, this post deserves a follow.

 

So I just installed the DuckDuckGo addon to Firefox which I should have done a while ago. What's this "DuckDuckGo Privacy Browser" for the phone though? Is it based on Firefox or Chromium?

 

Edit: Another relevant question: any info on whether WhatsApp collects data? Since it's now owned by Facebook I trust it much less.

[Intergalacticbits]

 

It seems like a bandaid on a gunshot wound to me though.

The effect of all this money to be made collecting data is that the social media stuff and what not seems like it constantly undermines any attempt by a user to separate their personal life from the online data collection.

 

I don't know what the answer is but It makes me feel like I can't speak, have a voice or use most social media.

Honestly I liked the internet better way back. 

When their was only boards with usernames and everyone was pretty much anonymous.

 

It was enjoyable to make friends with people I didn't know and just talk about things I liked.

It was a different fun experience, but now it is just like real life socializing.

In that it is so boring and you have to be so guarded, watching everything you say.

 

Seems less hassle to just say nothing.