Professional Documents
Culture Documents
Ladies and Gentlemen, here it is. Weve put a lot of effort into this, and its very long. We
tried to think of every angle in terms of privacy, and the effort was worth it. Almost 13,000
words about how to protect your privacy online. Theres no need to read it at once, just check
the index below and click on the parts that interest you.
Index
Introduction
So how secure is encryption?
Bitcoin
Other anonymous payment methods
VPN
Tor
Other ways to stay anonymous online
Use TrueCrypt
o Mobile options
Antivirus
o Free vs. paid-for antivirus software
o Some good anti-virus software
Anti-malware
Firewalls
o Some good firewall programs
Conclusion
Introduction
The recent (and ongoing) NSA spying revelations have highlighted just how much we have
sacrificed to the gods of technology and convenience something we used to take for granted,
and once considered a basic human right our privacy.
It is just not just the NSA governments the world over have been racing to introduce
legislation that allows to them to monitor and store every email, phone call and Instant
Message sent or received, every web page visited, and every VoIP conversation made by
every single one their citizens. Parallels with George Orwells dystopian world ruled by an
all-seeing Big Brother have been bandied about a great by the press of late, but are
unfortunately depressingly accurate.
All is not lost however, as encryption provides a highly effective way to protect your internet
behavior, communications, and data. The main problem with using encryption is that its use
flags you up to organizations such as the NSA for closer scrutiny.
Details of the NSAs data collection rules can be found here, but what it boils down to is that
data from US citizens is examined, and then discarded if found to be uninteresting to the
NSA. Encrypted data on the other hand is stored indefinitely, until such time as the NSA can
decrypt it. All data relating to non-US citizens can be kept indefinitely, but sheer practicality
suggests that encrypted data gets special attention.
If a lot more people start to use encryption, then encrypted data will stand out less, and
surveillance organizations job of invading everyones privacy will be made much lot harder.
Remember anonymity is not a crime!
A 128-bit key cypher would require 3.4 x1038 operations to reliably break
In 2011 the fastest supercomputer in the word (the Fujitsu K computer located in
Kobe, Japan) was capable of an Rmax peak speed of 10.51 petaflops. Based on this
figure, it would take Fujitsu K 1.02 x 1018 (around 1 billion) years to crack a 128-bit
AES key by force
In 2013 the most powerful supercomputer in the world is the NUDT Tianhe-2 in
Guangzhou, China. Almost 3 times as fast as the Fujitsu K at 33.86 petaflops, it would
only take it around a third of a billion years to crack a 128-bot AES key. Thats still
a long time, and is the figure for breaking just one key
A 256-bit key would require 2128 times more computational power to break than a
128-bit one
The US government itself uses NIST certified 256-bit AES encryption for sensitive
data (and 128-bit for routine encryption needs)
Although it is impossible to predict how things will develop in future, 128-bit
encryption is generally considered uncrackable for another hundred years or so
There are of course ways to break cyphers that do not involve brute force attacks, such as
exploiting weakness in a cypher. Despite a great deal of effort however, no weakness has yet
been found in cyphers such as AES. Other techniques, such as infecting target computers with
viruses, and mechanically recovering keys from discarded hard drives, are also possible. It is
good to remember that no matter how good an encryption key is, if it protected by a password
then it is only as strong as that password (so if possible, dont do it!)
In general, it is fairly safe to say that decent modern encryption methods are highly effective.
If an adversary as powerful as the NSA really wants your data, they MAY be able to get it,
but doing so would require considerable expenditure of resources and effort. For most of us
who are not being targeted as potential terrorists or mafia crime lords, even 128-bit encryption
is more than enough to heavily obfuscate our data and make even the NSAs job much harder.
As Matthew Green, a cryptographer and research professor at the Johns Hopkins University
Information Security Institute in Baltimore put it,
We have no idea what the NSA can do. However its reasonable to assume that even if they
can break modern encryption schemesa pretty big assumptionits going to be pretty
expensive for them to do so. That rules out massive non-targeted eavesdropping on encrypted
connections.
Also do not forget that the NSA is not the only organization wishing to spy on us, and these
other adversaries (such as the army of hackers and criminals in existence) will almost
certainly not have the available power, reach and resources that the NSA has.
Government agencies are much more likely to exert legal pressure on companies (through
court orders, subpoenas etc.) to hand over encryption keys (and issue gagging orders to stop
them alerting customers). As Edward Snowden himself put it,
Encryption works. Properly implemented strong crypto systems are one of the few things that
you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can
frequently find ways around it.
Update 9 September 2013: In the last couple of days the massive scale of the NSAs efforts
to break or otherwise compromise encryption standards has become publicly available thanks
to Mr Snowden. While details are somewhat thin on the ground, it seems that thanks to NSA
strong-arming, no commercial proprietary encryption standards or software can be trusted not
to have back doors built in, or to be otherwise deliberately weakened. In addition to this, any
encryption based non-ephemeral key exchange (i.e. any encryption not protected by Perfect
Forward Secrecy see below) is not just potentially vulnerable, but is now actively suspect.
This includes almost all TLS and SSH (i.e. https://) connections.
However, it also appears that the NSA and GHCQ face sizeable challenges when faced with
strong encryption (such as AES). This point was borne out by the fact that the UKs Scotland
Yard was unable to access most of the files on David Mirandas hard drive, because True
Crypt renders the material extremely difficult to access.
The observations above therefore still stand. As Bruce Schneier, encryption specialist, fellow
at Harvards Berkman Center for Internet and Society and privacy advocate says,
Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing
can compromise it. Thats how you can remain secure even in the face of the NSA.
We discuss the NSA decryption program revelations in more detail here and here.
Metadata
An important limitation to encryption is that it does not necessarily protect users from the
collection of metadata. Even if the contents of emails or voice conversations cannot be readily
listened in on, knowing when, where, from whom, to whom, and how regularly such
communication is made can tell an adversary a great deal, and is a powerful tool in the wrong
hands (i.e. just about anybody).
For example, even if using a securely encrypted end-to-end voice service such as Silent
Circle, your ISP (and anyone else watching) will still be able to tell who you are making the
call to, whether you are calling from your usual location, how often you call, how long you
usually chat, and much more. With such information it would be trivially easy to discover that
you were having an affair (for example)
However, the reason we said not necessarily protect users is that technologies such as VPN
and Tor do make the collection of metadata very difficult. In the example above, if you
always connected to a VPN service when using the internet, all a watcher could tell is that you
are connected to a VPN server, not that that you are using Silent Circle, let alone where and
when you are using it
Although the NSA does target individual communications, its primary concern is the
collection of metadata.
Probably the first step to improving your privacy is to pay for things anonymously. Of course,
when it comes to physical goods that need to be delivered to an actual real-life address, this
isnt going to happen (except for good bought locally with cash). Online services are a
different kettle of fish however, and it is increasing common to find ones that accept payment
through Bitcoin and the like. A few, such as VPN service Mullvad, will even take cash sent
anonymously in the post.
Bitcoin
Use anonymous, disposable email addresses (such as those supplied by Tor Mail)
Create a new Bitcoin address (wallet) for each purchase if you use the same address
then one mistake will allow all transactions to be traced back to you
Never reveal personal information such as your real name, address, or phone number
Use a mixer service even if you use one of the more anonymous methods of
purchasing Bitcoins outlined below, it cant hurt to launder it further (although this
will cost a bit).
VPN
A Virtual Private Network helps to ensure privacy by creating an encrypted tunnel between
your computer and a remote VPN server.
Example setup without VPN: Home PC -> ISP -> Internet
Example setup with VPN: Home PC => ISP => VPN server -> Internet
Once data has entered the VPN tunnel (==) it is hidden from view by encryption protocols
so that no-one, not even your Internet Service Provider (ISP), can see it. The only
computers that can see the data are the ones at each end of the VPN tunnel (bearing in mind
the comments we made regarding encryption at the beginning of this guide).
Because the VPN server can see all data going into and out-of the tunnel (and trace it back to
you), it is vital to choose a VPN provider you trust, and who keeps no logs of your internet
activity. If you are concerned about privacy then you should never pick a VPN provider who
keeps logs, and the comments below assume a no logs service. Providers we particularly like
that are good for keeping no logs are Mullvad, AirVPN and Private Internet Access (although
the fact that PIA is US based has introduced considerable uncertainty to this
recommendation).
Pros:
Cons:
As long as your VPN provider is trustworthy and keeps no logs, VPN is a very secure
and anonymous means of surfing the internet
It is also good for securing connections at public WiFi hotspots, and for evading
firewalls used to censor the internet
It is a lot faster than Tor (although there will be a small hit to your internet speeds)
It is very good for P2P filesharing, and spoofing IPs in order to stream geo-restricted
media content (e.g. Hulu).
It relies on trusting your VPN provider, and is therefore not as secure as Tor
It costs money (typically between $7 to $10 per month, with substantial discounts for
bulk purchases). Many VPN providers accept Bitcoin payments.
It is obvious to observers that you are using VPN.
The final link in the chain, the one that connects you to the internet, is known as an exit node,
and is one of the biggest weaknesses of the system. Nodes are run by volunteers, and those
running exit nodes are vulnerable to prosecution over the behaviour of other Tor users who
have used the system for illegal purposes (including piracy and much worse), as the IP of the
offenders can been traced to the exit nodes IP address.
This has led to a fairly small number of public exit nodes being available, and has meant that
restrictive governments such as China, who monitor these nodes, have been able to block
access to many of them. There are still plenty of nodes around however, but it does mean that
Tor users in some countries my need to reconnect to a number of different nodes before they
find one that has not been blocked.
The other big problem with Tor is that it is very slow, as users data is routed through a
number of servers randomly located anywhere in the world before connecting to the internet.
Pros:
Very secure and anonymous (in fact it is generally considered the most secure and
anonymous way to access the internet available, and is therefore suitable for political
dissidents and the like)
It is also good for securing connections at public WiFi hotspots and for evading
firewalls used to censor the internet (although see comments blocked exit nodes
above)
Free
Cons:
For most people who are not doing anything too illegal, and who are not in life threatening
situations, VPN is much faster and more flexible than Tor, while providing plenty of privacy
and security. Those in life threatening situations are better off using Tor (although if it is their
own government that is the danger, simply using a no logs VPN service located outside their
countrys jurisdiction and political influence may work just as well).
For the really paranoid out there, it is possible to route a VPN connection through Tor, or an
OpenVPN connection through an SSL or SSH tunnel (in order to hide its use). More details
about these methods can be found here.
A final note regarding Tor is that it makes the anarchic and entirely unregulated Silk Road
marketplace possible, as the online black market exists entirely within the Tor network (and
therefore has no need for vulnerable exit nodes). Although supposedly set up on libertarian
ideals, much of the actively on the Silk Road is highly illegal, so if you are curious then you
will have to investigate further on your own.
Its not just the NSA who are out to get you: advertisers are
too! And they are willing to use some very sneaky tactics to follow you round the web and
piece together a profile of you in order to sell you stuff (or sell this information to others who
want to sell you stuff)
Most people who care are aware of HTTP cookies, how to clear them, and that most browsers
now have a Private Browsing mode that not only prevents the browser from saving your
internet history, but also blocks these cookies. It is therefore a good idea to always surf using
Private Browsing, but this alone is not enough to stop you being tracked across the internet, as
your browser leaves many other traces as it goes
To clear the DNS cache in Windows,open the command prompt window and type:
ipconfig /flushdns [enter]
To clear the cache in OSX 10.4 and under, open Terminal and type: lookupd flushcache
To clear the cache in OSX 10.5 and above, open Terminal and type: dscacheutil flushcache
Flash Cookies
A particularly insidious development is the widespread use of the use of Flash cookies (also
known as Local Shared Objects or LSOs), which are not blocked when you disable cookies in
your browser, and which can track you in a similar manner to regular cookies. These can be
located and manually deleted from the following directories:
A better tactic however, is to use the CCleaner utility (available for Windows and OSX),
which not only cleans out pesky Flash cookies, but also a host other rubbish that is slowing
your computer down and leaving traces of your internet activity behind. Another option is to
install the Better Privacy browser extension for Firefox, which is designed to remove or
manage these LSOs.
AdBlock Plus (Firefox, Chrome, Opera, Android) this fantastic and must-have
extension blocks all manner of adverts, even Facebook ads and those embedded within
YouTube videos (here in the UK it even blocks 4oD ads!). In addition to this, it warns
you when visiting known malware hosting websites, and disables third party tracking
cookies and scripts. Unlike NoScript (see below), AdBlock Plus is very easy to use
while still remaining powerful. By default, AdBlock Plus allows some not intrusive
advertising. This can be turned off (Add-ons -> Extensions -> AdBock Plus -> Filter
preferences), or you can install AdBlock Edge for Firefox, a fork of AdBlock Plus that
removes this feature
Disconnect (Firefox, Chrome, Safari, IE) replacing popular Ghostery as our favorite
anti-tracking and anti-cookie extension thanks to its up-to-date database of tracking
cookies, page load optimization, secure WiFi encryption and analytics tools,
Disconnect blocks third party tracking cookies and gives you control of over all a
websites elements. It also prevents social networks such as Google, Facebook and
Twitter from following you so they can collect data as you surf elsewhere on the
internet
HTTPS Everywhere (Firefox and Chrome) another essential tool, HTTPS
Everywhere was developed by the Electronic Frontier Foundation, and tries to ensure
that you always connect to a website using a secure HTTPS connection, if one is
available. This is fantastic, but do remember the reservations about how SSL is
commonly implemented that we made earlier, and that it has almost certainly been
cracked by the NSA
Better Privacy (Firefox) as noted in the section on Flash cookies above, this
extension blocks this new kind of cookie
Honorable mention: NoScript (Firefox) this is an extremely powerful tool that gives
you unparalleled control over what scripts are run on your browser. However, many
websites will not play game with NoScript, and it requires a fair bit of technical
knowledge to configure and tweak it to work the way you want it to. It is easy to add
exceptions to a whitelist, but even this requires some understanding of the risks that
might be involved. Not for the casual user then, but for web savvy power-users,
NoScript is difficult to beat. ScriptSafe for Chrome performs a similar job. Readers
tip: I would recommend adding that even if you dont want to bother messing with
white lists in Noscript, you should still install the extension and choose to allow all
scripts globally. This still provides some needed protection without hindering your
browsing experience. (Thanks twlph!)
In addition to these extensions, most modern browsers (including mobile ones) include a Do
Not Track option. This instructs websites to disable tracking and cross-site tracking when you
visit them. While it is defiantly worth turning this option on, it should be remembered that
implementation is purely voluntary on behalf of website owners, and so no is guarantee of
privacy.
Note that this list is not exhaustive of all the great privacy related browser extensions out
there, and we plan to soon publish some of our favorites as a blog article. We do however feel
that it covers the most important and powerful extensions that you need to have installed.
Block reported attack sites and web forgeries in Firefox
These setting can be very useful for protecting you against malicious attacks, but do impact
your privacy by sharing your web traffic in order to work. If the tracking issues outweigh to
benefits for you, then you might want to disable them.
Users IP address
Date and time of query
Query search terms
Cookie ID this cookie is deposited in your browsers cookie folder, and uniquely
identifies your computer. With it, a search engine provider can trace a search request
back to your computer
This information is usually transmitted to the requested web page, and to the owners of any
third party advertising banners displayed on that page. As you surf around the internet,
advertisers build up a (potentially embarrassing or highly inaccurate) profile of you, which is
then used to target adverts tailored to your theoretical needs.
In addition to this, governments and courts around the world regularly request search data
from Google and other major search engines, which is usually duly handed over.
Google Transparency
Report on the number of User Data Requests received, and the number (at least partially)
acceded to.
There are however some search engines that do not collect users data. DuckDuckGo in
particular has grabbed the headlines of late, with its popularity shooting through the roof
following the NSA spying revelations (daily searches on DuckDuckGo jumped from the 2
million it had built up over the last four and a half years, to 3 million in just 8 days!).
An added benefit of using a search engine that does not track you is that it avoids the filter
bubble. Most search engines use your past search terms (and things you Like on social
networks) to profile you, so they can return results they think will interest you. This can result
in only receiving search returns that agree with your point of view, locking you into a filter
bubble where you do not get to see alternative viewpoints and opinions because they have
been downgraded in your search results. Not only does this deny you access to the rich texture
and multiplicity of human input, but it can also be very dangerous as it can confirm
prejudices and prevent you from seeing the bigger picture.
DuckDuckGo the best known alternative search engine, and one we have examined
in some detail here, DuckDuckGo pledges not to track it users. Each search event is
anonymous, and while it could in theory be tracked, there is no profile attached that
can be accessed by infiltrators. DuckDuckGo says that it would comply with ordered
legal requests, but as it doesnt track users, there is nothing useful to give them. In
use we have found DuckDuckGo to be very good, and through the use of bangs (see
our article), it can also be made to search most other popular search engines
anonymously too
Ixquick searches many popular search engines simultaneously and anonymously,
giving a star to results each time they are in the top ten of a search engine result.
Ixquick promises not to store or share any personal information, or use any identifying
cookies
Gibiru provides basic Google search engine results, but separates your query from
your IP with the use of proxy servers. In addition to this, Gibiru deletes all records
within seconds of performing a search, so there is no profile data to sell, package or
give away via partnership, request or subpoena
YaCy the above search engines rely on trusting the search engine providers to
maintain your anonymity. If this really worries you, then you might like to consider
YaCy, a decentralized, distributed search engine built using P2P technology. This is a
fantastic idea, and one that we really hope takes off, but for now it is more of an
exciting curiosity than a fully-fledged and useful Google alternative.
To turn Search
History off, click on the gear icon on the top right, and select Settings
Encrypted Webmail
For a while, Hushmail was considered the go-to service for secure webmail, as it offered PGP
encryption in a web based service. However, in 2007 a backdoor was used by the owners to
capture emails of three accounts, which were then handed over to the Canadian Courts. As
Hushmail CTO Brian Smith said in refreshingly honest blog post,
[Hushmail] is useful for avoiding general Carnivore-type government surveillance, and
protecting your data from hackers, but definitely not suitable for protecting your data if you
are engaging in illegal activity that could result in a Canadian court order.
It should be noted that any web-based service can in theory be compelled to modify their
system to capture users decryption keys (as Hushmail did), and Hushmail itself recommends
using non web-based services such as GnuPG or PGP Desktop if stronger security is needed.
Jitsi (Windows, OSX, Linux, Android (experimental)) this free and open source
software offers all the functionality of Skype, including voice calls, video
conferencing, file transfer and Chat, but can encrypt it all with ZRTP. The first time
you connect to someone it can take a minute or two to set up the encrypted connection
(designated by a padlock), but is afterwards transparent. As a straight Skype
replacement, Jitsi is difficult to beat
RedPhone (Android) this free and open source Android only app provides end-toend encryption of voice calls. Unlike normal VoIP apps however, it lets you use your
normal phone number and the normal system dialer, so operation is almost invisible,
except that when you connect to someone else with RedPhone installed, you are given
to option to encrypt the call
Silent Circle is a popular commercial suite of encrypted communications software
comprised of Silent Phone (iOS, Android), Silent Text, (iOS, Android), Silent Eyes
(Windows VoIP), and Silent Mail (iOS, Android, Outlook for Windows, Mac Mail).
The service costs $10 per month, but the software itself is open source and has been
audited by the American Civil Liberties Union to ensure it contains no back doors.
Reassuringly (in a way), the makers of Silent Circle recently closed their Silent Mail
service following the abrupt shutting down of Lavabit, in order to prevent spying.
Pidgin + OTR (Windows) Pidgin is a popular free and open source IM client that
lets you chat to users on AIM, Google Talk, MSN, Yahoo and many more. OTR (Offthe-road) is a plugin that combines AES encryption, perfect forward secrecy, and the
SHA-1 hash function to ensure strong encryption for IM sessions. As with GnuPG for
emails, initial setup is a bit of a pain, but once done operation is seamless (we now
have a detailed guide for this).
Addium (OSX) is a free and open source messaging client for Mac that also lets you
talk to friends on lots of different networks. Even better, Addium comes with OTR
support built-in!
TextSecure (Android) sister app to Whisper Systems RedPhone, free and open
source TextSecure replaces your Androids default text app with one that encrypts
texts to other TextSecure users, and encrypts all local messages so that if your phone
is stolen they will remain secure
Gibberbot ( Windows, OSX, Linux, iOS, Android) developed by the Guardian
Project, this app is available on all major platforms, supports chatting on a whole host
of different IM services, and has OTR built-in. It is still a little buggy and no-frills, but
has great potential.
Both SpiderOak and Wuala have iOS and Android apps, so you can easily sync across all
your computers and mobile devices. This convenience comes at a small security price, as both
services briefly store your password on their servers to authenticate you and direct you to your
files. Wuala also uses this password to encrypt and decrypt your files when using a mobile
device, although this is somewhat compensated for by Wuala uploading different segments of
your files to different servers, making it impossible for them to identify which data belongs to
which user. In both cases the passwords are deleted once a session is finished.
SpiderOak (2GB free, $10/m 100GB) available for all major platforms, SpiderOak
offers a zero knowledge, secure, automatically encrypted cloud service, which uses a
combination of 2048 bit RSA and 256 bit AES to encrypt your files
Wuala (5GB free, plans from 2/m 20GB to 160/m 2TB) available for most major
platforms and also offering 2048 bit RSA and 256 bit AES encryption (with SHA-256
hashes for integrity checks), Wualas service is very similar to that of SpiderOaks, but
with a slightly different approach to security (see above).
It should be noted that neither SpiderOak or Wuala are FOSS (and are therefore inherently
less trustworthy), although at appears that SpiderOak may be headed in that direction.
Because of its high profile, we feel that Kim Dotcoms Mega service deserves a special
mention, particularly as it offers a very generous 50GB encrypted space for free. Mega uses
your web browser to encrypt files before uploading and decrypt them after downloading,
which is great for convenience (and an Android app is available, with an iOS one on the way),
but is not as secure as the other methods outlined here. Our feeling therefore, is that while it is
worth paying attention to how Mega deals with its security issues, it is probably best avoided
for the time being. It is also worth pointing out that Kim Dotcoms involvement ensures the
service is receiving the highest possible level of scrutiny from security, law enforcement and
copyright enforcement bodies the world over.
While the focus of this document is on internet security, an important aspect of securing your
digital life is to ensure that locally stored files cannot be accessed by unwanted parties. Of
course, it is not just about local storage; as we have already noted you can also encrypt files
before emailing them or uploading them to Cloud storage.
Use TrueCrypt
Cyrptonite brings TrueCrypt and EncFS to Android, including allowing users to access
TrueCrypt containers (if you experience problems, a command line version of TrueCrypt is
included with the app). EDS Lite is another good option that does more or less the same.
Unfortunately there is no TrueCrypt compatible app or alternative available for iOS devices
that we are aware of.
Check out our three part introductory guide to using TrueCrypt! Part 1 Part 2.
Alternatives to Truecrypt
If the fact that TrueCrypt is not truly FOSS, or the implications of plausible deniability
worry you, there are a couple of other highly regarded encryption programs available:
It is also worth remembering that not just criminal hackers use viruses! The Syrian
government, for example, launched a virus campaign known as Blackshade, aimed at ferreting
out and spying on political dissidents.
Although most people are aware they should be using anti-virus software on their desktop
computers, many neglect their mobile devices. While there are less viruses targeting mobile
devices at present, smart phones and tablets are sophisticated and powerful computers, and as
such are vulnerable to attack by viruses, and should therefore be protected.
Mac users are famously bad for not installing ant-virus software, citing the fact that OSXs
Unix architecture makes virus attacks difficult (this is hotly contested by the way), the fact
that most hackers concentrate on Windows because most computers use Windows (true), and
the anecdotal evidence of many Mac users who have gone for years without using anti-virus
software yet never experienced any problems. However as events last year demonstrated,
Macs are not immune to viruses, and anyone serious about their security should always use
good anti-virus software.
Windows the most popular free antivirus programs for Windows are Avast! Free
Antivirus and AVG AntriVirus Free Edition, although plenty of others are also
available. A good review of commercial options can be found here
OSX Avast! Free Antivirus for Mac and ClamXav are well regarded, although other
free good options are available. In fact, the free software is better regarded than paidfor options, so we just recommend using them
Android again, there are a number of options, both free and paid for. Weve used
Avast! for ages now and find it works well, is free, and includes a firewall
iOS Apple is still somewhat in denial about the fact iOS is as vulnerable as any other
platform to virus attack, but VirusBarrier is now available from the app store
Linux the usual suspects: Avast!, Kaspersky and AVG Free are all available for
Linux, work very well, and are free.
Anti-malware
In addition to actual viruses, computers (Windows in particular) are vulnerable to various
other forms of malicious code known as malware. Users of non-Windows systems shouldnt
worry too much about this (and anti-virus software should deal with any problems), but
Windows users should consider using an anti-malware program alongside their regular
antivirus software. Windows versions Vista and up ship with the anti-malware program
Firewalls
A personal firewall monitors network traffic to and from your computer, and can be
configured to allow and disallow traffic based on a set of rules. In use they can be a bit of
pain, but they do help ensure that nothing is accessing your computer, and that no program on
your computer accessing the internet, that shouldnt be.
The biggest problem with using a firewall is determining which programs are ok, and which
are potentially malicious (perfectly legitimate Windows processes can, for instance, appear
pretty obscure), but once set up they become fairly transparent in use.
Some good firewall programs
Windows versions Vista and up have a firewall built-in, which is quite good and is
very easy to use, but only screens incoming traffic. For many this will be perfectly
sufficient, but those wanting a more robust solution might want to consider
commercial anti-virus suites which include a firewall as part of the package, or
Comodo Firewall Free and ZoneAlarm Free Firewall 2013, which are good free
options
OSX versions 10.5 and up have a basic firewall built-in, which like that in Windows
only monitors incoming traffic. If you want to monitor outgoing traffic, Little Snitch
($25) is a great program
Android as noted above, the free Avast! For Android includes a firewall
iOS the only iOS firewall we are aware of is Firewall iP, which requires a jailbroken
device to run
Linux there are many firewall programs and dedicated firewall distros available, but
for a simple and straight forward Linux firewall you might want to give Smoothwall a
try.
Ubuntu is very popular due to the fact that it is one of the easiest Linux distros to use, and
thanks to this popularity there is a great deal of assistance available for it from an enthusiastic
Ubuntu community. It therefore makes a good starting point for those interested in a using a
much more secure Operating System.
It consists of two parts, the first of which acts as a Tor gateway (known as Whonix Gateway),
while the second (known as a Whonix Workstation) is on a completely isolated network
which routes all its connections through the Tor gateway. This isolation of the workstation
away from the internet connection (and all isolated from the host OS inside a VM), makes
Whonix highly secure.
recommended), possible DNS leakage may result in your ISP handling this DNS translation
instead of your VPN provider (as should happen).
Fortunately, there are a number of free and secure public DNS servers, including OpenDNS
and Comodo Secure DNS, and we recommend changing your system settings to use these
instead of your ISPs servers. We have instructions of how to do this in Windows 7 (along
with a guide on how to detect and block DNS leaks when using a VPN) available here.
There remains the problem that DNS was not built with security in mind, and it is vulnerable
to a number of attacks, the most important of which is a man-in-the-middle attack known as
DNS spoofing (or DNS cache poisoning), where the attacker intercepts and redirects a DNS
request. This could, for example, be used to redirect a legitimate request for a banking service
to a spoof website designed to collect account details and passwords for unsuspecting
victims.
This has prompted the fine chaps at OpenDNS to develop DNSCrypt, a lightweight program
that encrypts all DNS traffic between the user and OpenDNS, preventing any spying,
spoofing or man-in-the-middle attacks.
Using Curve25519 elliptical-curve cryptography, DNSCrypt is available for Windows, OSX
and Linux, and although in preview release stage, is considered stable.
Insert a random space into your password this simple measure greatly reduces the
chance of anyone cracking your password. Not only does it introduce another
mathematical variable into the equation, but most would-be crackers assume that
passwords consist of one contiguous word, and therefore concentrate their efforts in
that direction
Use a phrase as your password even better, this method lets you add lots of spaces
and use many words in an easy to remember manner. Instead of having pancakes as
your password, you could have I usually like 12 pancakes for breakfast instead, to
immensely increase your security
Use more than 4 numbers in your PIN where possible, use more than four
numbers for your PINs. As with adding an extra space to words, this makes the code
mathematically much harder to break, and most crackers work on the assumption that
only 4 numbers are used.
Firefox password manager the password manager built into Firefox is one of the
easiest ways to store your passwords for each website you visit, and it works very
well. Do be aware however that you should set a master password to prevent just
anyone peeking at your passwords in Firefoxs options dialogue. In addition to this, it
is probably a god idea to back up your Firefox passwords every now and again
KeePass (multi-platform) this popular free and open source password manager will
generate complex passwords for you and store them behind AES or Twofish
encryption. It is a shame that KeePass doesnt integrate with your browser, but it is
possible to import saved Firefox passwords into it. KeePass itself is Windows only,
but KeepassX is an open source clone for OSX and Linux, as are iKeePass for iOS and
Keepass2Android for Android
Social networking
Self-censorship simply put, if there are things you dont want (or that shouldnt be)
made public, dont post details about them on Facebook! Remember that once posted
it is very difficult to retract anything you said, especially if it has been re-posted (or retweeted etc.) In addition to this, remember that the authorities monitor social
networking sites and services, so planning big illegal raves, or joking about bombing
your local airport, are very bad ideas
Keep private conversations private it is all too common for people to discuss
intimate details of a planned dinner date, or conversely to have personal rows using
public channels. Remember that things like Message (Facebook) and DM (Twitter)
exist, and use them. It wont hide your conversations from advertisers, the law, or the
NSA, but it will at least keep potentially embarrassing interactions away from friends
and loved ones (who probably really dont want to hear certain things anyway!)
Use aliases - despite what the likes of Facebook try to insist upon, there is nothing
stopping you from using a false name. In fact, in this world where employers almost
routinely check their staffs (and potential staffs) Facebook pages, using at least two
aliases a sensible one with your real name which is designed to make you look good
to employers, and another where friends can post wildly drunken pictures of you, is
almost a must. Remember that it is not just names you can lie about; you can also
happily fib away about your date of birth, interests, gender, where you live, or
anything else that will put advertisers and other trackers off the scent. On a more
serious note, bloggers living under repressive regimes should always use aliases
(together with IP cloaking measures such as VPN) when making posts that may
threaten their life or liberty
Keep checking your privacy settings although Facebook is notorious for
continually changing the way its privacy settings work, and for making their privacy
policies as opaque as possible, it is worth regularly checking the privacy settings on all
social networks to make sure they are as tight as possible (for example by ensuring
that posts and photos are only shared with Friends, not Friends of Friends or Public).
A good idea in Facebook is to ensure that Review posts friends tag you in before they
appear on your time line (under Privacy Settings -> Timeline and Tagging) is set to
On, to help limit the damage friends can do to your profile .
Use Glassboard instead Glassboard is basically a Facebook replacement that
encrypts your data on its servers, and promises not to sell, rent, or otherwise share
personal information to Third Party companies for marketing purposes. It is easy to
use, and can be accessed using iOS and Android apps, or through their web client.
Glassboard is organized around boards (much like Google+ Communities), where
users can chat and share photos etc. There is a free service, which gives you access to
10 boards, or $5 a month gives you unlimited access. Of course, no social network is
any good if you have no friends on it, which will always be the biggest challenge for
any service trying to compete with the big boys, and it goes without saying that
Glassboard is in no way FOSS.
While other countries governments seem desperate increase their own control over their
citizens data, nothing (including Chinas attempts at internet surveillance) matches the scale,
sophistication or reach of PRISM.
It is therefore a very good idea, if such things worry you (as they should), to avoid all dealings
with US companies where you are concerned about your privacy. To suggest that every US
company may be complicit in handing every users personal information over to a secretive
and largely unaccountable spying organization might sound the stuff of paranoid science
fiction fantasy, but as recent events have proved, is terrifyingly close to the truth
In addition to this, the UKs GHCQ is in bed with the NSA (They [GCHQ] are worse than
the US, Edward Snowden), so all UK companies should also be similarity avoided.
Conclusion
Is privacy worth it?
As we come to the end of this guide, we think this question is worth considering. Not only
will almost all the measures outlined above mark you out for special attention by the likes of
the NSA, and add extra layers if complexity and effort to everyday tasks, but much of the cool
functionality of new web-based services rely on knowing a lot about you.
Google Now is an excellent case in point. An intelligent personal assistant, this softwares
ability to anticipate what information you require is uncanny. It can, for example remind you
that you need to leave the office to catch the bus now if you want to get home at your usual
time, as well as providing navigation to the nearest bus-stop, and alternative timetables should
you miss it. Googles new, and possibly game-changing Google Glass system makes heavy
use of Google Now technology, which relies on storing and curating large amounts of
information about your habits, likes, dislikes, browsing history, where you like to drink, and
much more.
In other words, some of the most exciting and interesting developments in human-computer
interaction rely on a full-scale invasion of our privacy, and to box yourself in with encryption
and other privacy protection methods is to reject the possibilities afforded by these new
technologies.
We mainly pose the question is privacy worth it as food for thought. Privacy comes with a
cost, and it is worth thinking about what compromises you are willing to make, and how far
you will go, to protect it. In our view privacy IS vitally important, as everyone has a right not
to have almost every aspect of their lives recorded, examined and then judged or exploited
(depending on who is doing the recording), but it has to be recognized that maintaining
privacy is not easy (and can never be completely guaranteed) in the modern world.
Of course, what most of us probably want is the ability to share what we want with our friends
and with services that improve our lives, without worrying this information is being shared,
dissected and used to profile us for dubious ends. While this is not likely to happen soon, if
more people made even fairly basic efforts to improve their security, it would make both
government agencies and advertisers jobs much more difficult, to the point that it could even
force a change of approach.
Final words
It may take a bit of effort, but as we hope we have demonstrated in this Guide, it is entirely
possible and not too cumbersome to take steps that greatly improve your privacy while online.
Nothing is foolproof, but there is no reason to make the work of those who would invade
aspects of your life that you should rightfully consider yours and yours alone, easy.
Privacy is a precious but endangered commodity, and by implementing at least some of the
ideas we have covered you not only help to protect your own privacy, but also make a
valuable contribution to conserving it for everyone. After all, if everyone encrypted their
online life, where would the NSA be then?
Final note: If you are interested in further exploring the ideas and issues raised in this Guide,
a good place to start is the almost exhaustive set of links available at Opentrackers.org.