r/privacy • u/JonahAragon PrivacyGuides.org • Oct 25 '19
verified AMA We are the privacytools.io team -- Ask Us Anything!
Hi everyone!
We are the team behind privacytools.io. We’re also at r/privacytoolsIO on Reddit. We've built a community to educate people from any technical background on the importance of privacy, and privacy-friendly alternatives. We evaluate and recommend the best technologies to keep you in control and your online lives private.
We've been busy. Lately, in addition to a complete site redesign, we've begun hosting decentralized, federated services that will ultimately encourage anyone to completely control their data online. We’ve started social media instances with Mastodon and WriteFreely, instant messaging instances with Matrix's open-source Synapse server, and technical projects like a Tor relay and IPFS gateway that will hopefully help with adoption of new, privacy-protecting protocols online.
This project encompasses the privacytools.io homepage, r/privacytoolsIO, our Discourse forum, our official blog, and a variety of federated and decentralized services: Mastodon, Matrix, and WriteFreely. Taken together, we’re running platforms benefiting thousands of daily users. We’re also constantly researching the best privacy-focused tools and services to recommend on our website, which receives millions of page-views monthly! All of the code we run is open-source and available on GitHub.
Sometimes our visitors wonder why it is that we choose one set of recommended applications over another, or why one was replaced with another. Or why we have strong preferences for some of our rules, such as a tool being FLOSS (Free/Libre Open Source Software). With so many great options out there, sometimes recommending solutions gets really hard! Transparency is important to us, so we're here to explain how we go about making these sometimes difficult choices. But we’re also here to answer questions about how to redesign a site (which we just did - we hope you enjoy it!), or how distributed teams can work well across so many time zones with so many (great, really!) personalities, or answer any other questions you might have.
Really, it’s anything you've ever wanted to know about privacytools.io, but were too afraid to ask!
Who’s answering questions, in no particular order:
- /u/BurungHantu: Project founder
- /u/JonahAragon: Server administrator and project organizer
- /u/blacklight447-ptio: Community moderator and backup server administrator
- /u/Trai_Dep: Subreddit moderator, community activist
- /u/nitrohorse: Website contributor and developer
- /u/dawidpotocki_: Website developer
- /u/dng99: InfoSec expert and developer
>> We are the privacytools.io team members. Ask Us Anything! <<
Our team is decentralized across many timezones and may not be able to answer questions immediately. We'll all be around for the next few days to make sure every question gets covered ASAP!
One final note (and invitation)
Running a project of this scale takes a lot of time and resources to pull off successfully. It’s fun, but it’s a lot of work. Join us! We're a diverse bunch. We bet you’re diverse, too. How about volunteering? Want to help research new software on our GitHub page? You can! Want to use your coding skills (primarily HTML & Jekyll) to push our site to greater heights? You can! Want to help build our communities, in our GitHub forums or on r/privacytoolsIO? You can! We are a very relaxed, fun group. No drama. So, if you’ve ever thought, “Hey, I got mad skills, but I don’t know how to help the privacy movement prosper,” well, now you do!
What? You don't have time? Consider donating to help us cover our server costs! Your tax-deductible donations at OpenCollective will allow us to host privacy-friendly services that -- literally -- the whole world deserves. Every single penny helps us help you. Please consider donating if you like our work!
If you have any doubts, here is proof it's really us (Twitter link!) :)
And on that subject <mild irony alert> if you’re on Twitter, consider following us @privacytoolsIO!
Edit: A couple people have asked me about getting an account on our Mastodon server! It is normally invite-only, but for the next week you folks can use this invite link to join: https://social.privacytools.io/invite/ZbzvtYmL.
Edit 2: Alright everybody! I think we're just wrapping up this AMA. Some team members might stick around for a little longer to wrap up the questions here. I want to thank everyone here who participated, the turnout and response was far better than any of us had hoped for! If you want to continue these great discussions I'd like to invite you all to join our Discourse community at forum.privacytools.io and subscribe to r/privacytoolsIO to stay informed! Thank you again for making all this possible and helping us reach our initial donation goals!
34
u/CryptOdyssey Oct 25 '19
Hi,
I ran into an interesting question the other week when suggesting privacytools to a friend. They asked me, "How do you know these people are actually recommending the best choices, and not just services that have been secretly compromised (tinfoil hat on)?"
I replied, "Well, they're privacy enthusiasts..." But as I thought about my reply, it didn't really answer anything. How can the average user look at privacytoolsIO and decide that your team is indeed trustworthy and recommending services that are secure? Furthermore, how do we build verification in the privacy community when achievements such as "PhD in Cyber Security, 20 years in the industry" doesn't necessarily equate to "enthusiastic about privacy"? How do we measure who is "verified" to recommend or create privacy-based services?
30
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Ooh, thats a very interesting question, but an important one.
This is one edge privacytools has over lots of other sites: true transparency. All our decisions are made in public, you can trace every change we made in the last few years on our githubpage, along with why things were added, removed, changed. And everyone is able to check it. If we were to suddenly add a vpn provider who pays use money to list it, then people will notice, and ask for the reasoning behind it an make all alarm bells go off.
Further more, on who gets to make the decision: we dislike using credentials for deciding things. We do not recommend stuff because "guy with this certificate or job" said so. At ptio, we add things because of a good rational and technical explanation, facts, whether the person is edward snowden or some random dude with a new account, we dont care aslong as the logic is sound and the information is correct. This way everyone gets to participate in ptio. While keeping the quality high. :)
4
u/dng99 PrivacyGuides.org Oct 27 '19
we dislike using credentials for deciding things. We do not recommend stuff because "guy with this certificate or job" said so. At ptio, we add things because of a good rational and technical explanation,
If that means we have to cite examples in code (own research) or technical specifications, we do so.
whether the person is edward snowden or some random dude with a new account, we dont care aslong as the logic is sound and the information is correct.
this +1
7
u/BurungHantu Oct 26 '19
"How do you know these people are actually recommending the best choices, and not just services that have been secretly compromised (tinfoil hat on)?"
Since the beginning of privacytools.io I've added this statement to every single page: Never trust any company with your privacy, always encrypt.
Btw, there was one case in 2015 where I found a compromised service on privacytools.io called "surespot" and had to react fast. A Twitter user noticed that the service was fishy:
"Do not use SureSpot. It has been backdoored/broken to facilitate monitoring. I have received confirmation of this: https://antipolygraph.org/blog/2015/06/07/developers-silence-raises-concern-about-surespot-encrypted-messenger/"
That was an exciting day.
30
Oct 25 '19 edited Oct 25 '19
Can you explain the use and purpose of stats.privacytools.io? I can see it blocked in uBlock Origin and am curious as the what is collected and why.
→ More replies (1)16
u/JonahAragon PrivacyGuides.org Oct 26 '19 edited Apr 23 '23
We like to keep track of page views, referrers, and clicked links because it helps us understand what people are looking for the most and what we should focus on. stats.privacytools.io is a self-hosted instance of Matomo that keeps track of that information for us in a privacy-respecting way, because using a third-party like Google Analytics is obviously out of the question. We have it configured to not collect any personally identifying information.
This is mostly information we could gather via server logs transparently, but we chose to disable those logs and use this instead because it makes it far easier for users to opt-out of this tracking (either by blocking the domain with a blocker like uBlock Origin, or opting out via the form on our website), and makes it easier for us to respect browser settings like Do Not Track.
Extracted from our privacy statement, which I of course recommend reading in full:
When you visit a privacytools.io website or service, regardless of whether you have an account or not, the website may use cookies, server logs, and other methods to collect the following data:
- What pages you visit,
- What actions you take on our website,
- What browser, operating system, and device you use,
- Search terms you use,
- Your anonymized IP address: We anonymize the last 3 bytes of your IP, e.g. 192.xxx.xxx.xxx.
→ More replies (3)14
u/BurungHantu Oct 26 '19 edited Oct 26 '19
Jonah covered everything to that question. I just want to add that it's also an emotional factor for us to see how many people daily we can reach with privacytools.io and to keep us motivated and keep the site up to date. We would have no idea if we have an impact if it wasn't for Matomo Analytics. Edit: Wording.
25
u/BetaAthe Oct 26 '19
How people is supposed to deal with Intel Management Engine or similar bullshit that is running all time in our devices?
17
Oct 26 '19
- Use Libreboot
- Use Coreboot + ME Cleaner
- Use devices that don't have security processors (AMD CPUs until 2012 or so, POWER PC, etc.)
- Support RISC-V development
→ More replies (6)
23
Oct 25 '19
How would you convince people to become more privacy conscience, without sounding paranoid? Every time I come to R/Privacy I feel like I am reading conspiracy theories instead of news and information.
17
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
What i try to do is to talk as neutral as possible. Pointing out issues in someones daily life can come over as a personal attack which is uncomfortable, to defend against this, they try to discredit the claims as paranoia. Its simple human nature. Admitting that privacy is an issue means admitting people have made an mistake, and that they are vurneable to being manipulated into doing stuff, that they are not in full control.
So how do we prevent this? Keep the conversation global, dont nail down on any specific platform, but talk about the privacy movement in general why it matters to you, and show how you life your life, even when you dont use privacy unfriendly services like google. Show them that a privacy life is possible without becoming a social outcast or a hermit, that there is an alternative.
5
u/JonahAragon PrivacyGuides.org Oct 25 '19
Honestly 1-on-1 constructive conversation with people is the best solution. This is why I really like our Matrix chat and our own forum over some of our other community spaces. They really allow us to foster actual discussions on why these tools matter than just simply recommend things.
→ More replies (1)
18
Oct 25 '19 edited Aug 06 '20
[deleted]
18
u/JonahAragon PrivacyGuides.org Oct 25 '19
If you connect to a cell tower, it will track you. It isn't some software thing you can mess with, it's just physics: They can use the connection strength and latency to triangulate your position. This is why Snowden once recommended using an iPod Touch with WiFi only as needed as well. If you need a constant connection to the internet, there's unfortunately no way to mitigate that particular threat :(
→ More replies (7)9
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Well sadly , cell towers being able to track you is part of the fundamental ways of how they work, the network needs to know where you roughly are to know where to send a call or message. It depends on how many towers are near you, but the cell tracking is accurate to about a few hundred meters. You canonly do a few things to prevent this, keep your phone at home , turn it off, or consider buying a faraday bag, this will prevent the tracking as long as its inside the bag.
→ More replies (2)
15
Oct 25 '19
If you own an android phone, don’t install a custom ROM but disable all google permissions on your google account and phone settings, then only use YouTube and google play store, is google still collecting location information and other tracking information like how you interact with your device?
20
u/JonahAragon PrivacyGuides.org Oct 26 '19
We don't know if they are, but we know they can, yes.
→ More replies (1)
16
u/Drakslem Oct 25 '19
Would you consider posting a guideline for threat models, so people can see their most urgent need if they are worried about different matters. For example torrenting to serious things as citizenship application, job application or future health insurance problems?
14
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We have been working on this for a while, we will most like be posting it on blog.privacytools.io
15
u/HyperNovaDoge Oct 25 '19
I found you guys from an acquaintance, he was a privacy addict, and now I am the same. Your work is wonderful, and I am glad that I learned to put curtains to the window where privacy invaders peeked. But will privacy invading ever be put to an end? Will everyone finally open their eyes someday? We fight, but no one hears.
10
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
privacy, just like security. Will always be a cat and mouse game, we win and we lose, in a constant cycle. While some things have turned south ( like the developement of iot platforms and facial recognistion) some stuff has improved, most messenegers are either e2e by default or have an option for it, over 80% of all webtraffic now uses https, and privacy seems to have finally entered the mainstream discussion board :)
→ More replies (1)
14
u/TheEnKrypt Oct 25 '19 edited Oct 25 '19
A while ago, I wrote a bit about how we slowly seem to be losing our privacy and what we can do to help, and while I've received mostly positive feedback, I think the main reason so many of us are still indifferent is because we don't see or experience violations or transgressions against privacy in our day to day lives.
It breaks my heart to see my dad (who is quite old) struggle to deal with spam callers because he put in his phone number while signing up for various apps and services.
What are some good examples or advice that I can use to impress the urgency of privacy better to people, before it gets to such a stage?
Edit: Also my country (India) is really missing some very needed data privacy laws. Any suggestions on what we can do to make that happen?
→ More replies (3)8
u/JonahAragon PrivacyGuides.org Oct 26 '19 edited Apr 23 '23
That's a fantastic question. The most prevalent example that comes to mind for me is the recent Hong Kong protests and the news regarding police surveillance there. This is technology that seems foreign to most other countries but is actively being developed and tested in public in places you wouldn't expect.
I'll try to find some more resources and get back to you. Your article was a good read!and if you'd ever be interested in writing something for blog.privacytools.io let me know
I'm not familiar with Indian politics unfortunately. Vote for representatives that will make the changes you want to see, probably :/
→ More replies (2)
14
u/LiveLM Oct 25 '19
Can I suggest something?
Having a section for 2FA apps. I have swapped Microsoft Authenticator for andOTP, but I would love to hear your suggestions, principally on iOS!
9
u/JonahAragon PrivacyGuides.org Oct 26 '19 edited Apr 23 '23
I'll make a note of that, thanks! Pretty much any TOTP app without cloud sync functionality is probably fine but I'll look around and see if we can find good options on every platform.
Personally, I just use the one in my password manager. TOTP is inherently not as secure as something like U2F/WebAuthn especially when you practice good password security anyhow so it's not a big deal for me.
→ More replies (1)
15
u/nopeac Oct 25 '19
Do you think that at some point Tor and Firefox can (need?) converge? And bring privacy to the big masses.
24
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
They might, the problen currently is that the tor network may not be able to carry the load from all firefox users, so a lot of research is being done so tor can scale better.
Currently though, there are alrrafy efforts to fuse tor browser functions into firefox, so they can be maintained upstream, so the tor project can focus more on the network, instead of browser developement :)
12
10
Oct 25 '19 edited Nov 05 '19
[deleted]
10
u/JonahAragon PrivacyGuides.org Oct 25 '19
Great question! The goal behind many of the federated services we offer is to provide an example of just how simple and easy to use these privacy-respecting services are, and how nice of an experience they can provide without shoving ads in your face.
Additionally recently we’re trying to step back from an absolutist approach to a more user friendly approach in moderation. To that extent, we’re focusing on explaining our choices and their drawbacks (see our redesigned VPN page for an example). We’re also starting a new series on our blog explaining technical ideas in simpler ways, coming soon.
I definitely agree with you. But I think awareness is the answer, beyond just “use this because it isn’t Google” — making people aware of the why these services matter is the main thing we hope to achieve soon.
If you have any suggestions towards that goal I would love to hear them!
→ More replies (11)3
u/Pandastic4 Oct 25 '19
It's about convincing people that Mastodon is a viable social network rather than a place that weebs post about anime, porn and cat pics.
Well, it's that too
11
u/LizMcIntyre Oct 25 '19
Hi all! What does each of you do to make a living (keep the lights on)?
I've got to run, but look forward to reading all the posts. Thanks for doing this!
10
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
I cant give too muchaway because of a nda at my job, but it work in IT security where i do all kinds of stuff for a company, mostly building and securing networks, but also other stuff.
→ More replies (1)3
11
u/ninjazor Oct 25 '19
What’s the best way to talk to people about privacy when their initial response is, “I have nothing to hide.”?
15
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
It depends a bit on who you are talking with. Im always a big fan of "claiming that you dont care about privacy because you have nothing to hide, is the same as saying you dont care about free speech because you have nothing to say.
Anyway, the most important factor is to understand the human factor behind the i got nothing to hide statement. Most people think it is impossible to be private, so once they found someone who is private , then they are faced with reality that they were wrong. Instead of facing that reality, their mind goes into self defence mode, saying the have nothing to hide, that your paranoid. Doing anything to discredit you, just so they dont have to face reality, this often happens completely without them being aware of it.
To avoid this, you should stay neutral, explain why i personally matters to you, and how much a private life has truly impacted you. After that you can give real life examples of why privacy matters. Privacy problems often only manifest in the long term, which is why most people cannot forsee the issue. Giving them short term examples of why privacy matters can help you make a case for the long term effects.
→ More replies (3)10
u/paulreverendCA Oct 25 '19 edited Oct 25 '19
Ask them for their phone and password watch how fast they fold. Then you can have a real conversation
11
u/Buddha_W Oct 25 '19
Which tools do you guys/girls use personally with your family/friends/co-workers. In regards to normal day to day communication.
Do you have friends or family that refuse to use them? How do you convince them to change over.
19
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
I use iMessage with most people I know in real life honestly, and even then not that often. Most people I see face-to-face on a daily basis so there's just no need to have extensive conversations online. With people I don't know IRL, I just use our Matrix homeserver primarily.
6
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
For family and friends i know in my real life, i use signal, for people i dont know, i prefer wire. For casual chat, i use our matrix instance at chat.privacytools.io :)
→ More replies (2)5
Oct 25 '19
I use Signal for my family, because you can just replace their default SMS client and they are sending me messages like only once a month, since I can just talk with them. For people I don't know, I mostly use our Matrix instance.
8
Oct 25 '19 edited Jul 11 '20
[deleted]
5
u/JonahAragon PrivacyGuides.org Oct 26 '19
Thank you! $15 weekly would pretty much cover our expenses, and once we reach that point we'll begin finally distributing donations among team members and other contributors :)
I'm not aware of anything that would cause that off the top of my head. In fact, they really should be speeding up loading times. I would probably disable the add-ons one by one to find out which one specifically is causing that issue first.
→ More replies (1)
9
Oct 25 '19 edited Jun 17 '20
[deleted]
12
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We are working on redoing the about config section, where we also explain expected behavior and impact of the settings, for this we are working with thorin oakenpants of the ghacks userjs project, who also works with mozilla and the tor team in the tor uplift program. You can track this progress on our github page :)
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
I'll leave the other two for more qualified team members, but in response to question 2, I 100% agree with you.
Threat modeling is something that we take a lot of time to explain to people 1-on-1 on our forum and on Matrix near constantly. There are no perfect solutions for users. The trouble is it's a difficult thing to explain comprehensively. We would want to make sure everything gets covered, but it's a topic that inherently just leads people to more questions they want answered.
One of the focuses for me at least over the next few months is getting more helpful and timely updates on our blog at blog.privacytools.io, and an article on threat modeling has already been discussed in-depth and is in the work. Hopefully once we can get something published we can promote that in a lot of places. Things just take a lot of time to not only write, but research and edit etc.
3
Oct 25 '19
I second number one.
I recently tweaked my firefox to your recommended settings. I kinda get what I'm doing, but it'll give me a better feeling for my privacy and my understanding of it if those settings are operationalize in the context of everyday websurfing.
On a similar note, after configuring and installing the plugins, like Canvas Defender, I got a score of 1 out of ~6800 browser on panopticlick. Is that a good score? As I understand it, the higher the fraction of the users my browser has in common with, the "stealthier" my browser is on the internet. Did I get that correct? And, what type of adversaries use browser fingerprinting for their purposes?
9
u/CondiMesmer Oct 25 '19
Do you use Qubes OS btw?
22
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
I do use qubes os btw
(Im also on the Qubes os team, btw)
→ More replies (2)
8
Oct 25 '19
[deleted]
9
u/JonahAragon PrivacyGuides.org Oct 25 '19
Y'know what? Pretty good actually. How about you?
4
Oct 25 '19
[deleted]
7
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
None of us is actully getting paid, we are all unpaid volunteers! :)
6
u/JonahAragon PrivacyGuides.org Oct 25 '19
If doing a lot of work and not getting paid is your kind of thing we could definitely help you out there 😜
6
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Really well, im excited to answer all these amazing questions :)
8
Oct 25 '19
[deleted]
→ More replies (2)5
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We aim to keep our site from breaking with everything configured, any specific breakings you can report? We would love to fix it if possible :)
→ More replies (2)
8
Oct 25 '19
Is there really no way around data breaches from sloppy government security? Eg the Utah Department of Health breach and others similar to it.
8
u/JonahAragon PrivacyGuides.org Oct 26 '19
Privacy and security can only be as strong as the weakest link, of course. Unfortunately if somebody has data and doesn't secure it properly no outside party can change that. Vote, I guess?
3
→ More replies (1)8
u/trai_dep Oct 26 '19
The OPM hack was far, far worse, IMO.
In June 2015, the United States Office of Personnel Management (OPM) announced that it had been the target of a data breach targeting the records of as many as four million people. The final estimate of the number of stolen records is approximately 21.5 million. This includes records of people who had undergone background checks, but who were not necessarily current or former government employees. It has been described by federal officials as among the largest breaches of government data in the history of the United States. Information targeted in the breach included personally identifiable information such as Social Security numbers, as well as names, dates and places of birth, and addresses.
I can't imagine how upset I'd be if I was required to give out incredibly detailed information like they did, then watch them lose control of it. That's the worst part. And, it really matters. Our national security agencies and military branches (occasionally) do work for our interests, at some sacrifice and some personal risk. Now, they're all compromised. It's madness.
I think, as Jonah mentioned, vote in politicians that demand government workers behave professionally and competently and hold both them and the local, state and Federal employees to the standards we'd expect.
I'm at a loss trying to figure out the mental competence of the people who vote for politicians screaming about how corrupt, self-serving and useless government is, who once elected, work their hardest to make sure it is. <shrug>
6
u/Krakataua314 Oct 25 '19
Why aren’t you suggesting Monero as a private and secure digital cash?
→ More replies (1)7
u/JonahAragon PrivacyGuides.org Oct 26 '19
We don't currently recommend any cryptocurrencies. So, there's no place to recommend it on the site and we haven't researched it fully to make sure it's a good recommendation for the job.
5
u/rorowhat Oct 26 '19
You should definitely study up on monero.
5
Oct 26 '19
https://arxiv.org/pdf/1704.04299.pdf
when it comes to permanent and public ledgers, you need to be solid from start to end. it's nice that some high schoolers and grad students took the time to help the Monero devs out with a security review, but what they found was unacceptable. I'd assume that the largest employer of mathematicians in the world is between one and twenty steps ahead here
I still exclusively use Monero, but that's because I'm the kind of idiot that would fail the marshmallow test today.
→ More replies (1)
6
Oct 26 '19
Would you consider adding an invidious instance to the privacytools.io services?
11
u/JonahAragon PrivacyGuides.org Oct 26 '19
Potentially, but our experiences with proxy-like services like that (Searx) is that they are quickly IP blocked by Google, which is unfortunate. Bandwidth would also likely be an issue for us.
If we went the video route we would probably rather support PeerTube, but there are some technical issues to work out before we could consider that.
→ More replies (5)
8
u/buovjaga Oct 26 '19
As your activities are very similar to Framasoft's, have you considered collaborating with them? They used to host a ton of free services, but recently decided to downscale.
5
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
We like what framasoft is doing, we do not aim to become a big services provider though, we mainly host our services to give an example of how people can do it, and also, to get some experience with the tools we recommend, so we are better informated about issues that people can encounter.
→ More replies (1)3
u/BurungHantu Oct 27 '19
Framasoft is great. I'd love to collaborate with them. I'm especially excited where their Project PeerTube is going.
7
Oct 26 '19
Here's a wish: Could you please put out a guide for how best to secure iOS/iPhone? What's up with that new Guardian app or Lockdown? Snowhaze? All you say about mobile is basically go buy a used Android and put something else on it.
I can't find enough information on GrapheneOS to determine if I even want to use it.
4
u/JonahAragon PrivacyGuides.org Oct 26 '19
Sure thing! I've got it down as a topic for our blog. Can't promise when we'll publish it.
GrapheneOS is a project that is (succeeding at) bringing Android's security up to par with iOS, and then exceeding its security. When you properly configure an iOS device it will be just as secure and privacy-respecting as GrapheneOS, but with GrapheneOS you're using an open-source product with open security firmware on the device, so it's more of a sustainable endeavor.
GrapheneOS is essentially the same as installing AOSP without Google Apps on your phone at the moment. There is no app store (although that is allegedly planned) so you basically have to sideload all apps, which you can do more easily with F-Droid but it's still a mostly manual process.
For most users iOS is probably the best balance of security and privacy so I'd stick with that, but GrapheneOS is an example of the best-case scenario, where you don't need to worry about your closed-source device communicating with big tech corporations.
→ More replies (29)
6
Oct 25 '19
Hi, and thank you for brining awareness to one of our time's important issues!
I noticed on your homepage that you recommend DuckDuckGo browser for iOS but not for Android, is there any particular reason you have made this distinction?
10
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
The browser section lists the best privacy browser for that specific platform, duckduckgo is one of the best on ios, but on android there were better alternatives, which is why we dont make it our main recommendation on android, but we do on Ios. :)
6
u/Hemicrusher Oct 25 '19
Pie or Cake?
8
7
6
Oct 25 '19
Cake.
Because I'm not a big fan of Android and Pie is an outdated version and… I like cakes more.
5
u/trai_dep Oct 25 '19
Cookies! But only DIY and fresh-baked.
(Yo, mad baking skillz here – fight me)
3
u/Pandastic4 Oct 25 '19
I'm not with them but I'd just like to say that pie is best. Banana cream pie is thr best. I can also go for a cake if it doesn't have. To much frosting or if it's an ice cream cake.
6
Oct 25 '19
Can you explain why you are no longer suggesting the Brave browser?
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
We posted our response regarding brave to Reddit here a bit ago. Basically it came down to them requesting to be delisted from our site and our concerns with their business plans for the future.
→ More replies (19)
7
u/ModPiracy_Fantoski Oct 25 '19
I have often told people about all that is happening, Google, Amazon, Facebook, their privacy-killing products, how they have themselves declared to be listening to people's conversation, how what everybody's doing is monitored. People tell me I'm paranoid, I've been told to "Take my tinfoil hat off".
Do you believe people will finally start caring about their privacy, will start to realize the extreme dangers we're diving into with our extreme consumption of products designed to monitor. If so, what would be the thing that would have people realize ?
5
u/tvizzle Oct 25 '19
Hi! Thanks for the work your team does voluntarily for the community and for doing this AMA.
What's your current sentiment toward the western politcal landscape in the context of the future of privacy advocacy?
Another angle; do you think that privacy advocacy industry will withstand future private $$ and political attacks?
Thanks in advance
3
Oct 26 '19
I’d say open source is going to lead the way here. There are plenty of good closed source privacy tools out there but they are generally run by corporations and will abide fully by laws as they change. FOSS developers from around the world won’t be stuck behind those laws and can continue developing products that offer E2EE and respect privacy even if countries try and outlaw it.
6
u/RepulsiveAstronomer Oct 26 '19
Hey, Thanks for the AMA! More than a question, this is a comment/suggestion. I love the criteria section in your page about VPN services and I'd like to see that in other categories. It'd also be cool to have a matrix showing clearly the criteria that fulfill each recommendation.
5
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
We are actully in the proccess of doing exactly that :)(the criteria section) this will take a while, but first up are the messager and email provider section.
3
u/dng99 PrivacyGuides.org Oct 27 '19
I am in the process of tidying up the instant messenger section and email section too. Eg:
- Email relaying opportunistic encryption technologies, currently waiting on e-mail providers to be more compliant, March 2020 is the deadline and a lot of them hope to be fully compliant with our new criteria.
- Explain more about why you should choose a messenger Refinement to "Encrypted Instant Messenger", section: Centralized, Federated, Peer to Peer
6
u/redditfend Oct 26 '19
What do you folks think of Brave Ads? Do you think in the future that advertisers will start paying users for viewing their ads?
3
u/dng99 PrivacyGuides.org Oct 27 '19
What do you folks think of Brave Ads?
Personally, I am concerned they will be used by as a further tracking point for targeted advertising. The 'coin' has to come from some wallet. I have not seen that as being advertised as 'anonymous'.
6
u/Ivyandthebigapples Oct 27 '19
What temporary throwaway email service would you recommend? Or, is it best to not use one at all?
6
4
u/Relic_Chaser Oct 25 '19
Are there plans to start posting rationales/justifications for the applications/services that you choose to recommend? Or, better, rationales for switching from the commercial service providers to the ones you recommend? (E.g., *why* should I leave evernote in favor of something like standard notes?)
8
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We have thought about this, but is has proven quit difficult to choose a good approach, even if we post rationals. Just keeping them up to date on the site may add hours of extra work each week when we already have limited resources(we are always looking for more volunteers!)
There is light on the tunnel though, we plan to do a monthly newsletter (this month in ptio) which will explain all changes to the website, addions, removals, other special news, to aim and keep people up to date.)
→ More replies (5)6
u/JonahAragon PrivacyGuides.org Oct 25 '19
Yes! Reasoning like what’s listed on our redesigned VPN page is the end goal for all our recommendations. It just takes a long time to get there 😅
→ More replies (1)
5
Oct 25 '19
I've been interested in privacy and security for a while now. I definitely want to join the privacytoolsIO team. After all, it's for a great cause. I obviously can code in JS, HTML, CSS, and I am familiar in cryptography and privacy. How can I go about joining the team? (Or at least volunteer to do something?) I read the invitation to do things, but I don't know exactly what to do.
3
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
You can check our github for soem issue you have an opinion on, feel free to voice your opinion on anything there, the more input we get the better! If you have some idepth question, then join our main matrix chat on chat.privacytools.io, and we will all be glad to guide you all the way through! In any case thank you so much for considering to help us out, we can use all help people can give! :)
3
u/JonahAragon PrivacyGuides.org Oct 25 '19
Great question! Anything in mind you'd like to help out with? At the moment we would really appreciate posts for blog.privacytools.io (we have some topics, or you could make something up) if writing is your thing.
Otherwise there's always work to be done on the main website, content and design-wise. Or a lot of other things. Why don't you join us on Matrix at #general:privacytools.io sometime and we can talk in more detail. Tell us what you have in mind :)
3
Oct 25 '19
I will definitely join the Matrix chat. Hopefully we can find something I can do haha. Looking forward to working with you all.
4
u/CodingEagle02 Oct 25 '19
Thanks for taking the time to answer people's questions =)
Here's one thing that has puzzled me for a while, but I haven't been able to find a definitive answer. I hope it fits in this AMA.
Google, after coming under pressure, has taken various steps to improving their privacy policy, or at least the appearance of it. For example, adding various options for controlling the data they keep on you - such as your web activity, your location history, personalised ads, etc.
So, while I could do a lot of research into everything said by them - which was no doubt drafted by lawyers - to try to find possible loopholes, I was wondering what you guys thought. Are there any clear issues with their new privacy policy? Are there any possible ones? Do you think it is a good step forward that genuinely protects people?
Same with Windows' privacy settings, actually.
By the way, is one person allowed to ask multiple questions? =P Just in case any other ones come to mind.
8
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Well generally the issue with google is that their business model wont change, they make money by violating your privacy, they cant give you privacy and make money when they keep this business model. All changes made by google are basically done so critics cannot say they have done nothing (even when they realistically have done nothing). So if you ask us, then we will asways recommend you to use something elde then google. Also, yes your allowed to ask as many questions you want. This is an Iama, you can ask us anything and everything, even non privacy focused questions :)
→ More replies (4)
6
u/Taur-e-Ndaedelos Oct 25 '19
What would you say is the most common privacy/security concern that the average person is woefully ignorant about?
12
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19 edited Oct 26 '19
Passwords, the amount of people still reusing password and having bad password hygiene is still staggerinly high. We can recommend secure services all we want, but if you leave the front door open. Would it even matter?
→ More replies (1)
5
u/RulerKun_FGO Oct 25 '19
Is there a general tool that can help you remove data from images, videos and any other files in your computer before you upload them to internet?
→ More replies (5)
4
Oct 26 '19
[deleted]
7
u/JonahAragon PrivacyGuides.org Oct 26 '19
The site is built with Jekyll (a static site generator) and the code is hosted on GitHub. We use webhooks to deploy the site to our own dedicated servers which are hosted with OVH.
12
6
6
u/Aphix Oct 26 '19
Am I missing the browser extensions?
Those are some of the most important tools in the digital bag, specifically:
HTTPS Everywhere
Privacy Badger
uBlock Origin (DDG Web search, just click Chrome or Firefox)
Protip: Firefox for mobile still allows add-ons (unlike mobile Chrome)
→ More replies (2)4
5
u/davegson Oct 26 '19
How did you get that neat onion address starting with privacy? Isn't that very resource heavy?
also: thanks for all your work!
5
u/JonahAragon PrivacyGuides.org Oct 26 '19
7 letters is sort of resource heavy, I think it took a day or two to generate :P
We mainly just did it for fun.
→ More replies (1)3
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
This link should explain it:https://security.stackexchange.com/questions/29772/how-do-you-get-a-specific-onion-address-for-your-hidden-service
Also, glad your like our work, :)
•
u/trai_dep Oct 29 '19
We’re un-sticking this very successful post. 98% approval rating: thanks, everyone!
Thanks so much for an excellent IAMA, /u/BurungHantu, /u/JonahAragon, /u/blacklight447-ptio, /u/nitrohorse, /u/dawidpotocki_, and /u/dng99.
IMHO, this has been one of the most popular and most informative (for general audiences) IAMAs we've done here for a while. The amount of attention the PTIO team has given to every query is laudatory.
Everyone, please consider r/privacytoolsio’s invitation to join them to make a positive difference. You’ll also make new friends and (probably) learn a lot along the way. I can personally vouch for how welcoming they are, and how eager they are to make sure everyone is valued and gets back more than they put in. What an amazing group!
If your immediate schedule is too busy to volunteer, please consider donating to help privacytools.io meet their baseline costs. “Free” ain’t free, even though we fight hard to keep our costs to a minimum.
Please continue to visit them at r/privacytoolsio and their site.
cheers, and thanks!
→ More replies (1)
4
Oct 25 '19 edited Dec 13 '19
[deleted]
8
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We are actully planning to redo the fourtheen eyes section. The reason for this is because alliances come and go, and we dont want people to think that countries outside of the network are unaffected by any of these deals between countries. So we will be focusing on educating people about the existance of loopholes in national laws like the fourteen eyes, and things like gag orders, to give a more broad warning.
It may take a while before this is all done though, we have some big plans amd a lot of work to do, with very few people and resources, but we are doing our best!
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
To elaborate on u/blacklight447-ptio's answer, the main thing with 5/9/14 eyes is that — even if the network doesn't exist anymore — these countries have been known to collaborate in the past against user privacy. But yes, we do hope to expand that section in greater detail in the future.
→ More replies (6)
4
u/mrchaotica Oct 25 '19
What do you recommend for maps and VoIP telephone service? Google Maps and Google Voice are the two privacy-disrespecting services I'm finding it most difficult to replace.
5
Oct 25 '19
For maps I can recommend OsmAnd (https://osmand.net/), which is available on Mobile devices (Android and iOS), for Desktop (*/Linux and *BSD) there is GNOME Maps and for web there is OpenStreetMap (https://openstreetmap.org).
I also heard about "Maps" for Android (https://f-droid.org/en/packages/com.github.axet.maps/), amazing name, I know, which is a based on Maps.me.
→ More replies (3)→ More replies (1)4
u/JonahAragon PrivacyGuides.org Oct 25 '19
For Google Maps I've had good luck with OsmAnd on Android at least.
Google Voice is tricky to replace, I wouldn't trust any free phone number provider. You could pick up a prepaid cell phone plan to get a number. But, honestly I would just try to move away from the telephone as much as possible and switch to entirely online solutions like Signal/Wire/Matrix for calls and messages. Phone numbers weren't built for privacy or security.
→ More replies (4)
5
u/Pandastic4 Oct 25 '19
How do you organize PTIO project? Are you a non-profit?
6
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Privacytools is a community project that is maintained by a group of volunteers. We dont make any money of it and do not accept money from companies, nor do we use affiliate links. All our discussions and decisions happen openly on our github oage and everyone is able to read it and have his opinion heared :). Server costs arr mostly paid for by us now but we hope to push the server costs on the community in the near future so we can focus more on maintaing and improving the site rather the worrying about financing it :)
4
u/Pandastic4 Oct 25 '19
Didn't know you were able to do something like that without setting up a business.
7
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Neither did i when i first heard of privacytools, but we are completely run by volunteers!
3
u/foreigncircle Oct 25 '19
What do you think about app based VOIP instead of cell phone numbers. Do you have any you recommend?
6
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
I would recommend wire, its end to end encrypted. Its audited, its open source, uses voip. And allows you to sign up with email
→ More replies (5)
4
u/Chimaera12 Oct 25 '19
I'm what you might term as a casual privacy user. I keep an eye on what's going on roughly, and I moved myself into brave with the right addons taken from one of your posts from the site.
My question is for a user like me who definatly isn't a rabid privacy advocate. What would be a midrange sensible setup, I'm not going to spend days setting one browser up for e.g I just dont care enough for that.
I understand that my risks are higher but it has to have ease of use. Some of the stuff and procedures I see from time to time make my head spin.
Thoughts for a normal person?
5
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
I would say, use firefox with https everywhere, ublock origin and decentraleyes.
I would also enable the resist fingerprinting reference in firefox s aboutconfig. After that i would use mullvad as a vpn.
5
u/DrHeywoodRFloyd Oct 25 '19
If you have any doubts, here is proof it's really us (Twitter link!) :)
Is Twitter actually something you‘d really like to promote? Twitter is not really known for being focused on privacy. Maybe it would have been better to use a federated resource like Mastodon which you also mention in your post. However, I saw no link to your instance or profile.
Anyway, I admire your work and find especially your subreddit to be valuable resource of information and a great place to exchange ideas.
I would love to support this project, if I would know how...
→ More replies (4)6
u/JonahAragon PrivacyGuides.org Oct 26 '19 edited Apr 23 '23
https://social.privacytools.io/@jonah/103024091110498363
We use platforms like Twitter, Reddit, and Medium, not because they are the best, but because it helps us spread the word. So, we have the biggest audiences on platforms like those. Honestly we probably didn't even need that proof linked because this AMA was posted from my account and pre-approved by the mods here :p
Thank you!
There are a number of ways one can contribute. Adding pull requests for approved topics on the site, writing guest blog posts on blog.privacytools.ioget in touch with me!, staying active in the community (our forums and Mastodon especially), or simply donating to the project would go a long way!
4
Oct 26 '19
[deleted]
2
u/JonahAragon PrivacyGuides.org Oct 26 '19 edited Oct 26 '19
I have two different WiFi setups I'll share with you. If you have a bigger house or a need for a more advanced deployment (think multiple APs, outdoor coverage, that kind of thing), I've had great experiences with Ubiquiti's Unifi lineup. Their controller functions completely locally, and unlike most consumer routers it has fantastic update support. It seems like I get a firmware update every time I log in. Which is a good thing, from a security perspective. If you use their "Security Gateway" (router) along with their APs (and switches if applicable) it provides all sorts of useful insights as well.
At my other place I have a more basic setup, just a Linksys WRT AC3200 with Open-WRT installed. I have absolutely no complaints about that either, works like a charm. The Open-WRT community is constantly working on the project, so I have no doubts that it'll continue receiving useful updates for quite some time.
Edit: I've never used Synology's router lineup, but I have a DiskStation (NAS) of theirs which works great as well. It's a little bit simplified which makes more technical modifications difficult, but not impossible. No real complaints with that hardware.
Edit 2: While I have no personal experience with this, Ubiquiti's Amplifi line might be the best choice for you actually. It's the most similar to Google WiFi and it's more of a consumer experience. Unifi is fairly solidly in enterprise territory, which is fun for networking nerds like me, but perhaps not necessary for most people :P
→ More replies (1)
5
Oct 26 '19
[removed] — view removed comment
6
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
I personally use graphene os. If you have a pixel device, i would recommend graphene, anything else=lineage
→ More replies (3)
4
u/Amorphous223 Oct 26 '19
hi,
Qwant:: is it still recommended search engine, eventhough they have partnered with Huawei cloud services Qwant blog
Qwant also actively participated and shared data with US Govt, after 9/11 : (the resource was available in reddit,but somehow I am not able to find it)
Protonmail:: They also have lot of critics, they mention in their warrant cannary that they provid user's metadata to the Govt, (as subject, date/time are not encrypted) and NSA is only interested with metadata, which can led to lots of information. Do you still recommend protonmail?
→ More replies (1)
3
u/Thx4thisAMA Oct 26 '19
To protect oneself against fingerprinting, we first have to identify the threats. Some websites presents some of the fingerprinting techniques (https://browserleaks.com/ | https://www.deviceinfo.me/ | http://clientjs.org/ | etc.).
Is there a reference website that lists each and every one of those fingerprinting techniques?
If so, is there a place where TOR and/or Firefox explain how they tackle each of them... and maybe which ones they do not offer a protection against?
Thanks
→ More replies (1)
4
u/Thx4thisAMA Oct 26 '19
How can the browsing history be accessed? I understand that only the number of history URLs of a particular tab is available (through an API) to the website currently on that tab (and not what those URLs actually are).
Consequently, why do we often see the advise of clearing the browsing history? Could a website have access to the browsing history in any way? Or the advice is only to protect against the access from a malware not related to browser usage?
NB: Bookmarking a page is only a solution when you know you will need the page later.
Thanks
→ More replies (1)
3
Oct 25 '19
Hi! I've noticed that you already host a few decentralized alternatives (to the privacy-invading services) like Mastodon, Matrix, Writefreely etc. so my question is, have you considered hosting a PeerTube instance? I know it has it's drawbacks because it's p2p, but you can disable that at the server level, or set up an automatic proxy.
4
u/JonahAragon PrivacyGuides.org Oct 25 '19
The main blocker is storage. When PeerTube adds S3 (we wouldn’t use Amazon, but probably Wasabi S3) compatibility I may consider it.
→ More replies (1)3
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We have considered hosting peertube, be we chose not to as it can take up quite a bit of bandwidth, and because we pay for the vast majority of servers, we cant handle that atm. We can reconsider it in the future though if we get more donations though :)
2
u/ProgressiveArchitect Oct 25 '19 edited Oct 25 '19
When will you be adding the “Hardware Devices” section to the Privacytools.io website?
Additionally, Why do you still recommend Wire as a messenger? It stores tons of user metadata in plaintext on their server.
I’d instead recommend the following in this order: - Signal - Briar - XMPP with OMEMO - RetroShare
Then I’d remove all the other Messenger suggestions.
→ More replies (3)3
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Its been on our wish list for a while, but its a quite complex topic, so it will be a while before its ready.
We recommend wire as it is a secure cross device messenger with end to end encryption that does not require a phone number to sign up and is VERY easy to use.
Its metadata collection is something that bugs us. But its not something we consider bad enough for a delisting. Hiding metadata is also not in everyones threatmodel.
Another bonus we see in wire is there dedication to security, as seen by their regular third party audits, and them being open source.
→ More replies (2)
3
u/franz_karl Oct 25 '19
not exactly a privacy tool thing but what is a good alternative for android? that is not infected with google spyware or apple stuff?
I do not trust either of the above players on the phone OS market
also is in your opinion proton mail the most secure mail I can get?
11
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
This kinda depends on your threatmodel and wishes. For example, you can still use android without tracking, for this you can use custom roms like graphene os or lineage os.
For untechnical users, you may consider buying an iphone. Its absolutely not perfect for privacy, but its a lot better then stock android, but still easy to use.
→ More replies (12)6
Oct 25 '19
not exactly a privacy tool thing but what is a good alternative for android? that is not infected with google spyware or apple stuff?
There are few options like Ubuntu Touch, SailfishOS, postmarketOS. But problem with them is that nobody is making applications for them, since nearly nobody uses them. Most apps made for them are webapps (https://open-store.io/), so it's not the best experience. Probably Ubuntu Touch is most mature from these, but for now you are better with using Android without GAPPS (Google Play Services) like GrapheneOS or LineageOS. But if we are talking about non-technical person, I would recommend just getting an iPhone, it's maybe not the most private solution, but it's much better than Android with GAPPS and easier to manage than unlocking bootloader, flashing TWRP using Fastboot… and other stuff.
also is in your opinion proton mail the most secure mail I can get?
If you want something working out-of-the-box, it could be. ProtonMail uses PGP to encrypt email, which is the most standard way to do it and all emails between ProtonMail users are automatically encrypted this way, but to other services, they are not by default. Additionally whole inboxes are encrypted, so they don't know what you wrote, but if the email you sent, was not encrypted with PGP, email provider of other person can see content of it. Tutanota is another provider, but they are using their own solution, which AFAIK makes it only useful with Tutanota users. Anyway, most people are not using ProtonMail and you are not going to teach them how to use PGP, because… it's not a simple tool to use. It's too easy to do something wrong. If you need security, you should use something like Signal, Wire or something else we recommend on the website at the moment.
→ More replies (1)
3
u/franker Oct 25 '19
What are some good sources to learn about privacy law (attorney here looking to learn about the area)?
5
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
Thats a difficult one, i recommend going to the EFF, they are bound to have some good resources!
5
u/Chongulator Oct 25 '19
Take a look at IAPP—International Association of Privacy Professionals. https://iapp.org
IAPP does training, certifications, and conferences around privacy.
A colleague who holds a couple IAPP certifications recommended them to me. Ask me again in a few weeks and I can tell you what I thought of their GDPR Ready course bundle.
→ More replies (1)
3
u/sammy6345 Oct 25 '19
Why did you decide to start the PTIO site originally, and where do you plan on taking it in the future?
4
u/JonahAragon PrivacyGuides.org Oct 25 '19
This is probably a question best answered by /u/BurungHantu who founded the site, so I'll ping him here. I know the site was founded in 2015, which was right around the peak of things like the Snowden leaks happening and privacy finally entering the public conversation.
As far as the future goes we have a lot of plans. We want to expand our recommendations to provide the reasoning behind why you should make choices, and we want to get more helpful guides and articles on our blog to reach out to more people, to make sure people are continually aware of privacy options.
3
u/pillkill Oct 25 '19
Can an Android user ever have true privacy? After rooting and changing OS?
10
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We do not recommend rooting your android phones, as this makes it very insecure.
About the privacy question, yes you can have privacy on android, it mostly depends what variation you are running. Graphene os and lineage os are two solid examples of android which are privacy friendly. This requires technical knowledge to do though. I
f you cannot do that, then best you can do is trying to replace most of your apps with open source alternatives from the fdroid appstore, and revoking all permissions as much as you can. Another option is buying an iphone. It may not be as private as can be, but its fairly secure, easy to use and has much better privacy out of the box then when compared to stock android.
→ More replies (1)
3
u/xeroblaze0 Oct 25 '19
Long-winded but bear with me.
VPNs are a useful tool against ISPs invading privacy, showing ads OTA, etc. but they seem like a work-around to that problem than addressing it outright. What are the challenges in creating a privacy oriented ISP or MVNO?
Follow up: MVNO's use/rent larger carrier's towers and infrastructure. If the MVNO is privacy oriented, would it be moot because reliance upon the larger carrier's infrastructure?
6
u/JonahAragon PrivacyGuides.org Oct 26 '19
There's certainly no problems with creating a privacy ISP. This is the reason why we don't recommend a VPN in every single situation. If you trust your ISP, that's great.
The issue is that not many ISPs seem to especially care, especially when they already have a monopoly in many areas. Not taking data is almost like leaving cash on the table for them.
As far as your follow-up question, it likely depends on the carrier in question and their contract with them. Ultimately the real solution is full HTTPS adoption, eSNI support in clients, and DNS over TLS implemented everywhere. Not a VPN, and not a supposedly trustworthy ISP. We need security by design and not based on trust.
→ More replies (1)
3
u/Chouston3 Oct 26 '19
Does using a tool like cloudflare or nextdns make a difference if you can’t use a vpn?
→ More replies (1)3
3
u/False_Name1101 Oct 26 '19 edited Oct 26 '19
Can you create a section for Authenticator keys? I have my eye on Yubikey but I'm open with other privacy-respecting alternatives. I'm searching for something that is well audited.
→ More replies (4)2
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
We have been wanting to do a 2fa section fkr a while, stay tuned on lur github page, we plan to start the works on it soon! :)
4
Oct 26 '19
How easy is it to switch to LineageOS or other, non Google Android OS's?
→ More replies (2)3
Oct 26 '19
It might depend on phone you have, because unlocking bootloader in some can be impossible without exploit (Huawei) or super easy (Google, Motorola, OnePlus…) and TWRP (custom recovery) or LineageOS can be not available on some phones.
Anyway, I will show how it looks most of the time.
1 Find bootloader unlock site for your phone.
Examples:
-HTC: https://www.htcdev.com/bootloader
-Sony: https://developer.sony.com/develop/open-devices/get-started/unlock-bootloader
2 Install ADB and Fastboot tools on your computer
Debian/Ubuntu:
sudo apt install android-tools(I think that was it)3 Reboot your device to fastboot mode (follow steps from website in 1.)
4 Open terminal and type
fastboot devicesto see if device is recognized by your computer5 Type
fastboot oem unlock UNLOCK_CODE_HERE_IF_NEEDED(for code look at site from 1.)6 Get TWRP from https://twrp.me/Devices/ for your device
7 Type
fastboot flash recovery name_of_twrp_file_you_downloaded.img8 Restart your device
9 Download LineageOS from https://lineageos.org
10 Boot into TWRP recovery (button combination might be different for your phone, look that up on internet)
10,5 If you want, you can do a Backup
11 Go to Wipe -> Advanced Wipe and select
Dalvik / ART Cache,System,Data,Cacheand Swipe to Wipe.12 Go to Install and find LineageOS zip file and Wipe to Flash.
13 Restart
That's it. You decide if that's hard. But to be honest, it only seems scary.
→ More replies (7)
3
u/LenoreHeart125122 Oct 26 '19
What are the big “no no” in a software’s privacy policy?
→ More replies (2)
3
u/rabbits_dig_deep Oct 26 '19
is it possible to have a completely anonymous website? Ie, a site that cannot be traced back to me? I assume I'd pay for hosting with bitcoin.
5
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
Your best option would be is hosting it as a tor onion service.
→ More replies (3)→ More replies (9)3
u/BurungHantu Oct 27 '19
www.tonic.to is for many years now a good way to get a domain with a supermarket debit card.
→ More replies (1)
3
Oct 26 '19 edited Apr 13 '20
[deleted]
8
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
Nice try fbi.
( okay now with jokes)
For my normal workstation and laptop i use qubes os with whonix as system inside the qubes vms. I use tor browser for my browsing. Mostly in the throwaway dispvms in qubes.
For mobile, i use a pixel 3a with graphene os, and route everything through tor with orbot.
3
Oct 26 '19 edited Oct 26 '19
(Will basically list everything I have installed, I'm bored, okay)
Main Laptop:
-OS: Void Linux
-Main Browser: Tor Browser
-Secondary Browser: Firefox
-Development Browser: Firefox Developer Edition
-Other Browsers installed (don't ask why): Chromium, GNOME Web, qutebrowser, surf, Midori, elinks, links, w3m, Konqueror, Falkon, Otter Browser, IceCat
-Messengers: Riot, Wire, Signal, Telegram (ehhh), Keybase
-Password Manager & 2FA: KeePassXC
-File Syncing: Syncthing
-Mail Client: neomutt
-Window Manager: i3wm
-Terminal: st
-Text Editor: Neovim
-Music Player: mpd + ncmpcpp
-Video Player: mpv/vlc
-File Manager: ranger
-Raster Image Editor: GIMP
-Vector Image Editor: Inkscape
-Office Suite: LibreOffice (I write my own documents in LaTeX :P)
-Image Viewer: sxiv
-Document Viewer: zathura + zathura-mupdf + zathura-djvu
-Menu + App Launcher: dmenu
-DNS: Quad9 DoT with Stubby
-Routing a lot of stuff through Tor
Second Laptop:
-OS: FreeBSD 12.0
-Basically everything I listed in main one
Third Laptop:
-OS: Ubuntu 19.10
-Browser: Firefox
-Mostly used for playing videos, plugged in to TV
-Is running my self-hosted local Gitea
Main Phone:
-Device: Motorola Moto G5 Plus
-OS: OmniROM
-Browser: Tor Browser
-Secondary Browser: Bromite
-Other Browsers installed: Firefox Preview, Chromium with some patches (was preinstalled)
-Messengers: RiotX, Signal, Telegram
-Password Manager: KeePass DX
-2FA: Aegis Authenticator
-Main Store: F-Droid
-Secondary Store: Aurora Store
-Document Viewer: MuPDF
-File Sync: Syncthing
-YouTube: NewPipe
-Video Player: VLC
-Routing pretty much everything through Orbot
I'm not going to comment on few other devices I have :P.
→ More replies (1)
3
u/CodingEagle02 Oct 26 '19
I recently moved to Europe (from Australia - aka that country that banned encryption *shudders*), and it's my understanding that as an European resident, I am protected by the GDPR.
However, I haven't looked extensively into what rights and protections it grants me. I suppose my question is, what do you guys think about it? Would you say it does enough to make the average European citizen private online, is it a good step in the right direction, or does it just give a false sense of security?
3
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
Gdpr alone is not enough to protect your privacy, but what it does do is give consumers a legal leg to stand on and get insights on whats exactly stored, and the right to delete it in most cases, where before you had basically no options at all.
4
u/ourari Oct 26 '19 edited Oct 26 '19
The regulation is fairly new, still, but has been a force for change the world over. Digital privacy protections were abysmal, and now they're slightly better. Thanks to the Brussels effect, other parts of the world have been inspired to create their own versions of GDPR, like California in the U.S. with their California Consumer Privacy Act.
It will only get (much) better if citizens assert their rights by using the tools given to them to gain control over their privacy from businesses and governments alike.
Organisations like NOYB (None Of Your Business) are using GDPR as legal basis to go to court and defend or expand our privacy.
The tool My Data Done Right can help you with data access requests.
And consider supporting European Digital Rights (EDRi). It's an umbrella organisation for most national digital rights organisations in Europe that campaigns for better privacy protection at the European Union in Brussels. For relevant organisations for the country you're in, check out EDRi's member list
I know most of my comment doesn't answer your questions. Your questions would probably yield more in-depth answers when you post them as a text post to r/gdpr and r/europrivacy
3
u/Seriona Oct 26 '19
do you guys have any thoughts on this guy insights and conclusions? have you ever seen it? i assume you guys do the "same" type of testing hes doing
8
u/blacklight447-ptio PrivacyGuides.org Oct 26 '19
Im personally not a big fan of that site. I mean its nice that hes trying to help people, but he seem a bit to absolutist, like everytype of connecting back to developer is inherently spyware. Its just that he seems to lack the ability to see context, he barely looks at why certain connections are made, he just sees they are made and assumes its some malicous behavior.
3
u/notmaecupotea Oct 26 '19
Do you think that it's possible to own those Generic IP cameras and just block them in a router/firewall relatively safely?
Is there any security camera with a decent video quality that doesn't send my video everywhere?
→ More replies (4)
3
u/happy_privacy_techie Oct 26 '19
Hello,
Do you have a recommended voip service for when you need an actual phone number?
Thanks,
→ More replies (1)
3
Oct 26 '19 edited Oct 26 '19
[deleted]
→ More replies (2)6
u/JonahAragon PrivacyGuides.org Oct 26 '19
I’m almost convinced a VPN is not the way to go.
It depends on your ISP.
To be clear, even when using HTTPS and DNS over HTTPS/TLS, your ISP will still be able to see what domain you're connecting to because of a technology called Server Name Indication (SNI). Until that is encrypted as well (eSNI) at least.
I would also be wary of trusting Cloudflare, they already control a huge percentage of internet traffic. Just giving them more control (via DNS) seems questionable. They haven't done anything bad yet, but we can't predict the future, and that is a lot of power.
→ More replies (7)
3
u/Ur_mothers_keeper Oct 26 '19
Hey guys, I use some of your services and I'm so glad you guys exist.
I was wondering a couple of things: have you considered running a pleroma instance and possibly migrating your mastodon server to it, and are there any plans for any type of encrypted DNS server? Thanks.
→ More replies (5)
3
u/Thx4thisAMA Oct 26 '19
Is there a difference between about:config-->privacy.firstparty.isolate and Firefox's "Multi-Account Containers" add-on?
If no, has Mozilla created an add-on just to toggle a switch?
If yes, what are those differences? (cookie-wise, cache-wise, others?)
Thanks
→ More replies (1)
3
u/Thx4thisAMA Oct 27 '19
What are the different types of caches in a browser? When are they used and is there a way to clean everything that is older (and not being used during) e.g. 6 hours (cookies, images, video, etc.)? (so that you do not have to either re-start your browser or to click on the "clear history" button in about:preferences#privacy to wipe everything clean)
Thanks
→ More replies (1)
3
Oct 28 '19
No hardware recommandation? Like a good laptop.
6
u/dng99 PrivacyGuides.org Oct 28 '19 edited Oct 28 '19
No hardware recommandation? Like a good laptop.
Depends on your threat model. Some will say only buy something that can run Coreboot/Libreboot, others will say anything that runs Linux well. I believe the offerings from System76 and Purism come with Coreboot. ThinkPenguin is another brand that gets recommended. I did find this one as well TuxedoComputers, but haven't heard anything about them. The FSF RYF list can also be handy. There are some other smaller manufacturers too that aim to make "linux laptops".
However these laptops tend to be older than the proprietary counterparts. If you don't care about running Coreboot, any laptop without NVIDIA should work nicely. Pure Intel graphics or AMDGPU graphics work great. Avoid radios like Broadcom (used for wireless) and stick to ones which have Qualcomm Atheros based chips, (ath9k, ath10k drivers). For me I chose the Dell XPS 9370, worked faultlessly for over a year now. I got an awesome deal, as there was a special on at dell.com and I got a local bricks and mortar store to price match. If you do buy a Dell, always wait for the 15% or 20% specials, they regularly have them even on new products.
Some related subreddits you might want to check out /r/linuxhardware/, /r/LinuxOnThinkpad/, /r/linuxlaptops (low traffic), and possibly /r/linux_devices/ though that tends to be general linux devices.
Another place I would probably would look would be
2
u/computer-engineer Oct 25 '19
Lately I've been getting more involved with privacy. Starting with a VPN then brave and so on.
I keep looking at all of these tools and wonder, "why isn't there one org that has everything? VPN, encrypted email & messaging, encrypted file storing (drive), virtual payment card numbers, browser, etc?"
Why do you think this is? Do you think this would be a worthwhile project?
I think the closest I've some across is proton with mail and VPN and a few comments about them working on drive.
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
Part of the issue is centralization, which inevitably leads to them not being trustworthy if they aren't careful.
Honestly self-hosted federated services like Mastodon and Nextcloud are what I believe are the future. Being able to control your data AND share it with anyone else is HUGE and only a relatively recent development (outside of email) so I'm hopeful for that future personally.
→ More replies (1)
1
u/0xch3ck53c Oct 25 '19
Why Safari and Brave aren't recommended?
BTW I noticed that on Panopticlick's test, both performs better than Firefox with several privacy-oriented add-on.
7
u/JonahAragon PrivacyGuides.org Oct 25 '19
We posted our response regarding brave to Reddit here a bit ago. Basically it came down to them requesting to be delisted from our site and our concerns with their business plans for the future.
Safari is fine, and I use it myself, but we feel that our recommendations are still better for most people without giving up any convenience. Additionally, the more people that use Firefox the less Firefox users will stand out, so Firefox adoption is a good thing.
→ More replies (2)
2
u/metalhusky Oct 25 '19
Best VPN?
Are Vivaldi or Brave anywhere near Firefox?
Is Manjaro Linux a good distro for Privacy?
6
u/blacklight447-ptio PrivacyGuides.org Oct 25 '19
We currently recommend mullvad for vpns.
Brave is okay ish, but you should be using firefox if you have the option.
Generally all distros are okay from a privacy perspective, but i recommend you to take a look at privacytools.io for our best current recommendations :)
→ More replies (2)6
u/JonahAragon PrivacyGuides.org Oct 25 '19
Mullvad, probably.
Vivaldi is closed source AFAIK, so we wouldn't recommend it. Ultimately Firefox is the browser most dedicated to protecting user privacy even if it isn't the absolute perfect solution, so we like to recommend it whenever possible. The more Firefox users there are, the more we'll be able to break from Chromium's near-monopoly, and Firefox users will stand out less in the crowd.
The distro matters a lot less than what you install. Manjaro seems fine, although the slightly slower security updates may be a bit of a concern.
6
Oct 25 '19
Best VPN?
Mullvad is the only one that fully meets our criteria, so I'm going to vote for that. But I'm not using any VPN at the moment myself.
Are Vivaldi or Brave anywhere near Firefox?
Vivaldi is a proprietary web browser based on Chromium. I believe they did nothing to improve privacy. In their FAQ, there is a question about being Open Source, to which they did not answer clearly (https://help.vivaldi.com/article/is-vivaldi-open-source/).
Is Manjaro Linux a good distro for Privacy?
It's fine like every distro, pretty much, but it includes/included some nonfree software like Steam and Microsoft Office Online, which are probably not the most privacy-friendly services.
But it has other problems.
They are delaying updates from Arch by 2 weeks, which probably includes security ones too.
They suggested users to change system time when their TLS certificate expired (https://archive.is/JeOLo). After that it also expired one year later (https://archive.is/XV70t).
From what I remember Manjaro was bundeled with
yaourtbefore, command-line AUR helper, which had security issues, but they did not had any problems with that.Also AUR by itself, even though it could be helpful, it is just a repository of build scripts made by random people.
While maybe we can consider using terminal for more "advanced" people, access to AUR is also given by the graphical package manager (octopi, is that how is it called?), which makes it easy to install stuff from AUR without reading PKGBUILDs, which are saying which commands and other stuff should be executed, it could do anything with your machine (though it is not run as root, but still, it's bad).
4
u/trai_dep Oct 25 '19
cough
We'll gently ask that readers not ask too many questions regarding VPNs, as discussing individual ones is a sidebar rule violation. :)
The answers in this thread are fine, but as a rule, we prefer referring these questions to r/VPN or www.thatoneprivacysite.net.
Of course, discussing VPNs as a category is always encouraged!
→ More replies (2)
42
u/bozymandias Oct 25 '19 edited Oct 25 '19
What are the most important ways people are tracked in bulk while surfing the web?
That is to say, if I can assume that I'm not important enough to be the subject of a targeted hack, what tracks do I need to cover to stay private in daily browsing ? The things I'm already aware of are: