I have been reading up on privacy, computer- and information security and free software for quite a while now. These topics are very broad and can’t be summed up in just one post, so I’m going to write about eight steps that I think will increase your security and privacy while you are doing your computing.
Why Privacy Matters
First a brief introduction about why privacy matters. I see privacy as a fundamental human right, even when speaking about the Internet and computing in general. A lot of the people living on the planet are now connected using computers and the Internet, and it’s part of the daily life for a lot of people. This is why privacy matters in computing and networks. We should have the right to not being spied on, monitored, and suspected for no good reason. But this is not the only reason. Freedom of speech is also important, and you should be able to speak your mind and not being afraid of the consequences, like being flagged as a potential threat or far out radical. You should be able to freely express yourself.
You should be allowed to be anonymous online (where it makes sense). For example by not being identified with personal/sensitive information without a good reason, and be able to use aliases. And yes, there are legitimate reasons for using aliases. There are people out there who fear for the consequences of expressing their views, signed with their real name. It could be reprisals from employers, bullies, or the government. Groups that might want to use an alias when surfing online are activists and journalists. Anonymity is connected to both privacy in general and free speech.
You should be able to have a private life, be able to communicate freely with others and not fear for prying eyes on every move you make. After these arguments I hope you don’t still think about the classic apology which goes a little something like this: “Why should I care about this stuff when I have nothing to hide?”. You should at least care about others and their privacy.
The Eight Steps for Increased Privacy and Security
(Disclaimer: These steps doesn’t guarantee 100% privacy and immortality. And the tools and tips in this article are my recommendations. That means there are other tools and opinions out there.)
I’m going to leave out the most obvious things, like choosing strong passwords, not sharing your passwords with others, not download whatever you find on the Internet, etc. And I’m not going to suggest methods that makes your computing too much of a hazzle. I’m trying to find a balance between privacy, security, and having a functional life in the computer world. Use Tor and Tails when you want, of course. If you feel the need for it in everyday life. You can also have a secure computer not connected to the Internet (ever), running GNU/Linux or BSD and with full disk encryption. The possibilities are out there for the more paranoid (no offense).
Anyway, here is my list (the list is not sorted on importance):
1) Don’t use Gmail, Outlook, Yahoo! Mail, or similar.
Don’t trust the big companies behind these services listed above. You are not their costumers, you are the product that they are selling. They sell your data to third parties to make money and may turn over your data to the NSA and other government agencies. If you can afford to pay for a privacy aware email service, then do so. You will support a good cause. Don’t simply believe all the praise the email service providers give themselves about privacy. Do your own research. I recommend MyKolab, for now.
2) Use free software.
Free software means open source code, and open source code means that you can audit (look over) the code for yourself. If you don’t know programming you can pay someone to look over the code, or just see what others say about the software. It’s harder to hide backdoors and spyware in broad daylight, compared to behind locked doors. Free software is also often a synonym for privacy and security. Bigger free software projects are fast to patch critical security issues in their software.
As for the operating system I recommend running some GNU/Linux distribution or a BSD distro. GNU/Linux is my choice. I can find the software I need and easily install it. Using many of the most popular GNU/Linux distros are easy these days. That is a reason for choosing GNU/Linux over BSD, even though BSD can be pretty easy to use. The communities are also bigger in the GNU/Linux camp. I recommend Debian GNU/Linux for software freedom, stability, privacy and security. You can encrypt one or more partitions on your hard drives while installing Debian, for an added layer of security. One thumb rule goes as follows: The more packages you install/have installed, the more potential security holes you might have in your distro setup.
I recommend using Mozilla Firefox as your web browser. It’s open source and Mozilla cares about privacy and an open web. The Tor Browser is another alternative, but maybe not that suited for everyday use.
For more open source alternatives to proprietary software, visit AlternativeTo.net.
3) Use encryption.
Encryption is the process of encoding information or data so that only the intended parties can read it / understand it.
Encryption is important and protects your data from prying eyes, both online and offline on your hard drives. Sensitive data transferred over the Internet and sensitive/classified information on your computer should be encrypted. So, if you don’t want the information to get into the hands of strangers in “clear text”, use encryption.
When you are surfing the web, be sure you are using HTTPS addresses when you log in in to websites (look at the address bar in your web browser). This makes it very hard for attackers/sniffers to get your usernames and passwords. The connection between you (the client) and the server is encrypted. For offline computing and protection against physical attacks directly on your computer (theft for example), you can go for full or partial disk encryption.
For your communications, use XMPP (find a server to sign up to) together Pidgin + the OTR plugin for traditional chatting/instant messaging. For encrypted chatting in your web browser, use Cryptocat. For text, voice and video messaging, you could try Jitsi (instead of Skype).
4) Disable tracking.
Tracking is when websites are getting information about you and your browsing habits. It can be pretty innocent at times, or not. Tracking can be misused by companies selling your data to advertisers without your consent, for example. You can enable the Do Not Track Mozilla Firefox setting and install Disconnect and/or Adblock Edge/Plus add-ons to help block tracking attempts.
5) Get rid of tracks left behind by your web browser.
Remove cookies, history and cache that may be misused to identify you and your web browsing habits. This is done in your web browser. You can use private browsing in Mozilla Firefox or incognito mode in Chromium/Chrome so you don’t leave so much data on your computer about your web surfing.
If you don’t want to leave any tracks from your Internet browsing session, consider using the Tor Browser.
6) Be aware of online services and web apps hosted in the U.S.
The USA is not the land of the free or the land for privacy. You have hopefully learned that much over the last years of surveillance disclosures.
If you can avoid web services hosted in the U.S., then consider doing so. I’m primarily thinking about the web services where you provide your personal information and data/files. So, websites you log in to, kind of. This rule goes especially for email services, file hosting services and other services where you store personal and sensitive information.
Find out if a web service is hosted in the U.S. by using the Flagfox add-on in Mozilla Firefox.
7) Install add-ons in Mozilla Firefox (or other free software web browsers) for increased privacy and security.
The web can sometimes be a scary place, but that can be overcome with some help.
– Block advertisements and trackers: Adblock Edge/Plus.
– Visualize and block invisible tracking: Disconnect.
– Encrypted instant messaging: Cryptocat.
– HTTPS enforcement: HTTPS Everywhere.
– Cookies and local storage deletion: Self-Destructing Cookies.
8) Use a privacy friendly search engine.
Don’t identify yourself to any search engines. It’s not even needed. Google, for example, keeps your searches and other identifiable user information for an undefined period of time. They are also tracking you on other websites, like Facebook does too (source).
Alternatives to the Google search engine are DuckDuckGo, Startpage.com and Ixquick. DuckDuckGo is pleasant looking and has some nice features. And of course, gives me the search results I need, most of the time.
Some Final Notes
I haven’t mentioned anything about safe use of smart phones and tablets, so that is another chapter I’m not going to cover now. I don’t use such things much, so I don’t care too much about it. Also, it’s not my expert field. Things may change if I buy an Ubuntu Phone or tablet, a Firefox OS device, or something like that. It’s possible I will write about these topics later.
Anyway, that was eight tips. I hope they gave you some ideas about how you can fight for your privacy. You can read on if you are interested in the topics already discussed and want more advanced methods in your toolbox.
Read on if you feel like going even further…
If you are looking for even more tricks and are fine with using more energy on privacy, you can look into a good VPN service, end-to-end encrypted emailing using GnuPG, and alternative social networks like Diaspora*, GNU social, Movim and Identi.ca (instead of Facebook, Twitter, etc). The alternative social networks are all decentralized by their design, so they are representing freedom and privacy (and I smell some digital anarchy as well).
If you want to go even further, you can host your own web services/apps. You can have them private on your home network or connected to the Internet. Your data, on your hardware, under your control. Some examples are:
- Content management system (CMS): Joomla! or Drupal.
- Blog: WordPress, Jekyll or Ghost.
- Media hosting: MediaGoblin.
- File hosting / cloud storage service: ownCloud or Seafile.
- Social network: Diaspora* or Movim.
- Micro-blogging: GNU social or pump.io.
- Mail server: Kolab.
- XMPP server: Prosody or ejabbered.
- Forums: Vanilla Forums or Discourse.
- Wiki: MediaWiki.
Privacy and security is not a destination you get to, it’s a journey. The technology is evolving and so is the societies. So keep your eyes open and use common sense. Keep improving your computing habits and please spread the word about privacy related guides/articles like this one.
Thanks for your time.