Slashdot Mirror
How do You Protect Your Online Privacy?
P asks: "In the light of the recent discussions about on-line privacy: What can one do to protect his/her on-line privacy, while still having a enjoyable web experience? For example, are you using PGP for all your emails and Zfone for all your VOIP traffic? Or are there better ways of protecting oneself? Share your tips and tricks."
I don't use the internet.
seriously, if "They" want your data, They will go through your trash, subpoena your pay records and phone records, and tap your phone line. "They" will know more about you than you can imagine, regardless of whether you use encrypted VoIP or not.
Want to feel safe on line? Write your Congressman, tell your friends about IP and privacy issues, affect a cultural change. As long as 51% of your friends are willing to trade freedom (theirs and yours) for security (mostly theirs), you're fscked.
I want to delete my account but Slashdot doesn't allow it.
[x] Post Anonymously
I was using GPG in Thunderbird, linked to my gmail account. This was just for signing though, so it was more to protect my identity than my privacy. I believe GPG does encryption too. It was seamless once it was setup, but I use gmail from too many places. It just wasn't worth it. Here's hoping Google adds support for this sort of thing to Gmail.
This isn't a direct answer, but it's directly related. I've always wondered why network applications don't use encryption by default. For practically everything, from web servers to instant message apps, you have to go out of your way to set it up with any decent level of security.
Why aren't all connections passed over ssl or ssh? I know it's a bit of overhead, but it's not that significant for modern desktops.
Why isn't it the norm to see web servers running SSL? Why is SSL reserved for only financial transactions? For high-traffic web sites, this will slow the server down a little, but isn't that a valid tradeoff?
People seem concerned about the NSA wiretapping scandal, but this would be largely moot if the traffic they were snooping were encrypted. I can't be the only person who wishes encryption was the standard rather than the exception.
well, personally, if i'm doing something that i don't want traced, i'll fire up tor (http://tor.eff.org/)tor
i currently don't really worry about my email security (if someone wants to read my aunt's cookie recipes, thats fine by me). if i happened to be doing something important, i'd likely use some form of encryption, likely PGP or maybe something stronger.
upon the advice of my lawyer, i have no sig at this time
About all I use online is a web browser. For this, I of course use Mozilla Firefox, but disable cookies (except for sites that I know really need them, like online banking) and disable certain javascript features (opening windows, removing location bar, etc.).
I also use adblock to disable tracking sites. You know, hitbox.com and the like which use included URLs to track you by your IP address.
It's simple. Don't ask stupid questions on a forum populated by a good chunk of people who consider BOHF to be non-fiction (and a training manual, to boot).
UTF-8: There and Back Again
Lie. Lie about everything. Writing an email to your friend? Lie about it. Lie about everything that happened to you. Lie about who you are. IT DOESN'T MATTER. Signing up for some new service? Lie. Lie about your name, age, race, sex, address, credit card, whatever. Actually need to recieve the package? Send it to your neighbor and pick it up at the FedEx office with a fake ID that goes with your fake personality. Sometimes if you lie enough to a girl, you even get to sleep with her. Then, if you get herpes you can just lie to everyone else and say you don't have it! IT'S THE SAME THING IF YOU USE WINDOWS AND GET A VIRUS!! HOORAH! The lies will set you free.
I just simply do not enter valid information. If they wanted valid information, there are enough ways of getting it. The more information a site asks for, the more I make sure that the responses I give are false. If a site only wants say, my date of birth, I might give my real date. If it wants my postal address, telephone number, yada yada without just cause...I will give them wrong info. Its my way of discouraging the use of such techniques. Maybe if enough people do it, then the next time they upgrade their site they will ask only for information that they absolutely need to have instead of every little detail.
Find a job you like and you will never work a day in your life.
The only way would be to browse the internet from a completely anonymous place like a public library.
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
John Smith
1234 Anystreet
Anytown, CA
90210
(123)456-7890
DOB: 1/1/1900
email: aolsux@aol.com
Mothers maiden name: mommy
Easy to remember on any site I visit.
the moral of the story, NEVER give out true information to ANY online site.
You make exceptions on an as-needed basis.
(eg. bank, 1 or 2 trustworthy sites to shop from.)
"The price good men pay for indifference to public affairs is to be ruled by evil men." ~Plato (427-347 BC)
Easy, I just use someone elses!
Boffoonery - downloadable Comedy Benefit for Bletchley Park
I once received an abusive e-mail from some guy who was receiving loads of spam from a source using a rotation of from addresses. My address happened to appear on the mail he received and it he snapped, firing back at me. His mail address was from his family business, looked up the whois information which was correctly filled in. Phone number, address etc, simple google of the domain name showed me forums in which members of the family had posted in, different topics, cars, real-estate. From there I could build quite a profile of this person, his family, where they lived, google earth supplied satellite images of their house. I knew what kind of cars they owned, how much their house cost and when they bought it (purchasing records of individual houses was available online as part of the council areas statistics).
I sent him a mail explaining that it wasn't me sending the spam, and he wrote back apologising, then I explained to him all the information that I'd found including the google earth picture and he couldn't believe what I'd come up with by just roaming around the net.
Task Mangler
Firstly, tor with Privoxy and a Firefox plugin that makes it easy to switch between it and a direct connection. Others may use FreeNet, but I personally don't bother.
For IRC, connect using SSL (If you trust the network admins. Even if you don't, still better than nothing) and perhaps through Tor as well. For email, anything PGP-ish.
Also, for protecting my files, I use TrueCrypt.
This reminds me of a joke that takes place in a courtroom:
Prosecutor: Did you see this woman in New York?
Defendant: I refuse to answer that question!
Prosecutor: Did you see this woman in Chicago?
Defendant: I refuse to answer that question!
Prosecutor: Did you see this woman in Atlanta?
Defendant: What!? Atlanta?? I never saw her in Atlanta!
Moral of the story: if you don't pay attention to your email security except when you really need to, then when you do pay attention, someone else would also know to pay attention!
If someone wants to read my aunt's cookie recipes, that is not fine by me. Eat my {/dev/random}-XOR'd dust.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
...Just don't put shit on the Internet you want to keep secret. You never enter it in, it never gets out. AE
Some cross platform tools I use both under Linux and Windows:
But most importantly: /dev/brain
If you care about your privacy, don't give away your data to everyone!
Secondly use encrypted filesystems for data you want to keep private. I can recomend encfs for Linux http://arg0.net/wiki/encfs... it's easy to use and can be installed with yum in Fedora. It uses file-level encryption which makes possible incremental backups which retain the encryption.
If you want protection from being forced by a court to give up your key, take a look at http://www.truecrypt.org/ . This is a filesystem that lets you keep multiple levels of data encrypted with different keys, and if you give up one key noone can know that there's more data hidden with another key.
For web browsing use Tor, http://tor.eff.or/. Tor is still under development and may not be secure against a focused attack on you specifically, but at least your ISP won't be able to easily spy on you and your IPSs logs (which as we know are being mass-analyzed by the NSA) won't show anything about your activity. Also tor is
Plus, here's a good trick for ensuring that your web browser cache, history, etc., can't be easily searched by someone who gets access to your computer... put them on an encrypted filesystem, as follows. Make a script that mounts an encrypted filesystem (asking for the passphrase), sets your HOME env var to the newly mounted fs, then starts Firefox (which now places its cache there because that's HOME), and unmounts the encrypted fs after Firefox exits. You should do this even if your entire home dir is also on an encrypted fs, because your normal home dir is likely to stay mounted for longer periods of time, so this way you separate the risk levels. And it's easy. An additional little-known trick for this: set the LOGNAME env var to something other than your username to let you run a second copy of Firefox on the same X display (so you can have an "insecure" and a "secure" one running at the same time).
Of course use GnuPG for secure email. The Thunderbird Enigmail extension makes it painless.
You should also give money to the EFF and run a Tor server if you can, to help maintain our ability to have some privacy.
Finally, if you are a hardcore libertarian and/or think we should have a truly free Internet, experiment with FreeNet http://freenetproject.org/ and consider donating to its development. This project ran into some dead ends with scalability but the developers have taken a fresh approach and the new 0.7 dev version looks like it might be the start of something that could get big. They have a full-time programmer working on it paid by donations (and he's so dedicated to the ideal that his salary is the bare minimum he needs to live), so consider donating. (Btw., I'm not a libertarian in the political sense, but I think we need a strong counter-balance to the marching forces of fascism, so I donate to the Freenet project.)
or join the underground network named AnoNet, stops snoops on both the inside and the outside. its a self contained internet on top of the internet running over multiple vpn's, it might even have holes to the outside via a tor or proxy servers, i use it all the time, not only from an anonymous point of view but also the networking experiments, great community, great spirit.
free the nerd inside you!