How To Protect Your Privacy Online (theverge.com)

Though the U.S. Congress voted to roll back privacy rules, broadband customers can still opt-out of targeted advertising from Comcast, Charter, AT&T, and T-Mobile. But an anonymous reader explains why that's not enough: "It's not clear that opting out will prevent ISPs from putting your data to use," reports The Verge, adding "you're opting out of seeing ads, but not out of providing data." Neema Singh Guliani, legislative counsel for the American Civil Liberties Union, tells NPR that consumers can also "call their providers and opt out of having their information shared." But he also suggests a grass roots effort, calling this "an opportunity to pressure companies to implement good practices and for consumers to say 'I think that you should require opt-in consent and if you're not, why not?'"

To try to stop the creation of that data, Brian Krebs has also posted a guide for choosing a VPN provider, and shared a useful link to a chart comparing VPN providers that was recommended by the EFF. This may help avoid some of the problems reported with VPN services, and Krebs also recommends Tor as a free (albeit possibly slower) option, while sharing an informational link describing Tor's own limitations.
I'm curious what steps Slashdot's readers are taking (if any) to protect their own privacy online?

Comments

VPNs aren't all that great

[Geoffrey.landis]

Motherboard actually had an interesting article pointing out that VPNs actually aren't all that great for routine browsing: https://motherboard.vice.com/e...

Re:VPNs aren't all that great

[Anonymous Coward]

To summarize the article linked by the parent:

"Wahh, encryption slows down my 100GB connection and evil Republicans broke the Internet. I shouldn't have to use encryption because it's inconvenient and makes it harder for me to watch Netflix."

To which I can only reply with "grow up".

Re:VPNs aren't all that great

[Kernel Kurtz]

I have my VPN on most all the time with no issues at all. My regular PC only tests around 30 Mb/s on my 150 Mb/s connection, but that is shared with several other computers anyway. They also may or may not use VPNs and I can still saturate my connection if they are all busy. Just can't do it on one machine.

Ironically I mostly turn off the VPN for online banking, since banks and CC companies often flag connections from random geographic locations as suspicious.

Re: VPNs aren't all that great

[Anonymous Coward]

Had this problem with a bank. Their site stated that using a VPN was insecure. I sent them a capture of the statement by George Brandis where he says people should use a VPN. The bank took the notice down and unblocked the VPN IPs.

Re:VPNs aren't all that great

[Marxist Hacker 42]

If they grew up, they'd have to recognize that browsing history by default is public information. And that in fact, NOTHING ON THE INTERNET IS ANONYMOUS!

Re: VPNs aren't all that great

[Anonymous Coward]

they "could" be just as bad as what you are trying to solve. its centralized as well and ussually smaller entity thus posibly easier to sway. there fine for extra security(if you trust the provider) and a adblocker.

Re:VPNs aren't all that great

[tatman]

Motherboard actually had an interesting article pointing out that VPNs actually aren't all that great for routine browsing: https://motherboard.vice.com/e...

All its doing is moving your identifable traffic from the IPS to the VPN provider. The VPN provider can still sell your browsing habits.

Re:VPNs aren't all that great

[Lord Flipper]

Motherboard actually had an interesting article pointing out that VPNs actually aren't all that great for routine browsing

Motherboard.. LOL

They say they got 5% of their normal speed w/PIA... Gee, using an NYC server, how could that happen? /s

I get 85-95% of my cable speed with PIA, and that's while using a crowded Silicon Valley server... Drops to 75% when I use Southampton (UK) for BBC-related. London server would be considerably worse. I think I see a pattern here...

Again... Motherboard? Please.

Re:VPNs aren't all that great

[bmk67]

I get 25 down / 36 up. That's fine for browsing AFAIC.

Re:VPNs aren't all that great

[Hoban Washburne]

Just another PIA user that almost saturates my 75/75 FIOS connection, I would estimate about 60/60 bandwidth from PIA. Apparently that motherboard needs a firmware update BAD!!

Re:VPNs aren't all that great

[slashrio]

If you grew up you'd have understood that some people don't like it and that it shouldn't be a 'take it or leave it' proposal.

Re:VPNs aren't all that great

[Marxist Hacker 42]

It isn't a proposal. It's a fact. You can't have a generally available cyberspace without all the information on it being public.

It doesn't matter what people "like" or "dislike". Real growing up is learning that emotions are irrelevant criteria.

Re:VPNs aren't all that great

[slashrio]

I can, on an air gapped computer, encrypt a message sufficiently strongly to not be decrypted by brute force during the coming 100 years, send that over to my friend, who decrypts it on his air gapped computer. After reading, both computers are utterly destroyed.
This message will never (in the coming 100 years at least) become public.
Hence your statement ("...all the information on it being public.") is false.
QED

"Don't be online"

[Anonymous Coward]

The only real way...

Re:"Don't be online"

[Rick Schumann]

This AC is being an AC, but he/she/it isn't completely wrong either. The Internet is becoming increasingly unusable. No matter what precautions you're taking, you're putting yourself at an unknown level of risk just by using it at all. Sadly I don't expect this situation to improve, I expect it to get worse. Even the most egalitarian and benign governments are monitoring the Internet to one extent or another, and personally I don't trust any corporation in any country to obey privacy laws if they think they can get away with it, and if they think there's money to be made from collecting and using your personally identifiable data.

Re:"Don't be online"

[DogDude]

The Internet is completely usable. It was never designed to be anonymous or private. You may not think that it's usable for what you want to use it for, that doesn't mean it's unusable.

Re:"Don't be online"

[Kjella]

This AC is being an AC, but he/she/it isn't completely wrong either. The Internet is becoming increasingly unusable. No matter what precautions you're taking, you're putting yourself at an unknown level of risk just by using it at all.

Except that it's a really big boat and a lot more prominent people than you do stupider shit without being snuffed out by black ops teams. And if it's Titanic heading for the iceberg, well then Hitler 2 will have dirt on the 99% of the population that don't care enough that Facebook and Google and everyone else is profiling them. Sure, you can opt out of the Internet. But when the information everyone else leaves is used to turn the country into a new totalitarian state you can't opt out of that.

What lots of people do will in practice make decisions for you too. Not just votes in an election, though obviously the majority rules there too. People vote with their wallets and when they don't vote for the same as me those services shut down because of lack of business. If people don't care about pollution or littering or killing off the local environment or the planet then the result will be the same for everyone. If the public doesn't care about privacy, well the expectation of privacy will cease to exist.

Re:"Don't be online"

[Marxist Hacker 42]

How cute, you believe that voting is still based on the majority.

Re: "Don't be online"

[Anonymous Coward]

thats true but i wonder if people know why.

Re:"Don't be online"

[Rick Schumann]

If the public doesn't care about privacy, well the expectation of privacy will cease to exist.

"For YOU", as the meme goes.
Privacy is not decided by the majority, it is decided by the individual. If you fall prey to the troll/meme that privacy is dead and stop protecting your own, then you only have yourself to blame -- and you're helping perpetuate the troll/meme that social media, government agencies, and law enforcement would have you fall for. Keep protecting your private life from the prying eyes of whoever would pry into it. Even if you're not 100% successful, you'll still have some parts of your life that are yours and yours alone, as it should be. Otherwise, do you not see that you'd be living like a convict in a prison, or an animal on a farm, or like a perpetual child, watched and monitored 24/7/365? That's where things are headed if people don't come back around to the basic truth that 'privacy' is a normal, natural, healthy human need, not a sickness or a sign of criminal activity.

Re:"Don't be online"

[Anonymous Coward]

How sad, you've already given in to despair and are possibly just sitting back and letting the bloody bastards do whatever they want. Why haven't you just killed yourself yet?

Re:"Don't be online"

[Marxist Hacker 42]

Because there are better ways to resist than voting or blowing stuff up.

Only one 'grass root' effort will work

[Anonymous Coward]

Ad hoc mesh to bypass the ISP. As long as we remain beholden to them there is no hope for any kind of privacy amounting to anything more than a pipe dream. There is no law that can stop them from doing what they are doing. They are simply untrustworthy. It's that simple.

Re:Only one 'grass root' effort will work

[Anonymous Coward]

agree. every building, every utility pole should have a 'solar shingle' powering a mesh node.

it is possible and inexpensive already, but big tech companies, ISPs and government are desperate to suppress and conspiring to stop it.

why we need open hardware as much as open software, even more.

Not all that worried about it, but

[Anonymous Coward]

Mostly I don't care but I do have an EC2 instance set up with stunnel and apache acting as a pure TLS protected forward proxy. That allows for local tokens and cookies to persist if i so choose and still mask everything from my ISP. I don't really use it that often though. If I see a reason to I can, that's enough for me.

Tor...

[Anonymous Coward]

Now gets you put on a list just for using it. I suspect VPNs are going to do the same.

Re:Tor...

[RotateLeftByte]

And all the businesses that use VPN's for their remote access will be on that list as well.
Those businesses will not be best pleased with undue attention from the TLA's.

Re:Tor...

[Sloppy]

So, get on a "list," then. After all, it's a list of what?

And if you don't get on that list, then they'll just put you on the other list.

You can get even, though, by putting them on your list!

You can be online, just don't use:

[jimboinsk]

Any browser that doesn't completely anonymize and secure browsing, social media, hosted email, any other applications that don't encrypt their communications, any network connection that isn't anonymous, any device you don't plan to ever re-use and that wasn't purchased with a traceable payment. I think that covers it, if you accept a couple dozen more assumptions that aren't listed in addition to the above.

Re:You can be online, just don't use:

[gnick]

For a few limited cases, those precautions aren't over-reaching. For the rest of us, though, it's a matter of "good enough." Personally I use a VPN, but in many other situations I could be described as lax on avoiding tracking. There's some common sense, and then there's trading convenience for privacy.

Re:You can be online, just don't use:

[rtb61]

That is not enough. You must also do exactly what they do in spy vs spy, scenarios, misinformation should be core for protecting your privacy as well as everyone else's. Two tools https://adnauseam.io/ to create a plethora of fake clicks to poison data bases and http://www.cs.nyu.edu/trackmen... to copy search data miners.

Never ever forget email, now it is wide open in the US and unfortunately you should never ever use ISP provided email any more, no mention of that and for good reason because yes the new law is akin to allowing the postal service to open and scam all snail mail, including packages.

So in every facet of human digital communications, digital misinformation apps are required to run in the background flooding bullshit invasions of privacy with bullshit digital data, orders of magnitude greater than what is actually produce by real people. No channel should be left untouched free of data miner toxins, poison their invasion of privacy, in the interim, whilst of course kicking the fuckers out of government who sold you privacy.

Better option, overwhelm them

[Anonymous Coward]

Set up a browser to randomly hit websites, click on ads, and otherwise feed useless data into the maelstrom.

Heck, let's pay Indian Call Centers to contact Comcast with tech support problems.

It'll be worth it in the end.

There's nothing you can do with your own ISP

[DogDude]

There's literally nothing you can do if you're paying an ISP for connectivity.

The only way you can begin to have any kind of privacy is to connect through somebody else's connection (public or otherwise). From there, you can encrypt and all that good stuff. But with this new law passed, there's quite literally nothing you can hide from your own ISP.

Re:There's nothing you can do with your own ISP

[Anonymous Coward]

But with this new law passed, there's quite literally nothing you can hide from your own ISP.

In other words, it's the same as it's been since the beginning of the Internet.

Re:There's nothing you can do with your own ISP

[Anonymous Coward]

There's literally nothing you can do if you're paying an ISP for connectivity.

You can tunnel past them so they have no visibility.

Re:There's nothing you can do with your own ISP

[terbeaux]

You must be using the new definition of "literally" because otherwise what you wrote doesn't make any sense. There are literally (old definition) hundreds of ways to encrypt communications and obscure the fact that they are even happening at all.

Re:There's nothing you can do with your own ISP

[DogDude]

here are literally (old definition) hundreds of ways to encrypt communications and obscure the fact that they are even happening at all.

You can encrypt to your heart's content, but your ISP has access to every single packet that flows over your connection, including where and when, even if they don't have immediate access to its contents. So, I'll stand by my use of the word "literally", thanks!

Re:There's nothing you can do with your own ISP

[Anonymous Coward]

"but your ISP has access to every single packet that flows over your connection"

Are you dopey? If I tunnel all DNS and HTTP[S] traffic to [an]other host[s] first, the provider has no idea what web sites I'm visiting.

Re:There's nothing you can do with your own ISP

[sacrilicious]

You can encrypt to your heart's content, but your ISP has access to every single packet that flows over your connection, including where and when, even if they don't have immediate access to its contents. So, I'll stand by my use of the word "literally", thanks!

The person replying to you, telling you that encryption nullifies the point you're attempting to make, is completely right. Not just vaguely right, completely right. You therefor are either trolling, extremely misinformed, or somehow connected to a govt push to dissuade people from encrypting.

Re:There's nothing you can do with your own ISP

[terbeaux]

Not sure if trolling or genuinely naive...
Looking through DogDude's post history, I'm going to go with the latter.

Re: There's nothing you can do with your own ISP

[Anonymous Coward]

Jesus you paranoid fucks, your ISP isn't sniffing your fucking traffic. The way they get your "browsing history" is simple... it's called DNS lookup records.
Change to a 3rd party provider or roll your own. There's no need for a full blown VPN service.

Re:There's nothing you can do with your own ISP

[swillden]

here are literally (old definition) hundreds of ways to encrypt communications and obscure the fact that they are even happening at all. You can encrypt to your heart's content, but your ISP has access to every single packet that flows over your connection, including where and when, even if they don't have immediate access to its contents. So, I'll stand by my use of the word "literally", thanks!

Fine. So my ISP will know that I send a large stream of encrypted packets to one host that is a known Virtual Public Network service provider. My ISP can know nothing about the sites those packets are ultimately destined for, nor anything about their content. My ISP can see how much data I'm sending and receiving, but that's all... and if I really want to it's even possible to hide that by sending/receiving lots of meaningless packets. With a little work (I suspect I'd have to write some custom software, since I don't think what I'm thinking of exists) I could arrange to send and receive a continuous stream of data at a constant rate, 24x7, only a fraction of which is actual traffic. There's probably not enough information implicit in traffic volumes to make that worth the effort, but it could be done.

Re:There's nothing you can do with your own ISP

[Anonymous Coward]

It still knows where the tunnel goes and may use legal pressure to get either end of the tunnel to compromise it.

But when even the endpoints of the tunnel do not know where the data is coming from then it is private. That means compromised WLAN access points at both ends of the tunnel.

It means both servers' and clients' connection to outside world is over unknown and unsuspecting 3rd party access points. Directional high gain DIY antennas with provisions to quickly dismantle them to obfuscate the direction they were pointing at.

It means the door to the room where the antenna is must be rigged to displace the antenna to hide its original direction.

Re: There's nothing you can do with your own ISP

[Anonymous Coward]

or both and just cache for local dns server.

Re: There's nothing you can do with your own ISP

[Anonymous Coward]

ISPs around the world do *deep* packet inspection -- and before the widespread adoption of encryption for protocols like HTTPS and SFTP etc., deep packet inspection would give an ISP everything. And what, besides laws, limitations and expense of hardware, and potential bad publicity, would make an ISP forfeit access to a phenomenally rich source of information about individual users?! It's a goldmine!

Even after the widespread use of HTTPS, there are still many uses of HTTP (even for resources within HTML documents retrieved via HTTPS) and other unencrypted protocols, which leak a lot of information.

https://security.stackexchange.com/questions/155057/my-isp-uses-deep-packet-inspection-what-can-they-observe/155060

Re:There's nothing you can do with your own ISP

[Trax3001BBS]

There's literally nothing you can do if you're paying an ISP for connectivity.

The only way you can begin to have any kind of privacy is to connect through somebody else's connection (public or otherwise). From there, you can encrypt and all that good stuff. But with this new law passed, there's quite literally nothing you can hide from your own ISP.

Actually you can, I found this out by accident meaning it wasn't meant for this reason. I used OpenDNS and by doing do became a ghost to my ISP.

Re:There's nothing you can do with your own ISP

[slashrio]

You're thinking too local. The ISP maybe can not see what sites you visit, but your VPN-SP can. And the NSA totally can see both, and connect the dots.

Re:There's nothing you can do with your own ISP

[Anonymous Coward]

If I tunnel...

To where now? A Provider of Services on the Internet?

Re:There's nothing you can do with your own ISP

[swillden]

You're thinking too local. The ISP maybe can not see what sites you visit, but your VPN-SP can. And the NSA totally can see both, and connect the dots.

Well, the whole point of having a VPN SP is to find one that will not keep track of information about you, sell it to other parties, etc.

As for the NSA, bah. What interest would they have in me? We're talking about ISPs selling user data to parties unknown for profit, which can lead to all sorts of actual badness that impacts normal people. While I think it's very important to reign in the NSA as a matter of principle, in practice whether or not they have our data sitting in a secure database somewhere has little to no impact on ordinary Americans. That Comcast may sell my browsing habits to all sorts of organizations who may misuse the data in ways that harm us, or leak it since they're likely much worse at security than the NSA, that's important in practice, not just in principle.

Re:There's nothing you can do with your own ISP

[slashrio]

As for the NSA, bah. What interest would they have in me?

As of now, nothing, but with the right monkey at the helm that might change in a moment.
I remember (the story) that one year before WW II broke out, the Dutch government suddenly became interested in registering religion of its people.
A few years later it was found out that this whole anti-jew thing of the Nazi's was planned, and the (people in) Dutch government agreed with it on beforehand.
At that time people probably also will have said the same as you, only to find out a few years later they were wrong.

Re:There's nothing you can do with your own ISP

[swillden]

Sigh. I wasn't trotting out the old "I have nothing to hide" argument. Yes, that argument is flawed, and those flaws are the reason why it's important in principle to reign in the NSA.

My point was that that isn't the proximate risk. There's a much bigger and entirely non-theoretical risk in allowing ISPs to monitor connections that doesn't depend on the government deciding that middle-aged white guys need to be watched, and that's the risk that this thread is about, because that's the change that's in progress, in case you hadn't noticed. Whether or not ISPs can legally track you and sell the data has exactly zero impact on what the NSA may or may not do.

Re:There's nothing you can do with your own ISP

[slashrio]

Ok, ic u. But now your ISP buys that VPN-SP and suddenly the dots are connected, and sold.
Or both sell their data to a commercial third party which connects the dots...

Re:There's nothing you can do with your own ISP

[swillden]

Ok, ic u. But now your ISP buys that VPN-SP and suddenly the dots are connected, and sold. Or both sell their data to a commercial third party which connects the dots...

Again, selecting the VPN provider is an important part of the process. You need to find one that cares about security and privacy. Luckily, unlike with ISPs you can shop VPN providers worldwide and aren't limited to the small set that happen to operate in your neighborhood.

TrackMeNo

[sphealey]

I thought TrackMeNot was a good approach to poisoning big data analysis, but it does not appear to be receiving any updates and Google apparently figured out a way to detect it.

sPh

Another suggestion.

[Anonymous Coward]

Just don't look at porn.

Re:Another suggestion.

[Anonymous Coward]

Do what instead? Most of us are not photogenic.

Re: Another suggestion.

[Anonymous Coward]

Go to the gym. Fix what you can.

Do things where you can meet real people. Meetups. Volunteer.

Re: Another suggestion.

[Anonymous Coward]

There's the perpetual victim who thinks everything is everyone else's fault, and then there's there's a similar perpetual 'winner' who thinks he can do anything and just can't fathom anyone else not being able to. The latter is just as delusional as the former as he'll attribute failure in others to insufficient effort or laziness. Life is not that simple.

Barring some unlikely fortune in your life (eg fame/fortune), once you hit ~35-40, the pickings get real slim. You're either married at that point, involuntarily celibate, or single by choice. Life runs on these mating cycles. Humans are no exception.

Perhaps for some it's a cost/benefit ratio, and what passes for relationships today just doesn't cut it anymore.

Re: Another suggestion.

[Anonymous Coward]

Here we go. Because someone somewhere was screwed over by mother nature that means that other people can't go to the gym or otherwise take stepsâ to improve their slovenly selves. And can't stop watching porn because that would take inhuman strength.

Re: Another suggestion.

[Anonymous Coward]

I didn't say that no one could. I did imply that hitting the gym is not a fix-all. As far as your other suggestions go (volunteering), few people actually have the time for that outside of work.

You could just let people work out their life balances on their own instead of imposing your self righteousness.

Re: Another suggestion.

[Anonymous Coward]

Because of work? They don't have time because they are binge watching Netflix.

Re: Another suggestion.

[Anonymous Coward]

I guess for you it's worth spending all that time and money for female validation. For them it isn't. That time and money is better put to other uses, whether it's netflix or whatever it is they do. Perhaps they're not needy enough to bother with the real deal, or they know they can't get anyone they would want so they do the rational thing and settle.

Like I said, not everyone is like you.

Re:Another suggestion.

[GuB-42]

And what if you watch porn?
Many porn sites actually care about your privacy.
And if you are watching porn... well, it just means you are normal... 75% of American people do at least monthly.

Re:Another suggestion.

[slashrio]

Why, since when is it a crime?

I know this is off topic but...

[epyT-R]

I hate the color orange.

DNSCrypt?

[Anonymous Coward]

Not sure how much it prevents the ISP from tracking me but I've long NOT used my ISP's DNS servers and only used OpenDNS. Just this week I configured my router (asus, using merlin's stuff) to use DNSCrypt to OpenDNS which should SSL the requests - making my lookups private. That plus https practically everywhere else should secure my CONTENT but my IP connections could still be logged and sold - though I'm not sure how valuable that is for advertisers.

Re:DNSCrypt?

[Anonymous Coward]

Could you link to a tutorial ?? Could help provide how to's ??
Thank you in advance for your generosity

Re:DNSCrypt?

[Anonymous Coward]

It's not "easy" - you'll need to add a USB stick to your router and then enable JFFS and then install entware (google for tutorials for that) and then follow the instructions here:

https://github.com/RMerl/asuswrt-merlin/wiki/Secure-DNS-queries-using-DNSCrypt

But that didn't quite work for me and someone had conveniently made a shell script which does all the work and configuration to do it here: (You'll still need to enable JFFS and install entware first though!)

https://www.snbforums.com/threads/release-dnscrypt-installer-for-asuswrt.36071/

Calm your tits.

[Anonymous Coward]

Before everyone loses their shit over these "rollbacks to privacy", let's remember that these rules that are being rolled back didn't exist until fucking October. So it's not like we're losing some sort of magic protection that we've always had. If you weren't losing your shit over your ISP tracking you six months ago, there's no reason to lose your shit over it today.

Re: Calm your tits.

[Anonymous Coward]

> didn't exist until October

Actually they STILL don't exist. These weren't going to go live for MONTHS.

Re:Calm your tits.

[WaffleMonster]

Before everyone loses their shit over these "rollbacks to privacy", let's
remember that these rules that are being rolled back didn't exist until fucking October. So it's not like we're losing some sort of magic protection that we've
always had. If you weren't losing your shit over your ISP tracking you six months ago, there's no reason to lose your shit over it today.

CISA seems like a good enough new reason to "lose your shit" over ISP tracking.

The fact protections are being retracted due to lobbying by telecom industry might cause people concerned with such an egregious example of regulatory capture to "lose their shit".

Since previously I "lost my shit" on the topic of ISP cyber stalking when it was made public what AT&T and crew were doing to their customers I am entitled to "lose my shit" regardless.

Re:Calm your tits.

[fafalone]

Before, ISPs had the expectation that if they did something too outrageous, like say sell your browsing history, they could expect problems from the FCC, and that kept it from happening for a while until they started pushing things too far and the regulations got passed. Now they have the green light to go ahead and explicitly do that without fear of consequences. It's a pretty big difference.

and some sites won't load [Re:VPNs aren't all that

[Geoffrey.landis]

To summarize the article linked by the parent: "Wahh, encryption slows down my 100GB connection and evil Republicans broke the Internet. I shouldn't have to use encryption because it's inconvenient and makes it harder for me to watch Netflix."

More or less accurate. You missed "and some sites won't load at all."

Neema Singh Gulani is female.

[Anonymous Coward]

"But he also suggests a grass roots effort..."

Neema Singh Gulani is female.

Re: Neema Singh Gulani is female.

[Anonymous Coward]

Tits or it didn't happen.

Hosts files help vs. ad & dns requestlog track

[Anonymous Coward]

See subject: Stop ads & dns tracking via APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/

Ads/script & malware rob speed/security/privacy

Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!

Avoids DNSChangers in routers/IP settings & dns redirects (99.999% of ISP DNS != patched vs. it) + lightens DNS load & resolves faster from local system RAM!

* Via what u NATIVELY have in the IP stack in FASTER kernelmode!

APK

P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/

Isn't it funny

[Anonymous Coward]

How all these so-called "Privacy" sites are polluted with Third-Party trackers, Third-Partly loaded malicious Javascript, and that they prevent you from seeing anything at all if you block all the nastiness.

This should give a clue that *NONE* of these sites are actually interested in safety, privacy, or security.

The have alternate goals which is to have you choose to be pawned by them rather than your ISP.

Privacy, maybe

[Anonymous Coward]

TOR through a VPN

Would this work ?

[Anonymous Coward]

Change you user agent to something like this:

"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8 Copyright2017@"

Then tell your ISP that your queries are copyrighted and they have to negotiate with you (and perhaps pay you) to use them.

Re: Would this work ?

[Anonymous Coward]

This.

Wow. That is perfect. Like the claim that holding a web page in cache is a copy.

secure on line

[Anonymous Coward]

TAILS, baby, TAILS..

Use LOTS AND LOTS Of Microsoft Cloud Products =)

[dryriver]

Windows 10, Edge, Office 365 and the Microsoft Cloud are BRILLIANT for your privacy. Nobody will ever know who you are or what you do online. Nobody. =)

Charter 60 days

[Anonymous Coward]

Entered my email address at the Charter opt-out site. Got this response:

"Targeted Digital Marketing Ads
Your Privacy Preference has been submitted successfully.

Please note that it may take up to 60 days for this request to take effect."

Relevant links

[MrL0G1C]

More VPN providers than you can throw a bucket of sticks at:
https://thatoneprivacysite.net...

TorrentFreak 2017 survey:
https://torrentfreak.com/vpn-s...

I've moved from PrivateVPN (seem incompetent) to CyberGhost premium (slow, dodgy untrustworthy they essentially log), NordVPN next.

Valve/Steam f**ks over VPN users, downloads go at 40KB/s whilst using VPN, they seem to think it's up to them whether I use a VPN, like fuck you valve, that isn't your choice to make.

Re: Relevant links

[Anonymous Coward]

Slowing traffic based on endpoint addresses is a network neutrality issue. Not a privacy issue.

Re:Relevant links

[Anonymous Coward]

VPN sounds alright when you're on your PC/laptop at home, but what about mobile? Either way, if advertising leaks your data to ad networks that sell it to 3rd parties it matters little if you use VPN or not. A simple free flashlight app on your phone may easily leak your IDFA, location, email, MSISDN, even contacts.

Nowadays an ad blocker is more important than AV or a firewall.

Re:Relevant links

[Anonymous Coward]

Not sure what would cause that for you but I recently watched a download over my VPN that used nearly the entirety of my pipe (100Mb/s). Downloaded the latest Dark Souls 3 DLC in about 6 minutes.

Re:Relevant links

[Anonymous Coward]

pirate your games. problem solved

Re:Relevant links

[Kernel Kurtz]

VPN sounds alright when you're on your PC/laptop at home, but what about mobile?

I'm using Private Internet Access and they have clients for Android and IOS. They also let you connect 5 clients simultaneously.

Re:Relevant links

[Dupedupeshakur]

More VPN providers than you can throw a bucket of sticks at: https://thatoneprivacysite.net...

TorrentFreak 2017 survey: https://torrentfreak.com/vpn-s...

I've moved from PrivateVPN (seem incompetent) to CyberGhost premium (slow, dodgy untrustworthy they essentially log), NordVPN next.

Valve/Steam f**ks over VPN users, downloads go at 40KB/s whilst using VPN, they seem to think it's up to them whether I use a VPN, like fuck you valve, that isn't your choice to make.

Over my 50mb/s connections I've seen 9-30 mb/s with steam using expressvpn

Re:Relevant links

[MrL0G1C]

Do you use a VPN server whic has an IP that has the same geolocation as your country? (when getting good steam speeds)

It might just be that cyberghost are idiots and use the same IP address ranges for the free service as they do for the paid service which is why I see so much evidence of abuse reports for the IP addresses I'm using.

Re:Relevant links

[Dupedupeshakur]

yes - it allows for the selection of server by geolocation or performance (there is a utility to ping/bandwidth test all of their servers and compare). I'm near Seattle, picked the Seattle server, and have steam d/l server set to Seattle. Sometimes I trace back to New Jersey for some reason, but I'm getting ~150 ping times worst case for gaming.

Cylance blog on privacy protection

[Anonymous Coward]

Cylance recently posted a blog on steps to take to protect online privacy: https://www.cylance.com/en_us/blog/ten-practical-steps-to-protect-your-online-privacy.html

VPNs can be good if you DIY

[Anonymous Coward]

If you roll your own VPN via a VPS not only can you optimize the settings for maximum throughput, you're the only one consuming all the bandwidth so you aren't competing with other users. And, in many cases VPS cost less than a VPN service! With the latest OpenVPN 2.4 add this to the server.conf for increased throughput, you'll be pretty surprised. My tests show on a 30 Mbit connection, with compression I get 28 mbit, and without I get 16 mbit:

proto udp
fast-io
sndbuf 0
rcvbuf 0
push "sndbuf 393216"
push "rcvbuf 393216"
txqueuelen 1000
fragment 1450
mssfix 1450
comp-lzo no
compress lz4-v2
push "compress lz4-v2"

Granted, the U.S. government can subpoena your VPS connection, but I'm not trying to hide from them. I just want to protect myself from; hackers, ISPs, and DDOSers. I'm in a hotel right now, I wouldn't want to send unencrypted packets over this awful bullshit, especially when doing something like banking for example. The problem with any big VPN provider is that they've made themselves a target for government requests, hackers, and with this new law they could snoop and make money off your data legally now too.

The drawback to doing it yourself is that you have to spend significant amounts of time researching best security practices. Like checking and verifying integrity of downloads with gpg, keeping an eye on your server logs, running tripwire, tiger, rkhunter, chkrootkit, logwatch, OSSEC, psad, haveged, ed25519 ssh, fail2ban, not permitting remote root login, no ssh passwords - passworded preshared certs only, rsa 4096 and not the default for dh for pfs over the control channel for vpn (btw the next bump up in 5-10 years is 15k rsa keys most people don't know that), setting up a nice big swap file, turning on mlock in openvpn to get rid of old nonces, adjusting swappiness and cache pressure, automatic security updates, keeping your kernel up to date, rotating out old keys once in a while, blocking syn, xmas, and null attacks, build your keys with a local trusted machine not the vps, use tls-crypt not tls-auth, ncp-disable renegotiation cause that shit is retarded, use a non-root user/group for the vpn daemon, use persist-key persist-tun, run lmd maldet in a cron job, lock cron to root via cron.allow, check your tripwire tripwire tripwire often!, use mobaxterm (turn off the built-in x11 server though) because putty is antiquated crap, set tls-version-min to 1.2, using nonstandard alternative ports under 1024 for ssh and vpn (1024 because if someone breaks into your server as a guest and manages to crash your daemon remotely they can bring a daemon up on the same port, but if it is 1024 they cannot because 1024 is restricted to root), properly jailing services and setting file system permissions, using a proper hash and cipher, restricting the cipher list, making your iptables persistent, setting up your firewall correctly, geoblocking entire nuisance countries, having emails sent to a 3rd party email system in case someone modifies your logs, being prepared to burn your node and set it up again on a new IP if it does get compromised, and probably more I forgot to mention.

If you aren't doing all of that and even more, you aren't doing it right and probably shouldn't bother then.

But, at least, when you do it yourself you know due diligence has been done, with a public VPN you're putting yourself in their hands and they might have just flicked a switch and gone golfing. -- Most likely scenario.

Also, don't use Tor it just mixes your connection in with actual criminals and now you look like one too. If you do use it, absolutely DO NOT set up a super node! You'll get paid a few visits by law enforcement for certain.

Though, the average consumer can't pull off what I'm doing, unfortunately. Nor do they probably care enough. I've thought about setting up a service for people who want fast VPNs, since I know what I'm doing. The only reason I haven't done it is that a) I can't guarantee I wouldn't hand shit over to law enforcement, b) I don't want the terries to have a nice secure place to do their business. So, to do all of you a favor I haven't started a service like that. You're welcome.

Sorry for the rant.

Re:VPNs can be good if you DIY

[Anonymous Coward]

Sorry, this was the right settings for fragment and mssfix, the above was from an older server.conf I had. Leave the rest the same, and also add in tun-mtu:

tun-mtu 1500
fragment 1400
mssfix

Re: VPNs can be good if you DIY

[Anonymous Coward]

Stop being so autistic with regards to openvpn and anything with the word open in it and accept that ipsex does not degrade performance. Run IPSec between your home router and the router on the internet, run gre or l2tp inside that IPSec and route everything thought the gre/l2tp interface. Only the IPSec endpoint should be routed over your internet connection. I get less than 6% bandwidth loss over 250ms delay

Re: VPNs can be good if you DIY

[Anonymous Coward]

Alternatively, pay a VPN provider $5 a month, download their client or OpenVPN and it Just Works.

Unless you use Android OpenVPN client which crashes and forgets the VPN password every couple of hours.

Re: VPNs can be good if you DIY

[Anonymous Coward]

Hey thanks for the ad hominem attack for no reason because I don't use the same software as you. IKE in ipsec has been breached and all traffic can be unencrypted going through ipsec, I can't cite the link explaining this because it is illegal. I've never trusted ipsec, it is too new so many ports need to be open. Something is bound to go wrong. It is also a lot more work to set up, which consumes brain cycles needed for protecting the node instead. Also, the fact you suggest l2tp suggests you don't care about security, it's been well known that l2tp is easy to breach for a very long time now.

Re: VPNs can be good if you DIY

[Anonymous Coward]

Also, worth pointing out that ipsec use of various fixed ports make it easy to identify and easy to block. With openvpn you have 1 port you can alter. Let's say you have to be in a country you don't trust that takes a heavy hand approach to blocking vpn/ipsec/etc, you can set openvpn to tcp and 443 for example. This is a standard SSL port for https and they won't block it, otherwise they'd break the web. If they ever did start blocking it you could use port 80.

Re: VPNs can be good if you DIY

[Anonymous Coward]

When the publc vpn gets broken into they just bury it because it could bury them as a business. When it happens to your own DIY vpn, you just burn that bridge and start over. And, hopefully learn from it and close that hole in the future node. Also, with your own, you control the level of security and performance. The point of the ops post and link is that most vpn (especially cheap ones as you describe that "just work") have piss poor performance. They also happen to be using pretty weak hash, ciphers, protocols and keys in some cases as well. These guys aren't reacting to changes in the security landscape and updating their techniques. In some cases they can't because it would make life for their end users more difficult. Hence why "it just works." If it just works, then it probably wasn't done right.

Re: VPNs can be good if you DIY

[Anonymous Coward]

L2tp runs inside ipsex. There is nothing insecure in this use. It is just equivalent to gre in that particular use case. Ipsex which runs on the outside provides the security

Re:VPNs can be good if you DIY

[Anonymous Coward]

Thanks for rant and good insights into network security for home users. I do have a follow up question: your solution for setting up own VPN using a VPS like OpenVPN seems to take care of security issue involving public wifi networks. I get it. But how do you protect your online privacy when the traffic between your home network and the web is monitored by your ISP ?

Re:VPNs can be good if you DIY

[Lord Flipper]

Sorry for the rant.

Hey! No apology necessary. Thanks for all the info!

Re:VPNs can be good if you DIY

[Anonymous Coward]

Your ISP just sees encrypted traffic. And, you route your DNS through the VPN, so they can't see DNS queries either. Don't use theirs.

Re:VPNs can be good if you DIY

[Anonymous Coward]

The VPS on the other hand sees what's going out. All it does is ensure that your local ISP and public wifi are secure, which is where the most harm is. At some point you have to let someone see what you're doing. Unless you're going to go all rogue with tor or something, but there are consequences there and it can be unmasked anyways. The VPN suggestion is more of a security measure than an anonymity measure.

I'm more curious

[Anonymous Coward]

Of what measures are site owners and ad-platforms doing to ensure the integrity of their content and that their ads are not replaced midway...

Opt out?

[Anonymous Coward]

I have been opting out for years with 'AdBlock Plus' and Privoxy. I rarely see any ads and never see popup ads.

encrypted VPN

[Anonymous Coward]

ISP only sees encrypted packets going to an anon VPN - that will make your PC be ''located'' anyplace you like... USA, Europe, etc...

Why Washington D.C. thinks professional hackers would openly walk naked through the internets ... broadcasting their location as 'russian' is silly.

more like known state actors, within the USA can easily make their activities appear to come from Canada, or Russia, or where ever they like.

Change all your DNS settings to make sure they route through private DNS and not your ISPs DNS - and all of that goes through your VPN
with now DNS leaks.

I live in MN

[Anonymous Coward]

Living in MN seems to help.

Live in the wilderness

[Tony Isaac]

If you want privacy, you'll have to go find a wilderness hideout somewhere, not connected to the grid. It's an arms race. The more we try to protect our privacy, the more ways corporations will find ways to circumvent our protections.

While you're out there, you might run into some people who think Y2K destroyed civilization...

Re:Live in the wilderness

[Anonymous Coward]

you might run into some people who think Y2K destroyed civilization...

Didn't it though? Didn't it?

Remember how free the internet was back then? The pigs couldn't even find an IRC channel back then... now they've compromised all of TOR, SSL, and so much more...

How To Screw with ISP Ads

[n329619]

Step 1: Create a Macro / Script to auto click every 3 seconds
Step 2: Search for cat videos and set to auto click them
Step 3: AFK for 1/2 the day
Step 4: All your ads are now nothing but cats regardless of whatever you searched (search pizza -> get cat ads)

First step: don't use google and Facebook?

[mveloso]

If you want to protect your privacy, the first step is to not use use google services or Facebook. That includes google DNS!

U can avoid DNS tracking (avoid DNS via hosts)

[Anonymous Coward]

See subject: By using hosts hardcoded favorites (where u spend most time online) my program generates (shown here https://yro.slashdot.org/comments.pl?sid=10440093&cid=54160873/ IF you're ISP is tracking DNS requests via logs of them (most do).

APK

P.S.=> You also avoid DNS security & inefficiency issues galore (100's I listed here by category & FAR from a complete list) https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ as well as malware + ads tracking/infecting/slowing you etc. (hosts do tons more vs. ANY other single solution & for less, natively, using what you already have in faster kernelmode in the IP stack itself)... apk

Re:Hosts files help vs. ad & dns requestlog tr

[yuvcifjt]

Hosts file (and your solution) won't protect you against your own ISP storing your browsing history and possibly selling it to a third-party.

It can not be protected

[Anonymous Coward]

Otherwise prevention of crime would be impossible. That is not to say it is not almost impossible already. But I mean the perception and the belief it is possible are important in itself.

Law enforcement works like a religion: the more people believe in it, the better it works in preventing crimes.

Privacy and _belief_ in law enforcement are at somewhat mutually exclusive. When another gets stronger, the other gets weaker.

Re:It can not be protected

[slashrio]

If the government had been interested in preventing crime, 9/11 and Boston wouldn't have happened.

Everyone should start relaying Tor traffic

[Anonymous Coward]

Last week, I started up 3 relays (different cloud providers) and one exit nide (at home) and I urge everyone to do the same.
Let's help everyone that want to protect their privacy

top trending

[saidsanka]

alltoptrending.com

Hosts can vs. DNS requestlogs

[Anonymous Coward]

See subject: When you do hardcodes in hosts for resolving your favorite sites (my program does) avoiding ISP dns lookup for them.

* A reverse-proxy hosts don't avoid though...

APK

P.S.=> Nice part is, those same hardcoded favorites are FASTER than calling out to a remote DNS (especially, but even vs. a local one YOU setup too as there's no network traversal @ all, but done in your local system RAM) & avoid TONS of DNS security issues enumerated here (100's in various categories of many kinds in security/efficiency https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ )... apk

pfSense - Device specific routing

[ninthbit]

My pfSense firewall has an alias (group of IPs) that it routes via VPN. Originally it was only my OrangePi torrent server, but with the new legislation, I've moved my phone and PC into the group. My 6 Rokus go out unprotected, but I have to imagine for security Netflix and Hulu use HTTPs for all their control signaling, so short of throttling by the ISP, I don't see them being rewarded for trying to read that data.

Re:pfSense - Device specific routing

[Kevin by the Beach]

The insidious part is that Netflix and Hulu will be able to horse trade with your ISP.
    -- ninthbit Just channel surfed from channel 5 to channel 10 (hey .. watchers.. .0003 cents for this information)
        -- Public Utility ... we noticed that his smart power meter registered a 25 watt increase in power usage (maybe a refrigerator light came on)
        -- ISP ... we see an increase in encrypted traffic from (IPv6 address for home access point) to known VPN
        -- Telco Carrier .. Ring Indicator transmitted via last known cell tower for ....

If you take enough disparate data sources, but have a unique key that ties it together... You are owned

Flood the ISPs with bad data

[Anonymous Coward]

Maybe we should just develop a browser extension that will visit random sites in the background. If enough privacy minded people installed it then it seems as though the data would be bad enough to not even be worth buying. Is there a downside that i'm not seeing?

-Anonymous Coward :P

libreswan

[h4ck7h3p14n37]

If you're interested in rolling your own VPN I can recommend libreswan.

I got both L2TP over IPSec and IPSec with XAUTH and PSK configurations working with the native VPN client (racoon?) in macOS Sierra (and presumably iOS). I'm still trying to get Android 6.0 working with XAUTH and PSK (establishes tunnel, but doesn't route properly), but L2TP works ok. My *NIX hosts just use libreswan as the client.

Amazon offers 1,000 free hours to new AWS users and the pricing on their EC2 instances is very good, so it shouldn't cost too much to route your connections through them.

Computer Fingerprints

[Kevin by the Beach]

Don't forget that your computer has fingerprints.

1. Operating System
2. Browser
3. Browser Plugins
(versions and possibly installation dates of above)
4. Cookies
5. Tracking Files (1x1 invisible image isn't just to fill in a small hole in the picture)

Mix all of that together, and add in the IP addresses these fingerprints are observed at and you are very well known. It doesn't matter if you use a VPN or not... The one time that you forget to login to the VPN, you've just left a calling card. On top of that, most people don't realize that their ISP has been quietly rolling out IPv6. Nothing to see here, except a permanent IP address for your home, and every IPv6 compatible device that happens to use the internet via your connection. No worries about running out of address space here. Each mac address that's "found" connecting to your network is remembered.

So, go ahead. Waste time/money on a VPN.. it's only a minor speed bump to the big-data-monster

Breezy and Warm by the Beach

Re: Computer Fingerprints

[Anonymous Coward]

I only use my computer for porn, for any communication I use my radio... like a real man would.

Algo or Streisand

[Anonymous Coward]

Considering the clown show that most VPN services are (IPSEC key is 12345678 is a good one...), before the obvious problem of them tapping into your exit clearnet datastream for analytics, it isn't sane to trust them. Roll your own VPN exit.

Use Algo (IPSEC) or Streisand (almost every modern VPN method) as prerolled VPN exits you can deploy on any public cloud. True you have to trust the cloud provider to not tap you like an ISP, but the odds are better there since the incentives are aligned differently.

Or use Signal, use TOR.

Exactly -- we instead need to make the most of it!

[Paul Fernhout]

As I wrote here: http://web.archive.org/web/201...
"Now, there are many people out there (including computer scientists) who may raise legitimate concerns about privacy or other important issues in regards to any system that can support the intelligence community (as well as civilian needs). As I see it, there is a race going on. The race is between two trends. On the one hand, the internet can be used to profile and round up dissenters to the scarcity-based economic status quo (thus legitimate worries about privacy and something like TIA). On the other hand, the internet can be used to change the status quo in various ways (better designs, better science, stronger social networks advocating for some healthy mix of a basic income, a gift economy, democratic resource-based planning, improved local subsistence, etc., all supported by better structured arguments like with the Genoa II approach) to the point where there is abundance for all and rounding up dissenters to mainstream economics is a non-issue because material abundance is everywhere. So, as Bucky Fuller said, whether is will be Utopia or Oblivion will be a touch-and-go relay race to the very end. While I can't guarantee success at the second option of using the internet for abundance for all, I can guarantee that if we do nothing, the first option of using the internet to round up dissenters (or really, anybody who is different, like was done using IBM [tabulators] in WWII Germany) will probably prevail. So, I feel the global public really needs access to these sorts of sensemaking tools in an open source way, and the way to use them is not so much to "fight back" as to "transform and/or transcend the system". As Bucky Fuller said, you never change thing by fighting the old paradigm directly; you change things by inventing a new way that makes the old paradigm obsolete."

Re:Use LOTS AND LOTS Of Microsoft Cloud Products =

[slashrio]

This interference isn't arbitrary, its comprehensive.

Confusion here...

[martinfb]

It seems to me that there is a bit of confusion regarding the issue of ISPs and privacy.

According to a US Rep, Costello, (R) PA, it is the FTC, and NOT the FCC, that is to regulate privacy concerns here.
Here's a link to his explanation: https://iqconnect.lmhostediq.c...

Seems to me that we, the People, have allowed too much confusion and B/S from our political parties, such that it allows them to get away with too much.

I say we start purging the system of band-aid laws and get serious about being FOR the People!

What say you?!