The Ultimate Privacy Guide

The Ultimate Privacy Guide
Ladies and Gentlemen, here it is. We’ve put a lot of effort into this, and it’s very long. We
tried to think of every angle in terms of privacy, and the effort was worth it. Almost 13,000
words about how to protect your privacy online. There’s no need to read it at once, just check
the index below and click on the parts that interest you.

Index
Introduction
So how secure is encryption?




SSL encryption weakness
The importance of end-to-end encryption
Metadata

Use Foss Software
Pay for stuff anonymously



Bitcoin
Other anonymous payment methods

Anonymise your internet use




VPN
Tor
Other ways to stay anonymous online

Secure your browsing






Cached DNS entries
Flash Cookies
Great browser extensions you should use
Block reported attack sites and web forgeries in Firefox
Mobile browser security

Use a search engine that doesn’t track you



Search Engines that don’t track you
Clear your Google History

Secure your email





Encrypt your emails using GNU Privacy Guard
PGP on mobile devices
Encrypted Webmail
Encrypt your Gmail



Other email precautions

Secure your conversations




VoIP with end-to-end encryption
Secure your text messages, Instant Messaging and Chat
Ditch the cell phone!

Secure your Cloud storage




Manually encrypt your files before uploading them to the cloud
Use an automatically encrypted cloud service
Use BitTorrent Sync Cloudless syncing

Encrypt your local files, folders and drive


Use TrueCrypt
o Mobile options

Use antivirus, anti-malware and firewall software





Antivirus
o Free vs. paid-for antivirus software
o Some good anti-virus software
Anti-malware
Firewalls
o Some good firewall programs

Miscellaneous security hints and tips and tricks











Use Linux rather than a commercial OS
Use a Virtual Machine
Give Whonix a try
Password protect your BIOS
Secure your Flash Player settings
Change DNS servers
Use secure passwords
o Low tech solutions
o High tech solutions
Social networking
Avoid all US based services

Conclusion



Is privacy worth it?
Final words

Introduction

The recent (and ongoing) NSA spying revelations have highlighted just how much we have
sacrificed to the gods of technology and convenience something we used to take for granted,
and once considered a basic human right – our privacy.
It is just not just the NSA – governments the world over have been racing to introduce
legislation that allows to them to monitor and store every email, phone call and Instant
Message sent or received, every web page visited, and every VoIP conversation made by
every single one their citizens. Parallels with George Orwell’s dystopian world ruled by an
all-seeing Big Brother have been bandied about a great by the press of late, but are
unfortunately depressingly accurate.
All is not lost however, as encryption provides a highly effective way to protect your internet
behavior, communications, and data. The main problem with using encryption is that its use
flags you up to organizations such as the NSA for closer scrutiny.
Details of the NSA’s data collection rules can be found here, but what it boils down to is that
data from US citizens is examined, and then discarded if found to be uninteresting to the
NSA. Encrypted data on the other hand is stored indefinitely, until such time as the NSA can
decrypt it. All data relating to non-US citizens can be kept indefinitely, but sheer practicality
suggests that encrypted data gets special attention.
If a lot more people start to use encryption, then encrypted data will stand out less, and
surveillance organizations’ job of invading everyone’s privacy will be made much lot harder.
Remember – anonymity is not a crime!

So how secure is encryption?

The short answer is… very! While it is true that if anyone is
capable of breaking modern encryption cyphers then it is the NSA, to do so would be a
sizable challenge. With regard to a brute force attack, please consider the following:





A 128-bit key cypher would require 3.4 x1038 operations to reliably break
In 2011 the fastest supercomputer in the word (the Fujitsu K computer located in
Kobe, Japan) was capable of an Rmax peak speed of 10.51 petaflops. Based on this
figure, it would take Fujitsu K 1.02 x 1018 (around 1 billion) years to crack a 128-bit
AES key by force
In 2013 the most powerful supercomputer in the world is the NUDT Tianhe-2 in
Guangzhou, China. Almost 3 times as fast as the Fujitsu K at 33.86 petaflops, it would
‘only’ take it around a third of a billion years to crack a 128-bot AES key. That’s still
a long time, and is the figure for breaking just one key





A 256-bit key would require 2128 times more computational power to break than a
128-bit one
The US government itself uses NIST certified 256-bit AES encryption for sensitive
data (and 128-bit for ‘routine’ encryption needs)
Although it is impossible to predict how things will develop in future, 128-bit
encryption is generally considered uncrackable for another hundred years or so

There are of course ways to break cyphers that do not involve ‘brute force’ attacks, such as
exploiting weakness in a cypher. Despite a great deal of effort however, no weakness has yet
been found in cyphers such as AES. Other techniques, such as infecting target computers with
viruses, and mechanically recovering keys from discarded hard drives, are also possible. It is
good to remember that no matter how good an encryption key is, if it protected by a password
then it is only as strong as that password… (so if possible, don’t do it!)
In general, it is fairly safe to say that decent modern encryption methods are highly effective.
If an adversary as powerful as the NSA really wants your data, they MAY be able to get it,
but doing so would require considerable expenditure of resources and effort. For most of us
who are not being targeted as potential terrorists or mafia crime lords, even 128-bit encryption
is more than enough to heavily obfuscate our data and make even the NSAs job much harder.
As Matthew Green, a cryptographer and research professor at the Johns Hopkins University
Information Security Institute in Baltimore put it,
‘We have no idea what the NSA can do. However it’s reasonable to assume that even if they
can break modern encryption schemes—a pretty big assumption—it’s going to be pretty
expensive for them to do so. That rules out massive non-targeted eavesdropping on encrypted
connections.’
Also do not forget that the NSA is not the only organization wishing to spy on us, and these
other adversaries (such as the army of hackers and criminals in existence) will almost
certainly not have the available power, reach and resources that the NSA has.
Government agencies are much more likely to exert legal pressure on companies (through
court orders, subpoenas etc.) to hand over encryption keys (and issue gagging orders to stop
them alerting customers). As Edward Snowden himself put it,
‘Encryption works. Properly implemented strong crypto systems are one of the few things that
you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can
frequently find ways around it.’
Update 9 September 2013: In the last couple of days the massive scale of the NSA’s efforts
to break or otherwise compromise encryption standards has become publicly available thanks
to Mr Snowden. While details are somewhat thin on the ground, it seems that thanks to NSA
strong-arming, no commercial proprietary encryption standards or software can be trusted not
to have back doors built in, or to be otherwise deliberately weakened. In addition to this, any
encryption based non-ephemeral key exchange (i.e. any encryption not protected by Perfect
Forward Secrecy – see below) is not just potentially vulnerable, but is now actively suspect.
This includes almost all TLS and SSH (i.e. https://) connections.

However, it also appears that the NSA and GHCQ face sizeable challenges when faced with
strong encryption (such as AES). This point was borne out by the fact that the UK’s Scotland
Yard was unable to access most of the files on David Miranda’s hard drive, because ‘True
Crypt renders the material extremely difficult to access.”
The observations above therefore still stand. As Bruce Schneier, encryption specialist, fellow
at Harvard’s Berkman Center for Internet and Society and privacy advocate says,
‘Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing
can compromise it. That’s how you can remain secure even in the face of the NSA.’
We discuss the NSA decryption program revelations in more detail here and here.

SSL encryption weakness
Because of the way that SSL usually works, the number of keys needed to decrypt all data
from a service is very small. This means, for example, that all encrypted Hotmail emails could
be decrypted if just one key was obtained. There is a much more secure solution available
called Perfect Forward Secrecy , but so far only Google has implemented it (we have a fairly
lengthy article on this subject available here). As noted in the update above, HTTPS can now
be considered broken in all cases where PFS has not been implemented (i.e. almost
everywhere at present, but hopeful this will change in light Snowden’s revelations).

The importance of end-to-end encryption
End-to-end encryption means that data (including communications data) is encrypted at your
end, and decrypted only at the intended recipient’s end. The important point is that no ‘middle
man’ who can access your unencrypted data is involved. Because a middle man can always be
regarded as suspect, end-to-end-encryption should be seen as an absolute must if you care
about security.
A case in point is Microsoft, who while they encrypt all emails and files held in SkyDrive,
also hold the encryption keys, and used these to unlock the emails and files of its 250 million
worldwide users for inspection by the NSA.
Basically, services that encrypt your data on their servers, rather than you encrypting your
own data on your own machine, should be strongly avoided.

Metadata
An important limitation to encryption is that it does not necessarily protect users from the
collection of metadata. Even if the contents of emails or voice conversations cannot be readily
listened in on, knowing when, where, from whom, to whom, and how regularly such
communication is made can tell an adversary a great deal, and is a powerful tool in the wrong
hands (i.e. just about anybody).
For example, even if using a securely encrypted end-to-end voice service such as Silent
Circle, your ISP (and anyone else watching) will still be able to tell who you are making the
call to, whether you are calling from your usual location, how often you call, how long you

usually chat, and much more. With such information it would be trivially easy to discover that
you were having an affair (for example)…
However, the reason we said ‘not necessarily protect users’ is that technologies such as VPN
and Tor do make the collection of metadata very difficult. In the example above, if you
always connected to a VPN service when using the internet, all a watcher could tell is that you
are connected to a VPN server, not that that you are using Silent Circle, let alone where and
when you are using it…
Although the NSA does target individual communications, its primary concern is the
collection of metadata.

Use FOSS software
The terrifying scale of the NSA’s attack on public cryptography and its deliberate weakening
of common international encryption standards has demonstrated that no proprietary software
can be trusted; even software specifically designed with security in mind. It is now a proven
fact that the NSA has co-opted or coerced hundreds of technology companies into building
backdoors into their programs, or otherwise weakening security in order to allow the NSA
access. US and UK companies are particularly suspect, although the reports make it clear that
company’s across the world have acceded to NSA demands.
The problem with proprietary software is not just that as sole developers and owners,
companies can be fairly easily approached and convinced to play ball with the NSA, but that
their source code is kept secret, making it easy to add to or modify in dodgy ways without
anyone noticing.
The best answer to this problem is to use free open source software (FOSS). Often jointly
developed by disparate and otherwise unconnected individuals, the source code is available to
everyone to examine and peer-review, thereby minimizing the chances that it has been
tampered with. Ideally this code should also be compatible other implementations, in order to
minimize the possibility of a back-door being built in.
It is of course possible that NSA agents have infiltrated open source development groups and
introduced malicious code without anyone’s knowledge, and the sheer amount of code that
many projects involve means that it is often almost impossible to fully peer-review all of it.
Still, despite these potential pitfalls, FOSS remains the most reliable and least likely to be
tampered with software available, and if you truly care about privacy you should try to use it
exclusively (up to and including using FOSS Operating Systems such as Linux).

Steps you can take to improve your privacy
So with the proviso that nothing is perfectly foolproof, and if ‘they’ really want to get you
then it is probably worth assuming they can, there are steps you can take to greatly improve
your privacy.

Pay for stuff anonymously

Probably the first step to improving your privacy is to pay for things anonymously. Of course,
when it comes to physical goods that need to be delivered to an actual real-life address, this
isn’t going to happen (except for good bought locally with cash). Online services are a
different kettle of fish however, and it is increasing common to find ones that accept payment
through Bitcoin and the like. A few, such as VPN service Mullvad, will even take cash sent
anonymously in the post.

Bitcoin

Bitcoin is a decentralized and open source virtual currency
that operates using peer-to peer technology (much as BitTorrent and Skype do). The concept
is particular revolutionary and exciting because it does not require a middleman (for example
a state controlled bank) to work.
The recent financial crisis in Cyprus, where many investors lost large sums of money and
which eroded investors’ confidence in traditional banks the world over, has helped to greatly
boost Bitcoin’s popularity. This created something of an investment bubble which has that has
yet to settle down (1 Bitcoin (BTC or XBT) now trades for around $136 -a very sizeable
jump from the $74 we quoted in 2 moths ago in July).
Whether or not Bitcoins represent a good investment opportunity remains hotly debated, but
is not the subject of this article.
As a ‘crypto-currency’, Bitcoins can be bought, traded, invested and used to buy goods and
services; just like any other form of money. Although nowhere near as widely accepted as
‘regular’ currency, this is changing fast, especially in the realm of on-line services such as
VPN (in fact we have an article on 5 Best VPNs that accept Bitcoin!) that aim to improve
users’ anonymity,
One important thing to understand is that Bitcoin is not inherently anonymous. The exciting
thing is that with care it can be made so.
Buying Bitcoins Anonymously
Most Bitcoin traders are located in the US and have US based bank accounts, which can make
buying Bitcoins outside the States both a little involved, and location dependent. However,
the following methods are common ways to obtain Bitcoins anonymously.
For maximum anonymity:






Use anonymous, disposable email addresses (such as those supplied by Tor Mail)
Create a new Bitcoin address (wallet) for each purchase – if you use the same address
then one mistake will allow all transactions to be traced back to you
Never reveal personal information such as your real name, address, or phone number
Use a mixer service – even if you use one of the more anonymous methods of
purchasing Bitcoins outlined below, it can’t hurt to launder it further (although this
will cost a bit).

1. Buy Bitcoins non-anonymously then ‘clean’ them with a mixer service
Neither the cheapest nor the most anonymous method, this is the most convenient, and does
nevertheless ensure a high degree of anonymity. Using this method you do not actually buy
your Bitcoins anonymously; you simply purchase them from an automated Bitcoin exchange
such as Mt. Gox (the easiest way to buy Bitcoins), and then ‘launder’ them using a ‘mixer’
service such as Blockchain.info Shared Send.
A mixer service basically anonymises your Bitcoins by swapping them with multiple other
users, making it very difficult (but not impossible for a determined investigator) to follow the
chain back to you. Services such as this are, of course, not free (Blockchain.info for example
charges a 0.5% fee).
Most automatic exchanges (such as Mt. Gox) require you to prove your real world identity, in
which case it is easy to determine that you have purchased Bitcoins (but not what happens to
them after that if you mix them).
2. Use pre-paid credit cards
This method is somewhat location dependent, but in most areas it is possible to buy pre-paid
‘gift’ credit cards over-the-counter, which can then be used to buy Bitcoins anonymously if
the transaction is performed through disposable email addresses etc. Alternatively, you can
just use the card to buy an on-line service directly!
3. Buy locally with cash
The website LocalBitcoins.com lets you find Bitcoin sellers who live near you. Once you
have found a seller you are happy with, it is up to you to contact them and to arrange a
meeting.
Prices are generally higher than those on Mt Gox, and you should pay attention to the
feedback to ensure the seller is highly scored (it works much like the feedback system on
eBay).
4. Buy from an individual seller online
This can be done on LocalBitcoins.com, or in the #bitcoin-otc chatroom on Freenode (otc =
over-the -counter).
#bitcoin-otc uses a quite involved feedback system, which it is well worth spending the time
to understand, and you will need to hash out the payment method with the seller. A list of IRC
client can be found here.

Other anonymous payment methods
In addition to pre-paid credit cards and good old cash, there are plenty of alternative cryptocurrencies out there. Bitcoin is by far the most popular and stable crypto-currency, but others
are available. A full list of these is available here, and some of the pros and cons of the ‘top 5’
are outlined in this article.

Anonymise your internet use
One of the most effective ways to anonymise your activity and protect your data is to use
either a VPN service or Tor religiously. Both these methods hide your true IP address and
encrypt your internet connection. We go into a great deal more depth on how Tor works, and
the differences between the two in this article, but to summarize…

VPN
A Virtual Private Network helps to ensure privacy by creating an encrypted tunnel between
your computer and a remote VPN server.
Example setup without VPN: Home PC -> ISP -> Internet
Example setup with VPN: Home PC => ISP => VPN server -> Internet
Once data has entered the VPN tunnel (=…=) it is hidden from view by encryption protocols
so that no-one, not even your Internet Service Provider (ISP), can ‘see’ it. The only
computers that can see the data are the ones at each end of the VPN tunnel (bearing in mind
the comments we made regarding encryption at the beginning of this guide).
Because the VPN server can see all data going into and out-of the tunnel (and trace it back to
you), it is vital to choose a VPN provider you trust, and who keeps no logs of your internet
activity. If you are concerned about privacy then you should never pick a VPN provider who
keeps logs, and the comments below assume a no logs service. Providers we particularly like
that are good for keeping no logs are Mullvad, AirVPN and Private Internet Access (although
the fact that PIA is US based has introduced considerable uncertainty to this
recommendation).
Pros:





Cons:

As long as your VPN provider is trustworthy and keeps no logs, VPN is a very secure
and anonymous means of surfing the internet
It is also good for securing connections at public WiFi hotspots, and for evading
firewalls used to censor the internet
It is a lot faster than Tor (although there will be a small hit to your internet speeds)
It is very good for P2P filesharing, and ‘spoofing’ IPs in order to stream geo-restricted
media content (e.g. Hulu).





It relies on trusting your VPN provider, and is therefore not as secure as Tor
It costs money (typically between $7 to $10 per month, with substantial discounts for
bulk purchases). Many VPN providers accept Bitcoin payments.
It is obvious to observers that you are using VPN.

Tor (originally The Onion Router)
Tor is an anonymity network that supplies free software which lets you use the internet
anonymously. We go into more detail on how it works here, but basically you connect though
a number of randomly selected nodes (at least three), with the data being re-encrypted each
time. This means that although each node knows who is connecting to it, and who it connects
to, no node knows the whole route (circuit).

The final link in the chain, the one that connects you to the internet, is known as an exit node,
and is one of the biggest weaknesses of the system. Nodes are run by volunteers, and those
running exit nodes are vulnerable to prosecution over the behaviour of other Tor users who
have used the system for illegal purposes (including piracy and much worse), as the IP of the
offenders can been traced to the exit node’s IP address.
This has led to a fairly small number of public exit nodes being available, and has meant that
restrictive governments such as China, who monitor these nodes, have been able to block
access to many of them. There are still plenty of nodes around however, but it does mean that
Tor users in some countries my need to reconnect to a number of different nodes before they
find one that has not been blocked.
The other big problem with Tor is that it is very slow, as users’ data is routed through a
number of servers randomly located anywhere in the world before connecting to the internet.
Pros:







Very secure and anonymous (in fact it is generally considered the most secure and
anonymous way to access the internet available, and is therefore suitable for political
dissidents and the like)
It is also good for securing connections at public WiFi hotspots and for evading
firewalls used to censor the internet (although see comments blocked exit nodes
above)
Free

Cons:






Slow (often very)
Restrictive countries can make finding unblocked public exit nodes a pain
Not good for P2P downloading and streaming from spoofed IPs – not only are
network speeds too slow for this to be practical, but doing so slows down the system
even more for other users. In addition to this, volunteers running the exit nodes may be
held accountable for your copyright violations, so it is considered very rude
It is obvious to observers that you are using Tor, and some websites (such as PayPal)
may refuse to play ball

For most people who are not doing anything too illegal, and who are not in life threatening
situations, VPN is much faster and more flexible than Tor, while providing plenty of privacy
and security. Those in life threatening situations are better off using Tor (although if it is their
own government that is the danger, simply using a no logs VPN service located outside their
country’s jurisdiction and political influence may work just as well).
For the really paranoid out there, it is possible to route a VPN connection through Tor, or an
OpenVPN connection through an SSL or SSH tunnel (in order to hide its use). More details
about these methods can be found here.
A final note regarding Tor is that it makes the anarchic and entirely unregulated Silk Road
marketplace possible, as the online black market exists entirely within the Tor network (and
therefore has no need for vulnerable exit nodes). Although supposedly set up on libertarian
ideals, much of the actively on the Silk Road is highly illegal, so if you are curious then you
will have to investigate further on your own.

Other ways to stay anonymous online
VPN and Tor are the most popular ways to maintain anonymity and evade censorship online,
but there are other options. Proxy servers in particular are quite popular, although in our
opinion they are inferior to VPN.
Other services which may be of interest include JonDonym, Lahana, I2P and Psiphon.
Interestingly, many such services can be combined with Tor and/or VPN for greater security.

Secure your browsing

It’s not just the NSA who are out to get you: advertisers are
too! And they are willing to use some very sneaky tactics to follow you round the web and
piece together a profile of you in order to sell you stuff (or sell this information to others who
want to sell you stuff)…
Most people who care are aware of HTTP cookies, how to clear them, and that most browsers
now have a Private Browsing mode that not only prevents the browser from saving your
internet history, but also blocks these cookies. It is therefore a good idea to always surf using
Private Browsing, but this alone is not enough to stop you being tracked across the internet, as
your browser leaves many other traces as it goes…

Cached DNS entries
In order to speed up internet access, your browser caches the IP address it receives from your
default DNS server (see the section on changing your DNS server later).

In Windows you can see what DNS information
has been cached by typing ‘ipconfig /displaydns’ at the command prompt (cmd.exe)


To clear the DNS cache in Windows,open the command prompt window and type:
ipconfig /flushdns [enter]



To clear the cache in OSX 10.4 and under, open Terminal and type: lookupd flushcache



To clear the cache in OSX 10.5 and above, open Terminal and type: dscacheutil flushcache

Flash Cookies
A particularly insidious development is the widespread use of the use of Flash cookies (also
known as Local Shared Objects or LSOs), which are not blocked when you disable cookies in
your browser, and which can track you in a similar manner to regular cookies. These can be
located and manually deleted from the following directories:



Windows: C:\Users\[username]\AppData\Local\Macromedia\Flash Player\
#SharedObjects
OSX: [User directory] /Library/Preferences/Macromedia/Flash Player/#SharedObjects
and
[User directory] /Library/Preferences/Macromedia/Flash
Player/macromedia.com/support/flashplayer/sys/

A better tactic however, is to use the CCleaner utility (available for Windows and OSX),
which not only cleans out pesky Flash cookies, but also a host other rubbish that is slowing
your computer down and leaving traces of your internet activity behind. Another option is to
install the Better Privacy browser extension for Firefox, which is designed to remove or
manage these LSOs.

Great browser extensions you should use
Pioneered by Firefox, all modern browsers now support a host of extensions, many of which
aim to improve your privacy while surfing the internet. Here is a list of our favorites that we
don’t think anyone should be without:






AdBlock Plus (Firefox, Chrome, Opera, Android) – this fantastic and must-have
extension blocks all manner of adverts, even Facebook ads and those embedded within
YouTube videos (here in the UK it even blocks 4oD ads!). In addition to this, it warns
you when visiting known malware hosting websites, and disables third party tracking
cookies and scripts. Unlike NoScript (see below), AdBlock Plus is very easy to use
while still remaining powerful. By default, AdBlock Plus allows ‘some not intrusive
advertising’. This can be turned off (Add-ons -> Extensions -> AdBock Plus -> Filter
preferences), or you can install AdBlock Edge for Firefox, a fork of AdBlock Plus that
removes this ‘feature’
Disconnect (Firefox, Chrome, Safari, IE) – replacing popular Ghostery as our favorite
anti-tracking and anti-cookie extension thanks to its up-to-date database of tracking
cookies, page load optimization, secure WiFi encryption and analytics tools,
Disconnect blocks third party tracking cookies and gives you control of over all a
website’s elements. It also prevents social networks such as Google, Facebook and
Twitter from following you so they can collect data as you surf elsewhere on the
internet
HTTPS Everywhere (Firefox and Chrome) – another essential tool, HTTPS
Everywhere was developed by the Electronic Frontier Foundation, and tries to ensure
that you always connect to a website using a secure HTTPS connection, if one is
available. This is fantastic, but do remember the reservations about how SSL is




commonly implemented that we made earlier, and that it has almost certainly been
cracked by the NSA
Better Privacy (Firefox) – as noted in the section on Flash cookies above, this
extension blocks this new kind of cookie
Honorable mention: NoScript (Firefox) – this is an extremely powerful tool that gives
you unparalleled control over what scripts are run on your browser. However, many
websites will not play game with NoScript, and it requires a fair bit of technical
knowledge to configure and tweak it to work the way you want it to. It is easy to add
exceptions to a whitelist, but even this requires some understanding of the risks that
might be involved. Not for the casual user then, but for web savvy power-users,
NoScript is difficult to beat. ScriptSafe for Chrome performs a similar job. Reader’s
tip: ‘I would recommend adding that even if you don’t want to bother messing with
white lists in Noscript, you should still install the extension and choose to allow all
scripts globally. This still provides some needed protection without hindering your
browsing experience.’ (Thanks twlph!)

In addition to these extensions, most modern browsers (including mobile ones) include a Do
Not Track option. This instructs websites to disable tracking and cross-site tracking when you
visit them. While it is defiantly worth turning this option on, it should be remembered that
implementation is purely voluntary on behalf of website owners, and so no is guarantee of
privacy.
Note that this list is not exhaustive of all the great privacy related browser extensions out
there, and we plan to soon publish some of our favorites as a blog article. We do however feel
that it covers the most important and powerful extensions that you need to have installed.
Block ‘reported attack sites’ and ‘web forgeries’ in Firefox
These setting can be very useful for protecting you against malicious attacks, but do impact
your privacy by sharing your web traffic in order to work. If the tracking issues outweigh to
benefits for you, then you might want to disable them.

Mobile browser security
The above extension list concentrates on desktop browsers, but as we access the internet more
and more from our smart phones and tablets, it becomes just as important to protect our
browsers on these platforms as well. Unfortunately, most mobile browsers have a great deal
of catching to do in this regard, but many Firefox extensions (including the excellent AdBlock
Plus) will work on its mobile browser, and Dolphin Browser for Android has even more
extensions. Private Browsing, Do Not Track, and advanced cookie management are becoming
increasingly common on mobile browsers however, which a good thing.

Use a search engine that doesn’t track you
Most search engines, including Google (in fact particularly Google), store information about
you, including:





Users IP address
Date and time of query
Query search terms
Cookie ID – this cookie is deposited in your browser’s cookie folder, and uniquely
identifies your computer. With it, a search engine provider can trace a search request
back to your computer

This information is usually transmitted to the requested web page, and to the owners of any
third party advertising banners displayed on that page. As you surf around the internet,
advertisers build up a (potentially embarrassing or highly inaccurate) profile of you, which is
then used to target adverts tailored to your theoretical needs.
In addition to this, governments and courts around the world regularly request search data
from Google and other major search engines, which is usually duly handed over.

Google Transparency
Report on the number of User Data Requests received, and the number (at least partially)
acceded to.
There are however some search engines that do not collect user’s data. DuckDuckGo in
particular has grabbed the headlines of late, with its popularity shooting through the roof
following the NSA spying revelations (daily searches on DuckDuckGo jumped from the 2
million it had built up over the last four and a half years, to 3 million in just 8 days!).
An added benefit of using a search engine that does not track you is that it avoids the ‘filter
bubble’. Most search engines use your past search terms (and things you ‘Like’ on social
networks) to profile you, so they can return results they think will interest you. This can result
in only receiving search returns that agree with your point of view, locking you into a ‘filter
bubble’ where you do not get to see alternative viewpoints and opinions because they have
been downgraded in your search results. Not only does this deny you access to the rich texture
and multiplicity of human input, but it can also be very dangerous as it can confirm
prejudices and prevent you from seeing the ‘bigger picture’.

Search Engines that don’t track you








DuckDuckGo – the best known alternative search engine, and one we have examined
in some detail here, DuckDuckGo pledges not to track it users. Each search event is
anonymous, and while it could in theory be tracked, there is no profile attached that
can be accessed by infiltrators. DuckDuckGo says that it would comply with ordered
legal requests, but as it doesn’t track users, ‘there is nothing useful to give them’. In
use we have found DuckDuckGo to be very good, and through the use of ‘bangs’ (see
our article), it can also be made to search most other popular search engines
anonymously too
Ixquick – searches many popular search engines simultaneously and anonymously,
giving a star to results each time they are in the top ten of a search engine result.
Ixquick promises not to store or share any personal information, or use any identifying
cookies
Gibiru – provides basic Google search engine results, but separates your query from
your IP with the use of proxy servers. In addition to this, Gibiru deletes all records
within seconds of performing a search, so ‘there is no profile data to sell, package or
give away via partnership, request or subpoena’
YaCy – the above search engines rely on trusting the search engine providers to
maintain your anonymity. If this really worries you, then you might like to consider
YaCy, a decentralized, distributed search engine built using P2P technology. This is a
fantastic idea, and one that we really hope takes off, but for now it is more of an
exciting curiosity than a fully-fledged and useful Google alternative.

Clear your Google History
This is something everyone should do if they are concerned with the information Google is
keeping on them. It won’t stop someone who is deliberately spying on you and harvesting
your information (such as the NSA), but it will help stop Google profiling you. Even if you
plan on changing to one of the ‘no tracking’ services listed above, most of us have built up a
substantial Google History already, which anyone reading this article will likely want deleted.
To clear your history, simply sign into your Google account and go to
www.google.com/history, where you will see a list of searches that you have make recently.
Select which items (or use the checkbox at the top to select all items on that page) you want
removed, and hit ‘Remove Items’.

To turn Search
History off, click on the gear icon on the top right, and select ‘Settings’…

Secure your email
Most email services do provide a secure SSL encrypted connection between start point and
email servers, and email servers and end point, and Google has even led the way in fixing the
weakness in the way in which SSL is commonly implemented.
However, all this is no good if the email service is simply handing over your information to
an adversary (as Google and Microsoft have been doing with the NSA). While it seems that
smaller email providers have not (yet) been affected, it is likely that as the NSA and other
national government surveillance organizations extend their reach, this will change.
The answer to this problem lies in end-to-end email encryption, where the sender encrypts the
email, and only the intended recipient can decrypt it. The biggest problem with using an
encrypted email system is that you cannot impose it unilaterally – your contacts, both
recipients and senders, also need to play ball for the whole thing to work, and while trying
convincing your granny to use PGP encryption will likely just lead to bafflement, trying to
convince your customers might make many of them very suspicious!
It should also be noted that email encryption does not encrypt everything. The email addresses
of sender and recipient, date and time of sending, and e-mail’s subject line are not encrypted;
just the body and any attachments. As we briefly discussed earlier, metadata such as this can
still be very damaging in the wrong hands.
Another point worth bearing in mind if you are worried about NSA spying is that, probably
even more than encrypting other aspects of your internet use, encrypting your email is pretty
much asking the NSA to store your emails ready for decryption when they are able to do so.

Encrypt your emails using GNU Privacy Guard
There are plenty of end-to-end email encryption programs out there, the most famous of
which is Pretty Good Privacy (PGP, which was once open source and free, but is now the
property of Symantic). The Free Software Foundation has taken up the open source OpenPGP
banner however, and with major funding from the German government has released GNU
Privacy Guard (also known as GnuPG or just GPG).

An overview of how the OpenPGP standard works
Following the OpenPGP standard and fully compatible with PGP, GnuPG is a free and open
source alternative which is available for Windows, OSX and Linux. Although the basic
program uses a simple command line interface, more sophisticated versions are available for
Windows (Gpg4win) and Mac (GPGTools). Alternately, EnigMail adds GnuPG functionality
to the Thunderbird and SeaMonkey email clients. We have written a full guide to setting up
GnuPG in Windows using Gpg4win, available here).
PGP on mobile devices
Android users may also be pleased to know that GnuPG: Command-Line from the Guardian
Project is available in the Play Store. Although we have not tried them, mobile users wanting
a more user-friendly experience may want to give K-9 Mail (a well-regarded email client with
PGP support built-in) combined with Android Privacy Guard (Android), or iPGMail (iOS) a
try. A good guide for getting GPG working on Android is available here.

Encrypted Webmail

For a while, Hushmail was considered the go-to service for secure webmail, as it offered PGP
encryption in a web based service. However, in 2007 a backdoor was used by the owners to
capture emails of three accounts, which were then handed over to the Canadian Courts. As
Hushmail CTO Brian Smith said in refreshingly honest blog post,
‘[Hushmail] is useful for avoiding general Carnivore-type government surveillance, and
protecting your data from hackers, but definitely not suitable for protecting your data if you
are engaging in illegal activity that could result in a Canadian court order.’
It should be noted that any web-based service can in theory be compelled to modify their
system to capture users’ decryption keys (as Hushmail did), and Hushmail itself recommends
using non web-based services such as GnuPG or PGP Desktop if stronger security is needed.

Encrypt your Gmail
It is however possible to encrypt your Gmail using the free FireFox extension Encrypted
Communication (we’ve written a guide about how to use it) which provides 256-bit AES endto-end encryption. Once the extension is installed, just write your email, right-click anywhere
in the text of the message and select ‘Encrypted Communication’ to encrypt it. You will be
asked to enter a password, which the recipient will need to know (along with having the
extension running on their Firefox) to decrypt the message. Of course, you should transmit
this password to the recipient using a different communication method than email (in person
is best, but encrypted VoIP or messaging should be fine – see below)!
Note that there are other extensions available which seem to offer similar functionality and
which we often see recommended on the internet, but which should be avoided. Both
SafeMail for Chrome and Enlocked (multiplatform) send your email to their servers for
decryption, which means it at least as vulnerable as mail sent to Hushmail (i.e. they do not
offer end-to-end encryption). Furthermore, the SafeMail decryption page is not even SSL
encrypted!

Other email precautions
We will discuss encrypting files and folders elsewhere, but it is worth briefly noting here that
if it is just files you wish to protect, you can encrypt these before sending them by regular
email.
It is also possible to encrypt stored emails by encrypting the email storage folder using a
program such as TrueCrypt (discussed later). This page explains where Thunderbird stores
emails on different platforms (for example).

Secure your conversations

The first thing we have to make clear here is that regular
phone calls (landline or mobile) are never secure, and cannot be made so. It’s not the just the
NSA and GCHQ; governments everywhere (where they have not already done so) are keen on
recording all citizens’ phone calls. Unlike emails and internet use etc. that can be obfuscated
(as this article is trying to show), phone conversations are always wide open.
Even if you buy anonymous and disposable ‘burner phones’ (behavior which marks you out
as either worryingly paranoid or engaged in highly criminal activity), a lot of information can
be gathered through the collection of metadata, and it is also totally pointless unless the
people you are calling are equally paranoid.

VoIP with end-to-end encryption
If you want to keep your voice conversations completely private, then you need to use VoIP
with end-to-end encryption (except of course when talking in person).
VoIP (Voice over Internet Protocol) allows you to talk (and usually also make video calls and
Instant Message (IM)) over the internet. Allowing cheap or free calls anywhere in the world,
VoIP services have become extremely popular, with Skype becoming a household name.
Unfortunately, Skype (now owned by Microsoft) has perfectly demonstrated the problem with
most such services (which is a very similar problem to that with email) – that VoIP
connections to and from a middleman may be secure, but if the middleman just hands over
your conversations to the NSA (as happened with Skype) or some other government
origination, this security is next to meaningless.
So, as with email, what is needed is end-to-end encryption where an encrypted tunnel is
created directly between the participants in a conversation, and no-one else.
Good Skype alternatives




Jitsi (Windows, OSX, Linux, Android (experimental)) – this free and open source
software offers all the functionality of Skype, including voice calls, video
conferencing, file transfer and Chat, but can encrypt it all with ZRTP. The first time
you connect to someone it can take a minute or two to set up the encrypted connection
(designated by a padlock), but is afterwards transparent. As a straight Skype
replacement, Jitsi is difficult to beat
RedPhone (Android) – this free and open source Android only app provides end-toend encryption of voice calls. Unlike normal VoIP apps however, it lets you use your
normal phone number and the normal system dialer, so operation is almost invisible,



except that when you connect to someone else with RedPhone installed, you are given
to option to encrypt the call
Silent Circle – is a popular commercial suite of encrypted communications software
comprised of Silent Phone (iOS, Android), Silent Text, (iOS, Android), Silent Eyes
(Windows VoIP), and Silent Mail (iOS, Android, Outlook for Windows, Mac Mail).
The service costs $10 per month, but the software itself is open source and has been
audited by the American Civil Liberties Union to ensure it contains no ‘back doors’.
Reassuringly (in a way), the makers of Silent Circle recently closed their ‘Silent Mail’
service following the abrupt shutting down of Lavabit, in order to ‘prevent spying’.

Secure your text messages, Instant Messaging and Chat
Admittedly this section has a lot of cross-over with the previous one on VoIP, as many VoIP
services (such as Jitsi) also have chat/IM functionality built-in, and the issues are more or less
the same. However, as there are some great dedicated encrypted IM applications out there,
we decided they deserved a section of their own.








Pidgin + OTR (Windows) – Pidgin is a popular free and open source IM client that
lets you chat to users on AIM, Google Talk, MSN, Yahoo and many more. OTR (Offthe-road) is a plugin that combines AES encryption, perfect forward secrecy, and the
SHA-1 hash function to ensure strong encryption for IM sessions. As with GnuPG for
emails, initial setup is a bit of a pain, but once done operation is seamless (we now
have a detailed guide for this).
Addium (OSX) –is a free and open source messaging client for Mac that also lets you
talk to friends on lots of different networks. Even better, Addium comes with OTR
support built-in!
TextSecure (Android) – sister app to Whisper System’s RedPhone, free and open
source TextSecure replaces your Android’s default text app with one that encrypts
texts to other TextSecure users, and encrypts all local messages so that if your phone
is stolen they will remain secure
Gibberbot ( Windows, OSX, Linux, iOS, Android) – developed by the Guardian
Project, this app is available on all major platforms, supports chatting on a whole host
of different IM services, and has OTR built-in. It is still a little buggy and no-frills, but
has great potential.

Ditch the cell phone!
While we are on the subject of phones (sort of), we thought we should also mention that when
you carry your phone, your every movement can be tracked. It’s not just things like GPS and
Google Now (which works uncannily well at predicting what you want by storing just about
every piece of data about you) on SmartPhones: even the most modest cell phone can be
easily tracked by the satellites it uses to work. The only solution, if you really don’t want to
be tracked, is to leave your phone at home. Incidentally, the Google Now service only works
effectively if Goggle History is turned on (see above).

Secure your Cloud storage

As internet speeds increase, server level storage becomes
cheaper, our internet devices smaller (thus having reduced on-board storage), and the different
devices we use to access the internet more plentiful, it is becoming increasingly clear that
cloud based storage is the future.
The problem of course is ensuring that files stored in the ‘the Cloud’ remain secure, and here
the big players have proved themselves woefully inadequate – Google, Dropbox, Amazon,
Apple and Microsoft have not only been actively working in cahoots with the NSA, but in
their ToC’s reserve the right to investigate your files and hand them over to the authorities if
they receive a court order.
To ensure that your files are secure, there are a number of basic approaches you can take (note
that the options discussed below are far from the only ones available, as this is a highly
competitive area where many new and innovative solutions are appearing all the time)…

Manually encrypt your files before uploading them to the cloud
The simplest and most secure method is to manually encrypt your files using a program such
a TrueCrypt (see below). This has the advantage that you can carry on using your favorite
Cloud storage service, no matter how inherently insecure it is, as you hold all the encryption
keys to your files.
The downside compared to services such as SpiderOak and Wuala (see below), is that you
don’t get access to your files on the go.
Syncing files on your desktop is quite easy however, as you can place your encrypted folder
in your Cloud storage folder. Instructions for doing this using TrueCrypt and Dropbox can be
found here.
If you are in the market for a good Dropbox alternative, you may like to check out BestVPN’s
sister website BestBackups, for news and reviews of the best and the rest when it comes to
cloud storage services.

Use an automatically encrypted cloud service
These services automatically encrypt files before uploading them to the Cloud (we have no
truck with any service that encrypts files server-side, as these are always vulnerable to being
decrypted by the service provider). Any changes to files or folders are synced with local
decrypted versions before being secured and sent to the Cloud.

Both SpiderOak and Wuala have iOS and Android apps, so you can easily sync across all
your computers and mobile devices. This convenience comes at a small security price, as both
services briefly store your password on their servers to authenticate you and direct you to your
files. Wuala also uses this password to encrypt and decrypt your files when using a mobile
device, although this is somewhat compensated for by Wuala uploading different segments of
your files to different servers, making it impossible for them to identify which data belongs to
which user. In both cases the passwords are deleted once a session is finished.




SpiderOak (2GB free, $10/m 100GB) – available for all major platforms, SpiderOak
offers a ‘zero knowledge’, secure, automatically encrypted cloud service, which uses a
combination of 2048 bit RSA and 256 bit AES to encrypt your files
Wuala (5GB free, plans from €2/m 20GB to €160/m 2TB) – available for most major
platforms and also offering 2048 bit RSA and 256 bit AES encryption (with SHA-256
hashes for integrity checks), Wuala’s service is very similar to that of SpiderOaks, but
with a slightly different approach to security (see above).

It should be noted that neither SpiderOak or Wuala are FOSS (and are therefore inherently
less trustworthy), although at appears that SpiderOak may be headed in that direction.
Because of its high profile, we feel that Kim Dotcom’s Mega service deserves a special
mention, particularly as it offers a very generous 50GB encrypted space for free. Mega uses
your web browser to encrypt files before uploading and decrypt them after downloading,
which is great for convenience (and an Android app is available, with an iOS one on the way),
but is not as secure as the other methods outlined here. Our feeling therefore, is that while it is
worth paying attention to how Mega deals with its security issues, it is probably best avoided
for the time being. It is also worth pointing out that Kim Dotcom’s involvement ensures the
service is receiving the highest possible level of scrutiny from security, law enforcement and
copyright enforcement bodies the world over.

Use BitTorrent Sync Cloudless Syncing
The free BitTorrent Sync service is now in public beta phase (i.e. it is available to the public,
but is still considered experimental). Designed more or less as a Dropbox replacement,
BitTorrent Sync synchronizes files and folders across devices, but does so without storing
them in ‘the Cloud’.
You chose a folder that you want to share, and BitTorrent Sync gives you a secret for it. You
can then link that folder to a folder on another device (with BitTorrent installed on it) using
the secret. Any number of additional folders can be added in a similar fashion, and all files are
transferred using a securely encrypted (256-bit AES) P2P protocol.
BitTorrent Sync is free, easy to use, and is currently available for Windows, OSX , Linux and
Android (with an iOS app in private alpha stage). A limitation of the system is that as it is not
a cloud service, it cannot be used as an extra drive by portable devices with limited storage,
but on the plus side you are using your own storage, and so are not tied to Cloud provider’s
data limits (or charges).

Encrypt your local files, folders and drives

While the focus of this document is on internet security, an important aspect of securing your
digital life is to ensure that locally stored files cannot be accessed by unwanted parties. Of
course, it is not just about local storage; as we have already noted you can also encrypt files
before emailing them or uploading them to Cloud storage.

Use TrueCrypt

While other solutions are of course available, the king of local
encryption is undoubtedly the powerful free/donationware, open source program TrueCrypt
(available on Windows, OSX and Linux).
TrueCrypt can be used to create encrypted volumes on your computer, to encrypt entire disks,
to create hidden volumes, and even to create an entire hidden operating system (using 256-bit
AES, or any of a number of user specified encryption schemes). What makes Truecrypt so
powerful and easy to use is on-the-fly encryption, which allows you to work with files as you
would on normal, unencrypted files, without the hassle of continually encrypting and
decrypting them. Once a volume is mounted (using a password), operation is transparent, with
TrueCrypt keeping temporary files in RAM and generally clean up after itself.
For ultimate security, you can encrypt the drive your operating system is installed on, which
will ensure that all the little system files and other bits of junk that OS’s tend to create remain
secure. Of course, if you forget your password then you won’t be able to boot into your
system! TrueCrypt also even lets you create a container with hidden Operating System in it
(see below)!
TrueCrypt allows you to create hidden volumes, which provides’ plausible deniability’ as it is
impossible to prove that a second volume exists. This is great in situations where guilt must
be proven, but also means that if this is not the case (e.g. in repressive countries where
innocence must be proven), it is impossible to prove a hidden volume does not exist either
(which may result in imprisonment or torture based on the assumption that it does exist!). We
have written a post on this subject examining the issue in more depth.
A further consideration is that TrueCrypt is not, strictly speaking, truly FOSS, as some of its
code is ‘source-available’ instead. Nevertheless, TrueCrypt remains that best encryption
method available, and was enough to see off the police in the David Miranda incident.
Mobile options

Cyrptonite brings TrueCrypt and EncFS to Android, including allowing users to access
TrueCrypt containers (if you experience problems, a command line version of TrueCrypt is
included with the app). EDS Lite is another good option that does more or less the same.
Unfortunately there is no TrueCrypt compatible app or alternative available for iOS devices
that we are aware of.
Check out our three part introductory guide to using TrueCrypt! Part 1 Part 2.

Alternatives to Truecrypt
If the fact that TrueCrypt is not truly FOSS, or the implications of ‘plausible deniability’
worry you, there are a couple of other highly regarded encryption programs available:




eCryptfs (Enterprise Cryptographic Filesystem) (Linux) – looks like TrueCrypt
(which uses encrypted containers) as it creates a folder that transparently
decrypts/encrypts all files placed into out of it seamlessly and on the fly, but differs as
each file is encrypted separately, and if you unmount the folder you end up a number
of singly encrypted files (i.e. it provides per-file encryption)
Tomb (Linux) – a FOSS script that creates encrypted folders using LUKS AES/SHA256 encryption

Use antivirus, anti-malware and firewall software
Antivirus

First of all, while we’ve written about antiviruses here in
detail, we’ve also written a very detailed site about antiviruses at BestAntivirus.com. If you’d
like to choose an antivirus that best fits your needs, take a look at our sister site! Now, back to
the guide…
It almost goes without saying, but as this is an ‘ultimate guide’ we’ll say it anyway… always
use anti-virus software and make sure that it is up-to-date!
Not only can viruses really screw up your system, but they can let hackers enter it, giving
them access to all your (unencrypted) files and emails etc., webcam, passwords stored in
Firefox (if no master password is set), and much more. Keyloggers are particularly dangerous
as they can be used to access bank details and track pretty much everything you do on your
computer.

It is also worth remembering that not just criminal hackers use viruses! The Syrian
government, for example, launched a virus campaign known as Blackshade, aimed at ferreting
out and spying on political dissidents.
Although most people are aware they should be using anti-virus software on their desktop
computers, many neglect their mobile devices. While there are less viruses targeting mobile
devices at present, smart phones and tablets are sophisticated and powerful computers, and as
such are vulnerable to attack by viruses, and should therefore be protected.
Mac users are famously bad for not installing ant-virus software, citing the ‘fact’ that OSX’s
Unix architecture makes virus attacks difficult (this is hotly contested by the way), the fact
that most hackers concentrate on Windows because most computers use Windows (true), and
the anecdotal evidence of many Mac users who have gone for years without using anti-virus
software yet never experienced any problems. However as events last year demonstrated,
Macs are not immune to viruses, and anyone serious about their security should always use
good anti-virus software.

Free vs. paid-for antivirus software
The generally agreed consensus is that free antivirus software is as good at preventing viruses
as paid-for alternatives, but paid-for software provides better support and more
comprehensive ’suites’ of software that are designed to protect your computer from a range
of threats (combining antivirus, anti-phishing, anti-malware and firewall functions for
example). Similar levels of protection are available for free, but require the use of various
different programs. Also, most free software is for personal use only, and businesses are
usually required to pay for a license.
Some good anti-virus software:








Windows – the most popular free antivirus programs for Windows are Avast! Free
Antivirus and AVG AntriVirus Free Edition, although plenty of others are also
available. A good review of commercial options can be found here
OSX – Avast! Free Antivirus for Mac and ClamXav are well regarded, although other
free good options are available. In fact, the free software is better regarded than paidfor options, so we just recommend using them
Android – again, there are a number of options, both free and paid for. We’ve used
Avast! for ages now and find it works well, is free, and includes a firewall
iOS – Apple is still somewhat in denial about the fact iOS is as vulnerable as any other
platform to virus attack, but VirusBarrier is now available from the app store
Linux – the usual suspects: Avast!, Kaspersky and AVG Free are all available for
Linux, work very well, and are free.

Anti-malware
In addition to actual viruses, computers (Windows in particular) are vulnerable to various
other forms of malicious code known as malware. Users of non-Windows systems shouldn’t
worry too much about this (and anti-virus software should deal with any problems), but
Windows users should consider using an anti-malware program alongside their regular
antivirus software. Windows versions Vista and up ship with the anti-malware program

BitDefender built-in, or Spybot Search and Destroy , Windows Malicious Software
Removal Tool, and Malwarebytes (all free) can be used instead.

Firewalls
A personal firewall monitors network traffic to and from your computer, and can be
configured to allow and disallow traffic based on a set of rules. In use they can be a bit of
pain, but they do help ensure that nothing is accessing your computer, and that no program on
your computer accessing the internet, that shouldn’t be.
The biggest problem with using a firewall is determining which programs are ‘ok’, and which
are potentially malicious (perfectly legitimate Windows processes can, for instance, appear
pretty obscure), but once set up they become fairly transparent in use.
Some good firewall programs








Windows – versions Vista and up have a firewall built-in, which is quite good and is
very easy to use, but only screens incoming traffic. For many this will be perfectly
sufficient, but those wanting a more robust solution might want to consider
commercial anti-virus suites which include a firewall as part of the package, or
Comodo Firewall Free and ZoneAlarm Free Firewall 2013, which are good free
options
OSX – versions 10.5 and up have a basic firewall built-in, which like that in Windows
only monitors incoming traffic. If you want to monitor outgoing traffic, Little Snitch
($25) is a great program
Android – as noted above, the free Avast! For Android includes a firewall
iOS – the only iOS firewall we are aware of is Firewall iP, which requires a jailbroken
device to run
Linux – there are many firewall programs and dedicated firewall distros available, but
for a simple and straight forward Linux firewall you might want to give Smoothwall a
try.

Miscellaneous security hints and tips and tricks
Use Linux rather than a commercial OS
As we noted near the beginning of this Guide, no commercial software can be trusted not to
have a back-door built into it by the NSA . A more secure solution to Windows or OSX is
Linux, which is free and open source (although some builds incorporate components which
are not). In addition to it being far less likely that Linux has been compromised by the NSA, it
is a much more stable and generally secure OS than its commercial rivals.
Unfortunately, despite great strides made in the right direction, Linux remains less user
friendly than either Windows or OSX, and less computer literate users may struggle with it. If
you are serious about privacy however, Linux really is the way forward, and one of the best
things about it is that you can run the entire OS from a Live CD, without the need to install it.
This not only makes it easy to try out different Linux distros, but also adds an extra layer of
security when you access the internet.

Ubuntu is very popular due to the fact that it is one of the easiest Linux distros to use, and
thanks to this popularity there is a great deal of assistance available for it from an enthusiastic
Ubuntu community. It therefore makes a good starting point for those interested in a using a
much more secure Operating System.

Use a Virtual Machine
An additional level of security can be achieved by only accessing the internet (or only
accessing the internet for certain tasks) using a ‘virtual machine’. These are software
programs that emulate a hard drive onto which an Operating System (such as Windows or
Linux – VMing OSX is tricky) is installed, effectively emulating a computer in software
while running your normal OS.
The beauty of this approach is that all files are self-contained within the Virtual Machine so
that, for example, the ‘host’ computer cannot be infected by viruses caught by the VM (which
is why such a set-up is popular among hardcore P2P downloaders). The Virtual Machine can
also be entirely encrypted, and even ‘hidden’, using programs such as TrueCrypt (see above).
Because Virtual Machines are emulating hardware, then running another whole OS on top of
your ‘standard’ OS, there are substantial overheads in terms of processing power and memory
use. This means that VMs tend to be somewhat slow and cumbersome, although using a very
light Linux distribution such as Puppy can help, as does installing the VM on a separate hard
drive to your main OS.
Popular VM software includes the free VirtualBox and VMWare Player, and the premium
($273.90) enterprise level VMware Workstation. As noted above, TrueCrypt lets you encrypt
an OS, or even hide one.

Give Whonix a try
Whonix works inside a VirtualBox Virual Machine, and ensures that DNS leaks are not
possible, and that ‘not even malware with root privileges can find out the user’s real IP’.

It consists of two parts, the first of which acts as a Tor gateway (known as Whonix Gateway),
while the second (known as a Whonix Workstation) is on a completely isolated network
which routes all its connections through the Tor gateway. This isolation of the workstation

away from the internet connection (and all isolated from the host OS inside a VM), makes
Whonix highly secure.

Password protect your BIOS
Full-disk encryption using TrueCrypt is a great way to physically secure your drives, but for
this to be properly effective it is essential to set strong passwords in BIOS for both starting
up and modifying the BIOS settings. It is also a good idea prevent boot-up from any device
other than your hard drive.

Secure your Flash Player settings
The Flash Player is inherently a very insecure piece of software (see also Flash Cookies), but
despite the gains made by HTML5, it remains an important part of most people’s internet user
experience. It is therefore a good idea to check its settings, and turn off most of them off
(paying particular attention to the Camera and Mic settings!).
Many security related browser plugins disable Flash by default, which a good thing, but does
not help when you actually want view the Flash content. Be careful however to only allow
Flash on trusted websites. The Flash Player Settings Manager has moved from being online to
being accessed locally, and the easiest way to open it is to right-click on some Flash content
(e.g. a YouTube video) and select ‘Global Settings…’.

Change DNS servers and secure your DNS with DNSCrypt
Although we are used to typing easy-to-understand and remember domain names into our web
browsers, these domain names are not the ‘true’ addresses of websites. The ‘true’ address, as
understood by a computer, is a set of numbers known as an IP address. To translate domain
names to IP addresses, for example www.bestvpn.com to its IP address of 216.172.189.144,
the Domain Name System (DNS) is used.
By default this translation process is performed on your ISP’s DNS servers, which ensures
your ISP has a record of all websites you visit. Even when using a VPN service (highly

recommended), possible DNS leakage may result in your ISP handling this DNS translation
instead of your VPN provider (as should happen).
Fortunately, there are a number of free and secure public DNS servers, including OpenDNS
and Comodo Secure DNS, and we recommend changing your system settings to use these
instead of your ISP’s servers. We have instructions of how to do this in Windows 7 (along
with a guide on how to detect and block DNS leaks when using a VPN) available here.
There remains the problem that DNS was not built with security in mind, and it is vulnerable
to a number of attacks, the most important of which is a ‘man-in-the-middle’ attack known as
DNS spoofing (or DNS cache poisoning), where the attacker intercepts and redirects a DNS
request. This could, for example, be used to redirect a legitimate request for a banking service
to a ‘spoof’ website designed to collect account details and passwords for unsuspecting
victims.
This has prompted the fine chaps at OpenDNS to develop DNSCrypt, a lightweight program
that encrypts ‘all DNS traffic between the user and OpenDNS, preventing any spying,
spoofing or man-in-the-middle attacks’.
Using Curve25519 elliptical-curve cryptography, DNSCrypt is available for Windows, OSX
and Linux, and although in ‘preview release’ stage, is considered stable.

Use secure passwords
Okay, we have all been told this often enough to make us want to pull our hair out – we
should use long complex passwords, with combinations of standard letters, capitals and
numbers… and we should use a different such password for each service we use… arrgh!
Given that many of find remembering our own name in the morning challenging, this kind of
advice can be considered next to useless.
Fortunately, help is at hand!
Low tech solutions
Here are a couple of ideas which will vastly improve the security of your passwords, and take
almost no effort whatsoever to implement…






Insert a random space into your password – this simple measure greatly reduces the
chance of anyone cracking your password. Not only does it introduce another
mathematical variable into the equation, but most would-be crackers assume that
passwords consist of one contiguous word, and therefore concentrate their efforts in
that direction
Use a phrase as your password – even better, this method lets you add lots of spaces
and use many words in an easy to remember manner. Instead of having ‘pancakes’ as
your password, you could have ‘I usually like 12 pancakes for breakfast’ instead, to
immensely increase your security
Use more than 4 numbers in your PIN – where possible, use more than four
numbers for your PINs. As with adding an extra space to words, this makes the code
mathematically much harder to break, and most crackers work on the assumption that
only 4 numbers are used.

High tech solutions
Where mortals fear to tread, software developers jump in with both feet! There are a plethora
of password management programs available, but our pick of the bunch are:




Firefox password manager – the password manager built into Firefox is one of the
easiest ways to store your passwords for each website you visit, and it works very
well. Do be aware however that you should set a master password to prevent just
anyone peeking at your passwords in Firefox’s options dialogue. In addition to this, it
is probably a god idea to back up your Firefox passwords every now and again
KeePass (multi-platform) – this popular free and open source password manager will
generate complex passwords for you and store them behind AES or Twofish
encryption. It is a shame that KeePass doesn’t integrate with your browser, but it is
possible to import saved Firefox passwords into it. KeePass itself is Windows only,
but KeepassX is an open source clone for OSX and Linux, as are iKeePass for iOS and
Keepass2Android for Android

Social networking

Social networking, where you are encouraged to share every
random though that comes into your head, photos of what you had for dinner, and word-forword details of your relationship meltdown, can by and large be considered the antithesis to
concepts such as privacy and security. While, for example, Facebook can be considered
‘worse’ than Twitter in terms of privacy, selling every detail of your life to profiling-hungry
advertisers, and handing all your private data over to the NSA, all social networks are
inherently about sharing information, and all commercial ones make a profit through
harvesting your personal details, likes, dislike, places you visit, things you talk about, people
you hang out with (and what they like, dislike etc.), and selling them.
By far the best way to maintain your privacy on social networks is to avoid them altogether,
and to delete all your existing accounts. However not only can this be tricky (it is unlikely for
example that you will be able to remove all traces of your presence on Facebook), but for an
increasing number of us these social networks, where we chat, share photos and otherwise
interact with our friends, are a primary reason for using internet, and play a central role in our
social lives. In short, we aren’t willing to give them up.
Below then are some ideas for trying to keep a modicum of privacy when social networking,
for those (i.e. most of us) who insist on using them.











Self-censorship – simply put, if there are things you don’t want (or that shouldn’t be)
made public, don’t post details about them on Facebook! Remember that once posted
it is very difficult to retract anything you said, especially if it has been re-posted (or retweeted etc.) In addition to this, remember that the authorities monitor social
networking sites and services, so planning big illegal raves, or joking about bombing
your local airport, are very bad ideas
Keep private conversations private – it is all too common for people to discuss
intimate details of a planned dinner date, or conversely to have personal rows using
public channels. Remember that things like Message (Facebook) and DM (Twitter)
exist, and use them. It won’t hide your conversations from advertisers, the law, or the
NSA, but it will at least keep potentially embarrassing interactions away from friends
and loved ones (who probably really don’t want to hear certain things anyway!)
Use aliases - despite what the likes of Facebook try to insist upon, there is nothing
stopping you from using a false name. In fact, in this world where employers almost
routinely check their staff’s (and potential staff’s) Facebook pages, using at least two
aliases – a sensible one with your real name which is designed to make you look good
to employers, and another where friends can post wildly drunken pictures of you, is
almost a must. Remember that it is not just names you can lie about; you can also
happily fib away about your date of birth, interests, gender, where you live, or
anything else that will put advertisers and other trackers off the scent. On a more
serious note, bloggers living under repressive regimes should always use aliases
(together with IP cloaking measures such as VPN) when making posts that may
threaten their life or liberty
Keep checking your privacy settings – although Facebook is notorious for
continually changing the way its privacy settings work, and for making their privacy
policies as opaque as possible, it is worth regularly checking the privacy settings on all
social networks to make sure they are as tight as possible (for example by ensuring
that posts and photos are only shared with Friends, not Friends of Friends or ‘Public’).
A good idea in Facebook is to ensure that ‘Review posts friends tag you in before they
appear on your time line’ (under Privacy Settings -> Timeline and Tagging) is set to
‘On’, to help limit the damage ‘friends’ can do to your profile .
Use Glassboard instead – Glassboard is basically a Facebook replacement that
encrypts your data on its servers, and promises not to ‘sell, rent, or otherwise share
personal information to Third Party companies for marketing purposes’. It is easy to
use, and can be accessed using iOS and Android apps, or through their web client.
Glassboard is organized around ‘boards’ (much like Google+ Communities), where
users can chat and share photos etc. There is a free service, which gives you access to
10 boards, or $5 a month gives you unlimited access. Of course, no social network is
any good if you have no friends on it, which will always be the biggest challenge for
any service trying to compete with the ‘big boys’, and it goes without saying that
Glassboard is in no way FOSS.

Avoid all US and UK based services
The scope of the NSA’s PRISM spying program is quite frankly staggering, and Edward
Snowden’s revelations clearly demonstrate it has the power to co-op any US based company
(including for information relating to non US citizen and pretty much anybody else in the
world) and to monitor all internet traffic that passes through the US’s internet backbone.

While other countries’ governments’ seem desperate increase their own control over their
citizen’s data, nothing (including China’s attempts at internet surveillance) matches the scale,
sophistication or reach of PRISM.
It is therefore a very good idea, if such things worry you (as they should), to avoid all dealings
with US companies where you are concerned about your privacy. To suggest that every US
company may be complicit in handing every user’s personal information over to a secretive
and largely unaccountable spying organization might sound the stuff of paranoid science
fiction fantasy, but as recent events have proved, is terrifyingly close to the truth…
In addition to this, the UK’s GHCQ is in bed with the NSA (‘They [GCHQ] are worse than
the US’, Edward Snowden), so all UK companies should also be similarity avoided.

Conclusion
Is privacy worth it?
As we come to the end of this guide, we think this question is worth considering. Not only
will almost all the measures outlined above mark you out for special attention by the likes of
the NSA, and add extra layers if complexity and effort to everyday tasks, but much of the cool
functionality of new web-based services rely on knowing a lot about you.
Google Now is an excellent case in point. An ‘intelligent personal assistant’, this software’s
ability to anticipate what information you require is uncanny. It can, for example remind you
that you need to leave the office to catch the bus ‘now’ if you want to get home at your usual
time, as well as providing navigation to the nearest bus-stop, and alternative timetables should
you miss it. Google’s new, and possibly game-changing Google Glass system makes heavy
use of Google Now technology, which relies on storing and curating large amounts of
information about your habits, likes, dislikes, browsing history, where you like to drink, and
much more.
In other words, some of the most exciting and interesting developments in human-computer
interaction rely on a full-scale invasion of our privacy, and to box yourself in with encryption
and other privacy protection methods is to reject the possibilities afforded by these new
technologies.
We mainly pose the question ‘is privacy worth it’ as food for thought. Privacy comes with a
cost, and it is worth thinking about what compromises you are willing to make, and how far
you will go, to protect it. In our view privacy IS vitally important, as everyone has a right not
to have almost every aspect of their lives recorded, examined and then judged or exploited
(depending on who is doing the recording), but it has to be recognized that maintaining
privacy is not easy (and can never be completely guaranteed) in the modern world.
Of course, what most of us probably want is the ability to share what we want with our friends
and with services that improve our lives, without worrying this information is being shared,
dissected and used to profile us for dubious ends. While this is not likely to happen soon, if
more people made even fairly basic efforts to improve their security, it would make both
government agencies’ and advertisers’ jobs much more difficult, to the point that it could even
force a change of approach.

Final words
It may take a bit of effort, but as we hope we have demonstrated in this Guide, it is entirely
possible and not too cumbersome to take steps that greatly improve your privacy while online.
Nothing is foolproof, but there is no reason to make the work of those who would invade
aspects of your life that you should rightfully consider yours and yours alone, easy.
Privacy is a precious but endangered commodity, and by implementing at least some of the
ideas we have covered you not only help to protect your own privacy, but also make a
valuable contribution to conserving it for everyone. After all, if everyone encrypted their
online life, where would the NSA be then?
Final note: If you are interested in further exploring the ideas and issues raised in this Guide,
a good place to start is the almost exhaustive set of links available at Opentrackers.org.