Privacy Toolbox
2020-06-21
Tools to help protect your privacy – technological aid for a lack of ethics in tech.
For your convenience, the setup, maintenance, cost, or required technical knowledge of these tools increase as you read further down the list.
Please note that these tools will not render you fully anonymous; they are simple (and not so simple!) ways to protect your privacy.
Signal – Chat & Calls
- Developed by the non-profit Open Whisper Systems.
- No incentive to profit from your identity.
- Free/libre software, can be studied/audited.
- Minimal logging policy.
- End-to-end encryption, with a leading edge on research.
- Face blurring in pictures to protect your peers’ identities.
- Disappearing messages.
- Supports text, phone calls, and video calls.
Tor Browser – Web
- Developed by the non-profit The Tor Project.
- Better anonymizes your Web activity.
- Hides your traffic from your Internet service provider.
- Hides your IP address from the Websites you visit.
- Designed to prevent fingerprinting.
- Can circumvent certain types of censorship.
VPN
Hide your traffic from your Internet and phone service providers. Set up a VPN on both your PC and phone.
- Phone service providers are known to sell people’s data, such as location.
- Internet service providers can log your activity and sell it for similar purposes. In the past, they have also injected Ads.
Use a VPN service/application that blocks Internet traffic if a VPN connection cannot be established. Check for this capability when browsing for a VPN.
- Never connect to public networks (cafe, library WiFi) without a VPN.
DO NOT use a zero-cost (“free”) VPN; these monitor people’s activity and exploit it for profit.
Drive Encryption
Encrypt Android | iPhone | OSX | Windows 10 >
Encrypt the drives on your phone and PC in case you ever lose your device. You can similarly encrypt your USB drives as well.
Shop for an email provider that:
- Is in a country with strong privacy regulations (Northern Europe).
- Has encryption at rest.
- Has two-factor authentication (2fa).
ProtonMail at the time of writing seems like a good choice. It also supports end-to-end (e2e) encrypted email (OpenPGP) by default among ProtonMail peers, which is very convenient.
Email Encryption
Read the Email Self-Defense Guide >
Set up GnuPG / OpenPGP to send end-to-end (e2e) encrypted email with your peers.
ProtonMail does this out-of-the-box when communicating with other ProtonMail peers.
GNU/Linux – Operating System
GNU/Linux could be a better choice for you than operating systems like Windows or MacOS. The latter have embedded advertising IDs, track you in different ways, and are proprietary software, so they cannot be freely studied/audited. Most GNU/Linux distributions also happen to be zero-cost.
Ubuntu is a popular choice and may work better for your hardware, but ships with third-party proprietary software components such as device drivers.
PureOS is free/libre software, and therefore fully auditable.
If in doubt, I would try a live boot of PureOS on your system first to see if you experience any difficulties.
Librem 5 – Phone
- Developed by Purism.
- Does not track you. Does not embed advertising IDs.
- Offers kill switches for WiFi, cellular, and microphone/cameras.
Note that while the Librem does not track you, your phone service provider still does. Use the kill switches appropriately and a VPN.
Librem 13/15 – PC
A computer that does not spy on you and respects your freedom.
- Developed by Purism.
- Does not track you. Does not embed advertising IDs.
- Offers kill switches for WiFi, bluetooth, camera and microphone.
Note that like with the phone, the Librem PC does not track you, but your Internet service provider and the Websites you visit still do.
Avoid
Avoid: Whatsapp
Uses the same e2e encryption borrowed from Signal, but:
- Developed by an advertising company that exploits people’s privacy for profit.
- Logs metadata.
- Is proprietary software – cannot be freely read/studied/audited, and therefore cannot be trusted.
Avoid: Google hangouts
- Developed by an advertising company that exploits people’s privacy for profit.
- Is proprietary software – cannot be freely read/studied/audited, and therefore cannot be trusted.
Avoid: WeChat
- Has government backdoors and is subject to its censorship.
- Does not protect people’s privacy.
Avoid: Zoom
- The company has lied about its use of e2e encryption, giving it a different meaning than what the security literature and community understands.
- Has a broken encryption model. Encryption keys traveled through servers in China at some point.
- Is proprietary software – cannot be freely read/studied/audited, and therefore cannot be trusted.
Avoid: Facebook, Twitter
- Exploit people’s privacy for profit. No expectation of privacy.
- Can be used by others to track and understand you. In the past, Facebook was used to bias elections.
- Dropping these might also limit your reach depending on the circumstances. In that case, perhaps you can use pseudonymous profiles to at least protect your identity from others on the network.
Avoid: Gmail
- Developed by an advertising company that exploits people’s privacy for profit. No expectation of privacy.
References & Further Reading
Citizenlab / Move Fast and Roll Your Own Crypto (Zoom)
Citizenlab / WeChat Surveillance Explained
EFF / Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance
EFF / Cell-Site Simulators/IMSI Catchers
EFF / Gotta Catch ’Em All: Understanding How IMSI-Catchers Exploit Cell Networks
IANIX / The browser privacy handbook
Signal / Blur tools for Signal
Signal / Terms & Privacy Policy
Signal / WhatsApp’s Signal Protocol integration is now complete
The Intercept / The Metadata Trap
VICE / I Gave a Bounty Hunter $300. Then He Located Our Phone