permaculture

[Lawrence London <lfljvenaura@gmail.com>]

><><

Mozilla Privacy Blog
Covering the latest developments in privacy & data safety
Introducing Polaris Privacy Initiative to Accelerate User-focused Privacy
Online
https://blog.mozilla.org/privacy/2014/11/10/introducing-polaris-privacy-initiative-to-accelerate-user-focused-privacy-online/
"At Mozilla, we believe that an individuals’ privacy on the Internet cannot
be treated as optional. Our Privacy Principles guide us with the design of
each of our products and services. We’ve introduced features to support our
privacy focus across desktop and mobile, including: an add-on platform with
Firefox Add-ons like LightBeam, Disconnect, Ghostery and Privacy Badger;
the Do Not Track preference; Private and Guest Browsing; high levels of
encryption with Firefox Sync; an individual approach to apps permissions;
and even a new Forget button. But we recognize we need to do better and do
more. We want to give our users the Web experience they want through
features that create transparency and control. We want our users to trust
us and the Web."

><>

https://voat.co/v/AskVoat/comments/126756
Why don't you use encryption? What would change your mind? (self.AskVoat)

submitted 1 month ago by zedoriah

You know the NSA is listening, watching, and reading everything you do
online. You know every email, text, and IM you send is being recorded and
tagged. You know that governments violate your privacy at every turn.
There's a very simple solution in using strong encryption. PGP/GnuPG for
emails. OTR for IM. TOR for web browsing.

But in my entire address book I have a grand total of 4 people who use
encryption for communication.

So what's stopping you? What would make it better?

EDIT Links:

GnuPG - Gnu Privacy Guard https://www.gnupg.org/

EnigMail - GnuPG Plugin for Thunderbird - https://www.enigmail.net

OTR for pidgin - Off The Record IM encryption - https://otr.cypherpunks.ca/

TOR - The Onion Router, encrypts and bounces traffic around to provide
anonymity and access to .onion sites - https://www.torproject.org/

TOX.im - secure encrypted chat, video chat, and file transfer -
https://tox.im

Google End-to-End Encryption for gmail -
http://googleonlinesecurity.blogspot.com/2014/06/making-end-to-end-encryption-easier-to.html

><><

"Protect yourself on the net, especially from surveillance."

"I cannot vouch for the accuracy of the opinions or the information,
because my level of expertise is too low, but you can decide for yourself.
If some of the topics are unfamiliar, explanations are clear. There are
estimates of Difficulty Level for using each tool, and Warnings. The list
is comprehensive. If you are interested in privacy and avoiding
vulnerability, take a look at the "black hole router condition" link at the
bottom of the topic list."

Topics covered:

Browsers: Firefox, Chromium, Tor (and other browsers to avoid)

Browser Add-ons: HTTPS Everywhere, Privacy Badger, NoScript, uBlock, Random
Agent Spoofer, Self-Destructing Cookies, Better Privacy.

Password Managers: Password Safe, KeePass, LibreOffice

Web Analytics: Piwick, Open Web Analytics, AWStats

Disk Encryption: TrueCrypt, VeraCrypt, Linux Unified Key Setup

File Encryption: LibreOffice, GnuPG, P7ZIP/PeaZip, TrueCrypt

VPN (Virtual Private Network)

Operating Systems: Linux Mint, Ubuntu, Arch Linux

<>

Outline below is a summary of a well-organized, clear presentation on how
to protect your privacy online. Don't be intimidated because it appears to
be technical. Most is straightforward, not jargon. The layout of the
information
presented is impressive.

A map of the terrain of privacy issues. Fly over, take a look.

Privacytools.io

A Privacy-respecting search engine

VPN providers with extra layers of privacy – No Affiliates
Our VPN Provider Criteria
Related VPN Information

What is a warrant canary?
Warrant canary examples
Related warrant canary information

Global Mass Surveillance – the Fourteen Eyes
Key Disclosure Law – Who is required to hand over information keys to
authorities?

Browser Recommendation

WebRTC IP Leak Test – Is your IP address leaking?
How to disable WebRTC in Firefox
How to fix WebRTC in Google Chrome
Other browsers

Excellent Firefox Privacy Add-ons
Firefox: Privacy Related “about:config” Tweaks
Privacy-Conscious Email Providers – No Affiliates
Become your own mail service provider with Mail-in-a-Box
Privacy Email Tools
Email Clients
Email Alternatives
Encrypted Instant Messenger
Encrypted Video and Voice Messenger
Encrypted Cloud Storage Services
Self-Hosted Cloud Server Software
Secure File Sync Software
Password Manager Software
File Encryption Software
Self Contained Networks
Decentralized Social Networks
Domain Name System
Productivity Tools
PC Operating Systems
Live CD Operating Systems
Mobile Operating Systems
Open Source Router Firmware

Quotes

"The NSA has built an infrastructure that allows it to intercept almost
everything. With this capability, the vast majority of human communications
are automatically ingested without targeting. If I wanted to see your
emails or your
wife's phone, all I have to do is use intercepts. I can get your emails,
passwords, phone records, credit cards. I don't want to live in a society
that does these sort of things... I do not want to live in a world where
everything I do and say is recorded. That is not something I am willing to
support or live under." - Edward Snowden in The Guardian

"We all need places where we can go to explore without the judgmental eyes
of other people being cast upon us, only in a realm where we’re not being
watched can we really test the limits of who we want to be. It’s really in
the private realm where dissent, creativity and personal exploration lie."
- Glenn Greenwald in Huffington Post

Recommended Privacy Sources

Panopticlick - Tests your browser to see how unique it is based on the
information it will share with sites it visits.

ipleak.net - IP/DNS Detect - What is your IP, what is your DNS, what
informations you send to websites.

Surveillance Self-Defense by EFF - Guide to defending yourself from
surveillance by using secure technology and developing careful practices.

PRISM Break - We all have a right to privacy, which you can exercise today
by encrypting your communications and ending your reliance on proprietary
services.

The Ultimate Privacy Guide - Excellent privacy guide written by the
creators of the bestVPN.com website.

IVPN Privacy Guides - These privacy guides explain how to obtain vastly
greater freedom, privacy and anonymity through compartmentalization and
isolation.

AlternativeTo.net - Great collection of open source online and self-hosted
software sorted by likes.

All of the above (and more) can be found at the link below:
https://www.privacytools.io/#email

<>

Two good articles on how to protect your digital privacy

1) In his first email to Laura Poitras, Edward Snowden wrote, "Assume your
adversary is capable of one trillion guesses

per second.” He meant that pass-words now need to be seven-word
pass-phrases, carefully constructed.

The first article teaches you how to do that.

Title: Pass-phrases that you can memorize - but that even the NSA can't
guess

https://firstlook.org/theintercept/2015/03/26/passphrases-can-memorize-attackers-cant-guess/

The second article deals with encrypting the files on your laptop, (for
which you would need to use a good pass-phrase) so

that if somebody got access to your laptop, your files would still be safe.

Tells you how to do it, for Windows, Mac OS X, and Linux.

Title: Encrypting your laptop like you mean it

https://firstlook.org/theintercept/2015/04/27/encrypting-laptop-like-mean/

Both from The Intercept, author: Micah Lee

<>

How people stay safe online: experts compared to non-experts
"This paper outlines the results of two surveys—one with 231 security
experts, and another with 294 web-users who aren’t

security experts—in which we asked both groups what they do to stay safe
online. We wanted to compare and contrast

responses from the two groups, and better understand differences and why
they may exist."
...
"Security experts rely heavily on password managers, services that store
and protect all of a user’s passwords in one

place. Experts reported using password managers, for at least some of their
accounts, three-times more frequently than

non-experts. As one expert said, “Password managers change the whole
calculus because they make it possible to have both

strong and unique passwords.”
...
"More broadly, our findings highlight fundamental misunderstandings about
basic online security practices. Software

updates, for example, are the seatbelts of online security; they make you
safer, period. And yet, many non-experts not

only overlook these as a best practice, but also mistakenly worry that
software updates are a security risk."
....
Iulia Ion, Software Engineer
Rob Reeder, Research Scientist
Sunny Consolvo, Us Researcher
http://googleonlinesecurity.blogspot.com/2015/07/new-research-comparing-how-security.html

><><

Researchers claim they’ve developed a better, faster Tor
HORNET, a high-speed onion routing network, could be deployed on routers as
part of the Internet.
http://arstechnica.com/information-technology/2015/07/researchers-claim-theyve-developed-a-better-faster-tor/

"Tor, the world's largest and most well-known "onion router" network,
offers a degree of anonymity that has made it a popular tool of
journalists, dissidents, and everyday Internet users who are trying to
avoid government or corporate censorship (as well as Internet drug lords
and child pornographers). But one thing that it doesn't offer is speed—its
complex encrypted "circuits" bring Web browsing and other tasks to a crawl.
That means that users seeking to move larger amounts of data have had to
rely on virtual private networks—which while they are anonymous, are much
less protected than Tor (since VPN providers—and anyone who has access to
their logs—can see who users are).

A group of researchers—Chen Chen, Daniele Enrico Asoni, David Barrera, and
Adrian Perrig of the Swiss Federal Institute of Technology (ETH) in Zürich
and George Danezis of University College London—may have found a new
balance between privacy and performance. In a paper published this week,
the group described an anonymizing network called HORNET (High-speed Onion
Routing at the NETwork layer), an onion-routing network that could become
the next generation of Tor. According to the researchers, HORNET moves
anonymized Internet traffic at speeds of up to 93 gigabits per second. And
because it sheds parts of Tor's network routing management, it can be
scaled to support large numbers of users with minimal overhead, they claim.

Like Tor, HORNET encrypts encapsulated network requests in "onions"—with
each layer being decrypted by each node passing the traffic along to
retrieve instructions on where to next send the data. But HORNET uses two
different onion protocols for protecting anonymity of requests to the open
internet and a modified version of Tor's "rendezvous point" negotiation for
communication with a site concealed within the HORNET network."

<>

http://www.theregister.co.uk/2015/07/20/edward_snowden_to_the_ietf_please_design_an_internet_for_the_user_not_the_spy
NSA whistleblower Edward Snowden has urged the world's leading group of
internet engineers to design a future 'net that puts the user in the
center, and so protects people's privacy. Speaking via webcast to a meeting
in Prague of the Internet Engineering Task Force (IETF), the former spy
talked about a range of possible changes to the basic engineering of the
global communications network that would make it harder for governments to
carry out mass surveillance.

The session was not recorded, but a number of attendees live-tweeted the
confab. It was not an official IETF session, but one organized by attendees
at the Prague event and using the IETF's facilities. It followed a
screening of the film Citizenfour, which documents the story of Snowden
leaking NSA files to journalists while in a hotel room in Hong Kong.

"Who is the Internet for, who does it serve, who is the IETF's ultimate
customer?" Snowden asked, rhetorically. The answer was users, not
government and not business.

But, he said, the current internet protocols were leaking too much data
about users. "We need to divorce identity from persona in a lasting way,"
he argued, highlighting how the widespread use of credit cards online was
connecting identity to online activity.

"If it's creating more metadata, this is in general a bad thing." Instead,
protocols should "follow users' intent." He argued that DNS queries should
be encrypted – as well as actual content – so that encryption, rather than
surveillance, was the norm. "People are being killed based on metadata," he
noted.

Spud gun
Snowden appeared to have a good understanding of how the internet's
protocols work, and pointed to a new protocol called SPUD that combines
transport protocols to reduce the number of "middleboxes" that data needs
to travel through when users interact online.

Snowden noted that the network path was the best place for spies to get
access to information and that each middlebox provided another potential
point of attack, but also warned that SPUD could make the core UDP internet
protocol "a new channel for leaking metadata about users' intents."

He also argued that having identifiable "long lasting" hardware addresses
was "extremely dangerous," as it connects people to, say, a MAC address
when they use wireless internet connections, which can put an immediate
flag on their identity and location.

Snowden's speech was met with a standing ovation. Which is hardly
surprising – the IETF and internet engineers in general tend to have a
strong independent streak, and many are still embarrassed by the fact that
the NSA managed to crack a number of key internet protocols developed by
the IETF and even subvert some of its working groups in their bid to
develop new standards that would give the spooks easy access.

One of the IETF's first responses to the Snowden revelations was the
creation of a new RFC document, which currently serves as "best current
practice." In RFC 7258, the organization notes that "Pervasive Monitoring
Is a Widespread Attack
on Privacy" and "The IETF Will Work to Mitigate Pervasive Monitoring." ®

Crowd-funded research on the ties between Google and the CIA. Crowd-funding
enabled the research to be done independently.
https://medium.com/@NafeezAhmed/how-the-cia-made-google-e836451a959e

http://thehackernews.com/2015/07/Italian-hacking-team-software.html
Hacking Team, one of the most controversial spyware and malware providers
to governments and law enforcement agencies all around the world, allegedly
been hacked, with some 500 gigabytes of internal data leaked over the
Internet.
The leaked data indicates that despite its denials, the spyware company did
sell powerful spyware tools to oppressive regimes in Sudan, Bahrain,
Ethiopia and Saudi Arabia.

<>

Unbreakable encryption prototype being tested over 2 years.
"...in quantum communications bits are carried and sent by individual
photons (a particle of light), which cannot be tampered with without
leaving a trace of the intrusion. As a consequence the secrecy of
untampered encryption keys, and the genome data they protect, can be
guaranteed."
http://www.toshiba.co.jp/about/press/2015_06/pr1801.htm?from=RSS_PRESS&amp;amp;uid=20150618-3787e

<>

Hidden costs of "free" content" ... current advertising practices that
enable "free" content are in direct conflict with security, privacy,
stability, and performance concerns ...." "Advertising does not make
content free. It merely externalizes the costs in a way that incentivizes
malicious or incompetent players to build things ... (like) ad injection
malware, and create sites that require unsafe plugins and take twice as
many resources to load, quite expensive in terms of bandwidth, power, and
stability."
Monica Chew
http://monica-at-mozilla.blogspot.com/2015/05/tracking-protection-for-firefox-at-web.html?m=1

<>

"Why the Current Section 215 Reform Debate Doesn't Matter Much"
"Certainly the government is collecting that data, but we don't know how
they're doing it, we don't know at what scale they're doing it, and we
don't know with which authority they're doing it. And I think it is a farce
to say that we're
having a debate about the surveillance authority when really, we're just
debating this very narrow usage of the statute."
https://www.schneier.com/blog/archives/2015/05/why_the_current.html

<>