Guess who's back. Back again.
Yeah, it's me. I felt like fucking with something again, so here goes. What follows is a short primer and a slightly modified version of the existing netsec page. I'd like to think about folding it into a general persec page, including netsec, though of course this isn't necessary. There are tools that I, not a sysadmin nor particular expert, view to be outdated here, and I have proposed cuts and swaps.
I am also by no means an expert on computer security, so have left most of the tools on the page intact and changed very little on that front. I know what works for me, but without sitting around paying a pentester to try to wreck my shit I don't actually know how effective it is. If you are
an expert, I could certainly use some help here. Note also that this is a start, a work in progress, and ideally I'd like to expand into a general security section, perhaps splitting off to various pages in their own right.
Let's get after it, comrades.
What is Persec?
Persec is short for personal security. In communities that practice security or do intelligence, or both, most things are shortened into such portmanteaus, and it's useful to learn them. Persec regards guarding your personal information (ie, who you are, where you're from, what you did...) from anyone who doesn't need to know. To what degree you do this is entirely your prerogative.
Why should I care about security at all?
Well, you are presumably a leftist, and may or may not be aware, but the US Government as well as other groups and orgs do not have a good history with regard to treatment of leftists or marginalized people. See Fred Hampton, or the FBI smear campaign against MLK, for two immediate examples. In addition to that, you don't send your bank info to the Nigerian Prince emailing you, do you? Same thing; you're just consciously aware of that threat.
So What Kind of Information Should I Guard?
All of it. If it is not intrinsically necessary for what you are doing, do not give the information. This is nuanced. Perhaps your date is asking about the neighborhood you live in. This isn't necessary, but you will weigh the risks vs the benefits of talking about it and/or seeming rude or overly paranoid for not talking about it.
In addition, you should be aware that you give away a lot automatically on a regular basis. Facial recognition software nails you everywhere you walk around, and a constant stream of selfies into any social media will be sold to people who will use them to help augment the success rate of that software. See Facebook auto finding faces and auto tagging your friends for you? Maybe it seems innocuous there, but who are they selling it to?
Unlock your phone with your face or fingerprint? Law enforcement has that data, almost guaranteed.
Fill out a fun survey? Dope, thanks for the street you grew up on in that nostalgia question. Nice, Greenwood Elementary as a school, and oh wow Ms. Applebaum was your favorite teacher? No way, my first pet was a Jack Russel named Roger too! Boy oh boy do I love that song by 3OH!3 too, just like it's your favorite!
Maybe not all of those were there, but you may be throwing common security question answers all over the place. You are also giving this stuff to innumerable third parties via cookies and other other means, allowing them to store and sell that data in turn. You do it when you give your email for that retail store rewards program too. Every purchase, logged, used to target you with ads or services.
What Do I Do?
Well, you could move into the Alaskan wilderness, grow a long beard, and rough it in a primitive frontier cabin. That'd minimize your profile and data footprint for sure.
You could also ignore this. Give up anything and everything.
But likely you will pick something between those two points. There are two ways to do it while still being online: hiding and obfuscating.
Obfuscating would be pretending to be that which you are not, hiding in plain sight. Changing everything to appear that you're on a Thinkpad running Linux instead of a Chromebook by shown software/hardware signatures and MAC address, choosing an IP address in a techie Bay Area district, and using a fake photo from thispersondoesnotexist.com to complete the persona. There are more steps necessary there but that will help with non state-level data collection and analysis.
Regardless which method or methods you choose, you must also remain who you actually are, and publicly so. Maybe you got rid of Facebook because that's just the smart thing to do, but if you've got a Twitter habit, keep it and don't cross the streams. Never log into your Twitter from the spoofed persona, nor should your fake persona ever inhabit the same session (or even hardware) to your real persona. This is easiest done with a live boot disc like TAILS on a hunk-a-junk craigslist laptop you buy in cash.
This seems complicated.
It is. Security culture, in the world and online, is a constantly evolving thing, and takes keeping tabs on and learning about, and a lot of dry reading and head pounding.
There are a few overall resources that can help. The Free Software Foundation The Electronic Frontier Foundation Richard Stallman The GNU Project
This is a list of tools and tips to keep data secure. The information presented is currently aimed at Windows users but includes information relating to data security for Linux, Mac, and mobile users. As you spend time learning about privacy, privacy tools, and security, you will start learning what works and why, but this is a general jump-off point. Also, note that Windows 10 contains a frankly ridiculous amount of phone-home capability, and is selling you out every second you use it. Make the switch to a user-friendly Linux distro and your privacy will thank you. linux4noobs
For other opsec information, please see our Communications section on this page.
To discuss the information here or make suggestions, please see the talk page
A brief note on these tools: Comodo Security Solutions is a private firm offering some of these products. In the digital world, a for-profit enterprise exists to make money on a product. If you are not paying for a product from a for-profit venture, then you are the product. Additionally, a Wikipedia skim shows how full of shit they are. I've left them in this post because they previously existed there but strongly disagree with continuing to leave them up, so am striking all of them.
- PGP - Usually used to encrypt e-mails, but also encrypts physical data on your hard drive.
- OpenVPN - VPN software using SSL/TLS for key exchanges.
- Bitvise - An SSH client for Windows users.
- TCPcrypt - A protocol that attempts to encrypt (almost) all of your network traffic.
- VeraCrypt - Comprehensive, on-the-fly disk encryption.
- Protected Folder - Not encryption software, but allows you to password protect folders and files. Protected folders are invisible unless PF is opened and they are unlocked with the password.
Browser extensions, Add-ons, etc.
- HTTPS Everywhere - Forces all website connections to be HTTPS. Developed by the Electronic Frontier Foundation.
Adblock for YouTube
- Ublock Origin
- Safescript - The Chrome equivalent of NoScript
- DuckDuckGo - "The search engine that doesn't track you. A superior search experience with smarter answers, less clutter and real privacy."
Virtual Machines See this page on our wiki for information specific to iPhone users.
- The Electronic Frontier Foundation's "Surveillance Self-Defense" guide
- CVE - Searchable repository of known security vulnerabilities in various products and programs
- Security Focus - Similar to CVE.
CCleaner - Maintenance is part of security. Updating software is important, but so is deleting junk such as cache, cookies, history, unused registry keys, etc. CCleaner does all of that and includes other features such as a drive wiper. recommend not using CCleaner except old versions, propose swapping for Ninite and adding a section on how to do what CCleaner did, just manually instead.
- Check Your Torrent Client's IP Address
- Find out what your browser knows about you - "A demonstration of all the data your browser knows about you. All this data can be accessed by any website without asking you for any permission."
- Using Tor bridges - Bridges, also called relays, are alternative entry points to the Tor network that are not all listed publicly. Using a bridge makes it harder, but not impossible, for your Internet Service Provider to know that you are using Tor.
- Free VPNs - Paying for a trusted VPN service is always the best. There are too many arguments about what free VPN providers to use. Nonetheless, here's a review of several (which points out that "Many free VPNs are a security nightmare.") Caveat Emptor.
- DD-WRT - A free custom firmware for routers. Many come with enhanced firewall and VPN features. The DD-WRT wiki is most useful.
- Test Your Router - A variety of features which allow you to test your network security. Examples include a port scanner to test which ports are open on your network.
- InterNIC Whois - Find out who owns an IP or domain, where it's located, etc.
- Tor Network Status
- Awesome Honeypots - A lengthy and regularly updated list of open-source honeypots and other security tools.
- Signal - Encrypted mobile messaging app.
- How to clear your Flash and Java cache and clear your DNS cache
- Disable unnecessary Windows services
- Why you shouldn't use DropBox
- "Top 10 List" of Good Computing Practices
- The Arch Linux Wiki, Or How I Stopped Worrying and Learned To Solve Every Computer Problem Ever After Only Three Nervous Breakdowns and Five Weeks of Cursing and Troubleshooting
- The only way to guarantee your data is 100% secure.