“If after I die, people want to write my biography, there is nothing simpler. They only need two dates: the date of my birth and the date of my death. Between one and another, every day is mine” ―
In a prior post titled The Faustian Bargain, I warned about the dangers of selling your privacy short and I promised to follow up with some ways that you can begin to better guard your privacy. I am by no means an expert in privacy. I only bring this information with what limited knowledge I have, and that tends to be focused on the digital sphere. My work has largely been in targeted advertising, and so I come from the other side of the privacy equation; the one that trades your personal information for better-targeted advertising. But my graduate studies were in Information Systems and that incorporated IT Security and Network Defense. With all that said, here are some basic ways you can begin to guard your privacy:
Change Your Password
This is one of the simplest and most overlooked forms of privacy protection. All too often business partners that we give our information to are not secure. So it’s not that we are careless in securing our passwords, but that business partners that we’ve created accounts with are insecure. For this reason, I typically decline to create an account with retailers, and I checkout as a guest instead. I do my best to also ensure that payment information is not stored with retailers as well, or I try to checkout with a processor like PayPal so that all of my information is stored in one place, instead of with 50 different sites. Google launched a tool not too long ago that scans the dark web and searches out any compromised sites that you have given your password to. It’s rather kind of scary how this scenario is the rule and not the exception. When notified of all of my compromised passwords, it then became a daunting task to clean them all up. Especially in a scenario where you may have used the same password for any number of websites. I have found that a solution to this lies with a password manager such as LastPass. With a browser extension like LastPass, you can create secure passwords on the fly, and store them in a master account that you can secure with a single password. They are stored in a hashed or encrypted format so that should they be hacked, the passwords are useless to the hacker. Consider 2-Factor Authentication for some apps. This is an extra layer of security that attaches your password to the second form of authentication so that you not only need a password, but a phone to receive a text, and apply a temporary security code that you provide to the vendor. Popular examples of accounts that utilize two-factor authentication include Apple and Google.
Go Encrypted
Encryption is a universally adopted method of securing content and devices from prying eyes, but it does have limitations. By encrypting files and devices, you’re essentially placing the data within a locked box and therefore making the data useless without a special key to unlock the contents. The contents themselves are scrambled or hashed, and offer no value without the key to unscramble the contents. You can encrypt email and text messages so that only the sender and recipient can read the contents. This requires both the sender and recipient to have the key to decipher the contents. No privacy is offered if your data is physically in the hands of the wrong person. For instance, you may be in an encrypted email or messaging conversation, but if you leave your phone or computer open in a public space, the encryption obviously offers little to no protection for you. Below is a list of examples and applications to get you started. It is advised that you test out applications and determine what works best for your needs.
- Email – Proton*, Tutanota, Librem, Mailbox.org, Mailfence, TorGuard, Hushmail . All of these email services are fairly known, but maybe the most popular is Proton Mail. I personally use Proton. They offer end-to-end encryption, are extremely transparent, and have servers based in Switzerland where you have more privacy protections than you may within the United States. They offer free and paid services, but like most providers, you must pay for IMAP integration. It’s similar in cost to the Google GSuite of web services.
- Text Messaging – Signal*, Telegram, Threema, WhatsApp, Librem. Like all encryption, it’s necessary that both parties have the appropriate tools for this messaging to be secured. I personally have experience with Signal and it carries a good name in the industry as non-profit and secure. By default, Apple Messages is encrypted, but only between iPhone users. Signal and many of the other players here are cross-platform compatible. Some considerations must be made when dealing with any technology platform, and text messaging is no different. In particular, not only how are messages transmitted, but how are they stored? What personally identifiable information is required? Where are the hosting servers of the encryption service located and what jurisdictions are they under?
- Phone Calls – SilentPhone*, Signal, Telegram, Wire, Librem. Most of the platforms available for messaging also offer encrypted video and voice calls. I am highlighting SilentPhone here because they are a heavy hitter in the space. Silent Circle’s co-Founder, Phil Zimmerman, is the inventor of PGP and ZRTP encryption and he has serious street cred. in this space. SilentPhone started out in hardware but then moved into a software space, and now you can encrypt your calls across platforms on any device with the app installed.
- Web Browsing – HTTPS Everywhere (Chromium-Based Browser Extension). I’m going to have a separate section below on private web browsing, but while we’re on encryption you can force your browser to request the encrypted version of any website you visit through the HTTPS Everywhere Browser extension from the Electronic Frontier Foundation. Not every site will have an SSL Certificate (encrypted version), but if it’s available, this browser extension will force request that version. Additionally, you will want to set your browser to request DNS translation over HTTPS. When you type a web address into your browser, it first must go through a Domain Name Server that correlates the URL to an IP address. This typically happens in plain text, unless you have your browser set to DNS over HTTPS. This is actually built into many browsers now, but you may need to check if your browser requests DNS over HTTPS by default.
- Cloud Storage – This one should be a given, but anytime you utilize cloud storage you should ensure that your cloud storage is encrypted so that if the servers where your data is stored are hacked, your data remains private. Beyond whether or not your data is encrypted, it should be noted that most of the major players in the cloud storage space also have a bad track record of snooping on the contents of your storage or willingly handing over the contents to law enforcement or other players who request it. This gets back to the fact that we’re not discussing who does or does not have something to hide. This is a matter of individual privacy, and there is some good commentary and suggestions for cloud storage you can find here.
Choose Privacy-Focused Web Browsing
In 2021 it almost goes without saying, but your every move is tracked online. At a minimum for the purposes of selling you goods and services, but what’s more, often for nefarious purposes. Whether it’s a black hat hacker trying to obtain your personal and financial information or someone who doesn’t like your political opinions looking to doxx you, the internet can be an unsafe space for all. Appropriate steps should be made to protect your browsing from prying eyes and scammers alike. There are some very good and fast browsers available to you; among those include Brave, Vivaldi and Opera, which are Chromium-based browsers. I prefer Brave, as Opera (a historically Norwegian company) sold in the last few years to China. I don’t have a ton of experience with Vivaldi, but it is a project of former Opera developers. Mozilla FireFox is a traditionally privacy-focused browser alternative, but as of recent has participated in the political censorship game. There are other browsers available such as Duck Duck Go and Gibiru, that are primarily applications for searching their search engines. You will need to find what works for you. The focus of any privacy-based browser should be the elimination or minimization of trackers.
Even with traditional browsers like Google Chrome, extensions such as HTTPS Everywhere, Ghostery, and Privacy Badger are readily available to you. Private or incognito windows also offer you some local protection for browsing, but don’t do much in the way of protecting the data between you and the destination servers. For the ultimate in anonymous browsing, consider the TOR Browser. This particular browser uses a technology called “Onioning”, which basically means that it transmits across a disseminated network of individual user machines and re-encrypts the connection at every stopping point. This is the equivalent of driving from point A, to point B, to point C and at every stop changing the plates on your car. The benefit of this is advanced privacy. The downside to this is without a high-speed internet connection, this can be an extremely slow browsing experience. This particular technology was famously used by participants during the Arab Spring. Finally, many privacy-focused search engines are available that take a different approach to advertising, and in this way, they target you contextually rather than based on your browsing history. These include DuckDuckGo, Gibiru, StartPage, Qwant, SwissCows, and others. Find which you like best and set it as your default search engine.
Use A VPN
Every government agency and corporation worth their salt is using a VPN or a Virtual Private Network. Think of it as a tunnel only available between where you are and your destination. By traveling through the tunnel you are sheltered from the world outside of the tunnel. A VPN encrypts your data between the source and destination point so that you can access an internal network somewhere as if you were present at the destination point. A VPN is a necessity for extremely sensitive data, but can also serve useful purposes unrelated to security, such as getting around geographic data restrictions for streaming data. Say you want to watch streaming content such as a football game, but it is only available regionally. With a VPN you can present yourself as if you’re present in the limited region and in this way bypass filters that block the content to you. Many good VPNs are paid services, but there are also some decent free ones available to you. Typically the more you pay, the faster your service and higher your data caps go.
- Free VPNs – HotSpot Shield, TunnelBear, ProtonVPN, WindScribe, Speedify
- Paid VPNs – ExpressVPN, NordVPN, SurfShark
Turn off Data Uploads
Nearly every connected device that you own has an option for data usage sharing. This data should be anonymized in theory, however, the sheer amount of usage data that your devices are sharing might surprise you. I recently installed a Firewalla on my home network for better control over my network, and I was astonished to find that I was uploading more data than I was downloading. I have a connected home. I am a tech adopter. As such, there are many dozens of connected home devices in my home that require attention. Installing the FireWalla helped me to narrow down which devices were the egregious offenders with data sharing and uploads. Unsurprisingly, the top offenders were smart home speakers. In order to be available for voice commands, the speakers are sending a constant upload stream of data to servers elsewhere. The easiest way around this is to just pair a microphone / remote to the devices and then turn off the microphone buttons and cameras on the devices where available. If you have open laptops, close them at night. Turn off your gaming consoles. Shut down your connected exercise equipment after every use. Finally, near every device has data sharing settings. Check your device’s settings and turn data sharing off.
Offline: Consider Lower Tech or P2P
A recent goal of mine has been in building redundant forms of communication. In a world where landline phone services are all but extinct and near everyone utilizes cellular communications, having a backup form of communication that doesn’t rely on community infrastructure is important. I recently picked up a few GMRS radios and an FCC license, and have enjoyed communicating with family via GMRS radio at distances of 15-20 miles, without relying on communal infrastructure. Though not necessarily a top privacy option, they can offer some level of privacy based on nothing more than how rare their everyday use is. GMRS technology usually offers CTCSS or DCS privacy channels, which breaks your signal off to sub-frequencies and makes your communications largely unheard without a radio scanner. These are perfect for emergencies but do require a line of sight for communications. Another good option for point 2 point communications is something like a GoTenna or BearTooth device that creates an ad-hoc network for you to transmit data over. There are serious range limitations with these devices and require that you have the apps downloaded and installed on your cellphone before traditional networks go down. However, these do provide an exceptional level of privacy for private communications.
Offline: Get a P.O. Box
This one may seem silly and out of place, but you potentially give up a lot of information in your mailbox. Whether it’s your financial account numbers or your mail ballot, the opportunity for someone to get hold of your private information is not likely, but guaranteed. Consider getting a PO Box if you don’t have a secure mailbox available to you.
Offline: Ditch the PII In The Public Square
This should maybe go without saying, but consider what personally identifiable information is available out there and consider cleaning it up. Have you ever seen vanity plates on a car that say “Dr. So and So”? Maybe it’s just paranoia, but that sort of thing usually screams “sue me” when I see it. And then there are the stickers on the back of mini-vans that both identify every member of a family, and also give you their children’s names, hobbies, and where they go to school. Surely we’re smarter than this? Finally, make sure you lock down your social media profiles to only those people you know and trust. In an age of doxxing and cancel culture, you don’t want to be the example of someone who had an internet argument once and it loses your job for you.
As I’ve mentioned above, this list is not intended to be the be-all and end-all of privacy lists. I have some experience in this realm, but I’m by no means an expert. I hope that this serves as a good starting point to get you thinking about ways that you can begin to better guard your privacy during the buying and selling.
** Neither the Author, nor the Site Owner assumes any liability from the use of these products. **
Photo source: https://unsplash.com/photos/FqaybX9ZiOU
- Rubber, Meet Road - June 18, 2024
- These Unchallenged Voices - May 12, 2024
- Kindness & Fake Hate - March 26, 2024