4 ms·

I would like to attain some decent level of privacy, but my searches on how to go about it yield a large amount of conflicting information (which I suspect is t

by juanre 10y ago

I would like to attain some decent level of privacy, but my searches on how to go about it yield a large amount of conflicting information (which I suspect is there on purpose.) Is there a sensible guide out there that some of the experts at HN would recommend?

kbart 10y ago
It depends on your threat model: what do you want to hide and from who? If you simply want to avoid someone reading your messages (payload), using https everywhere, end-to-end encrypted chat clients (ie. Signal), encrypted mail (ie. PGP), maybe disk encryption (ie. VeraCrypt) should be enough to defend against non-targeted attacks and government dragnets. If you want to hide your "meta-data" from non-targeted government snooping (browsing history and who do you contact with) it gets more complicated -- in this case you also need VPN and/or Tor. Defending against targeted attacks is next to impossible, but you should not be worried about these anyway, unless you are on FBI's top list or smth. Using open-source tools and avoiding highly centralized services (Google, Facebook etc.) is generally a good idea for a privacy minded individual as well.
- falcolas 10y ago
  Simply using VPNs and Tor provided a signal, and is (per previously released documents) a great way to get on a short list of people to pay more attention to. I almost think we'd be better off going the other direction and hiding our signal in a bunch of noise, or just grab everything and review it on an uncompromised network (such as "spider every top link from HN and store it locally, then browse only that local copy").
  - kbart 10y ago
    If enough people use secure communications, then it becomes noise. Take an old, boring door lock analogy: everyone locks their home door, but nobody thinks that they have something to hide or illegal in their home just because of that. Making privacy and encryption tools easily accessible and easy to use is our best best imho.
    - falcolas 10y ago
      Given the breadth and intent of these laws, I'd expect a different response - requiring ISPs to block VPN traffic that isn't hitting a whitelisted (i.e. corporate) endpoint. VPN traffic has a distinctive signature, and ISPs are already using deep packet inspection hardware already, so blocking VPN traffic seems like a natural evolution in this particular arms race.

by juanre 10y ago

kbart 10y ago

It depends on your threat model: what do you want to hide and from who? If you simply want to avoid someone reading your messages (payload), using https everywhere, end-to-end encrypted chat clients (ie. Signal), encrypted mail (ie. PGP), maybe disk encryption (ie. VeraCrypt) should be enough to defend against non-targeted attacks and government dragnets. If you want to hide your "meta-data" from non-targeted government snooping (browsing history and who do you contact with) it gets more complicated -- in this case you also need VPN and/or Tor. Defending against targeted attacks is next to impossible, but you should not be worried about these anyway, unless you are on FBI's top list or smth. Using open-source tools and avoiding highly centralized services (Google, Facebook etc.) is generally a good idea for a privacy minded individual as well.

falcolas 10y ago
Simply using VPNs and Tor provided a signal, and is (per previously released documents) a great way to get on a short list of people to pay more attention to. I almost think we'd be better off going the other direction and hiding our signal in a bunch of noise, or just grab everything and review it on an uncompromised network (such as "spider every top link from HN and store it locally, then browse only that local copy").
- kbart 10y ago
  If enough people use secure communications, then it becomes noise. Take an old, boring door lock analogy: everyone locks their home door, but nobody thinks that they have something to hide or illegal in their home just because of that. Making privacy and encryption tools easily accessible and easy to use is our best best imho.
  - falcolas 10y ago
    Given the breadth and intent of these laws, I'd expect a different response - requiring ISPs to block VPN traffic that isn't hitting a whitelisted (i.e. corporate) endpoint. VPN traffic has a distinctive signature, and ISPs are already using deep packet inspection hardware already, so blocking VPN traffic seems like a natural evolution in this particular arms race.