7 ms·

To be safe see this site. It has everything you need. Https://www.privacytools.io/

tptacek 10y ago
This page is batshit crazy. The very first thing it asks you to do is sign up with a random VPN vendor. Then it recommends Firefox or Tor Browser --- Tor Browser is the single least safe browser of all possible browsers you can install.
- jhlgkhkhil 10y ago
  Why is that?
  - tptacek 10y ago
    Because it's based on and thus only ever asymptotically secure as Firefox, which is not the most secure browser architecture, and because of the economics of browser exploit development, and the fact that Tor Browser Bundle collapses a whole set of valuable targets down to a single release train, we can be sure that pretty much anyone who uses browser exploits as standard operating procedure has a stockpile of TBB exploits.
    - jhlgkhkhil 10y ago
      So how would you suggest browsing privately then?
      - tptacek 10y ago
        I would start by learning the difference between Tor and Tor Browser.
        jhlgkhkhil 10y ago
        OK this advice is dangerous. The reason Tor Browser exists is because configuring Tor for safe use is difficult...
        tptacek 10y ago
        I'm confident that it's the opposite of dangerous advice.
        jhlgkhkhil 10y ago
        Interesting please tell me more.
        mjg59 10y ago
        Using Tor Browser as your primary browser is a bad idea because it's way behind on security features and you mark yourself out as an interesting target. Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. So it depends what you're optimising for. If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. There are cases where using the Tor Browser makes sense, but it's a terrible blanket recommendation. If you're not actively trying to hide your identity, using it will make you less secure than you would otherwise be.
        JupiterMoon 10y ago
        > Using Tor Browser as your primary browser is a bad idea because it's way behind on security features Is it? Please provide references. > and you mark yourself out as an interesting target/ Yeah that seems likely. > Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. Is it? If Chrome leaks any local information this is not true. NB I do not know if Chrome does so but please refer to https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... for an example of what I am getting at. > If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. Yes. But Tor Browser is released specifically to help you manage this. Information leakage through the web browser is amazingly easy - and it doesn't take logging onto a website to be finger printed (Chrome over Tor is probably a fairly unique fingerprint on its own). Why not find out for your self how unique at https://panopticlick.eff.org/ https://panopticlick.eff.org/ > If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. No comment. > But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. Doubt it but again citations needed. > There are cases where using the Tor Browser makes sense, agreed. > but it's a terrible blanket recommendation. Citation needed. > using it will make you less secure than you would otherwise be. Citation needed.
    - hackuser 10y ago
      I've seen this advice before, but people need a better option: 1) Chrome over Tor? I've read that they don't integrate well (but I know very little about it). 2) Chrome to a (secure) VPN? How does a typical end user find a secure VPN? 3) ?
      - tedunangst 10y ago
        Re-evaluate whether the kind of privacy offered by tor is your number one priority. A lot of journalists have notes and work product and contact info they need to protect, but they're not living deep undercover. The information stored on their computer is far more sensitive than the list of sites they visit.
        hackuser 10y ago
        > Re-evaluate whether the kind of privacy offered by tor is your number one priority A good point. Though in fairness, that's why I included Chrome over a VPN as an option. > The information stored on their computer is far more sensitive than the list of sites they visit. Not that it invalidates your points, but I wonder how true this one statement is. First, remember that in addition to metadata Tor hides content (which may be redundant in the case of HTTPS-secured websites, but that's not a bad thing). Also, a journalists' metadata could tell you a lot about the who, what, when, where, why and how they are researching, and expose sources. What is more valuable, knowing who a journalist is talking to and when, or knowing what was said? IM very HO, I think the former.
dguido 10y ago
Hi, my name is Dan, and I don't recommend anything on the privacytools website. Above all the many problems it has, it recommends using insecure hosted VPNs and advocates an app-centric approach to restoring your privacy (e.g., Install this app and you'll be safe!). This is no better than believing you can eat unhealthy food and fix it with weight loss pills. If you're looking for a better solution to a communications security problem, you're welcome to check out Algo, a self-hosted VPN that I support: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
- deleted 10y ago
  [deleted]
- ploggingdev 10y ago
  Thanks for the link to Algo. First time coming across it. I was under the impression that PrivateInternetAccess was well regarded, but this link [1] which is in the blog post linked above was an eye opener. [1] https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa
- claudiojulio 10y ago
  Private Tools recommends using VPN for privacy rather than anonymity. For anonymity the page recommends Tor, Tails ...
hackuser 10y ago
EDIT: If this was crowd-funded (to help pay for the expert's time), I'd be happy to contribute. The reputation of this page emphasizes (epitomizes?) a need the public has: An authoritative, accurate, comprehensive, usable security guide for non-technical end-users. * Authoritative: There are too many pages, apps, and too much advice like the parent. Most end users - even most IT professionals, IMHO - have no good way to differentiate between good advice and bad. The solution is for one source of advice to become authoritative; i.e., it needs to be endorsed by people respected in the IT security industry and by names the public recognizes (e.g., the NY Times, ACLU, NRA, etc.). Its authority must stand out from the rest, and in a way the general public recognizes (endorsements on HN don't work), or it becomes just another voice among many. * Accurate: Written by true IT security professionals who do real homework for it. Not IT pros or devs who read about security and have some sense of it. Not even by cryptographers who don't know the implementation side. * Comprehensive: A one-stop shop. Otherwise, it loses authority and usefulness. * Usable: Something non-technical end users can grasp and implement, as easily as possible. The harder it is, the fewer people will use it and the more people will misuse it (i.e., misunderstand it and make mistakes). 'Easily' also means affordably; telling everyone to buy iPhones may not be realistic. Personally I wouldn't mind a guide for technical users, but that is a very secondary concern.

This page is batshit crazy. The very first thing it asks you to do is sign up with a random VPN vendor. Then it recommends Firefox or Tor Browser --- Tor Browser is the single least safe browser of all possible browsers you can install.

jhlgkhkhil 10y ago
Why is that?
- tptacek 10y ago
  Because it's based on and thus only ever asymptotically secure as Firefox, which is not the most secure browser architecture, and because of the economics of browser exploit development, and the fact that Tor Browser Bundle collapses a whole set of valuable targets down to a single release train, we can be sure that pretty much anyone who uses browser exploits as standard operating procedure has a stockpile of TBB exploits.
  - jhlgkhkhil 10y ago
    So how would you suggest browsing privately then?
    - tptacek 10y ago
      I would start by learning the difference between Tor and Tor Browser.
      - jhlgkhkhil 10y ago
        OK this advice is dangerous. The reason Tor Browser exists is because configuring Tor for safe use is difficult...
        tptacek 10y ago
        I'm confident that it's the opposite of dangerous advice.
        jhlgkhkhil 10y ago
        Interesting please tell me more.
        mjg59 10y ago
        Using Tor Browser as your primary browser is a bad idea because it's way behind on security features and you mark yourself out as an interesting target. Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. So it depends what you're optimising for. If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. There are cases where using the Tor Browser makes sense, but it's a terrible blanket recommendation. If you're not actively trying to hide your identity, using it will make you less secure than you would otherwise be.
        JupiterMoon 10y ago
        > Using Tor Browser as your primary browser is a bad idea because it's way behind on security features Is it? Please provide references. > and you mark yourself out as an interesting target/ Yeah that seems likely. > Using Chrome over Tor is strictly better from a privacy viewpoint than using Chrome on its own. Is it? If Chrome leaks any local information this is not true. NB I do not know if Chrome does so but please refer to https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea https://blog.torproject.org/blog/bittorrent-over-tor-isnt-go... for an example of what I am getting at. > If privacy is your absolute priority, the Tor Browser reduces the number of cases of information leakage but still requires you to have the discipline to avoid any other methods of leaking your identity. Yes. But Tor Browser is released specifically to help you manage this. Information leakage through the web browser is amazingly easy - and it doesn't take logging onto a website to be finger printed (Chrome over Tor is probably a fairly unique fingerprint on its own). Why not find out for your self how unique at https://panopticlick.eff.org/ https://panopticlick.eff.org/ > If you understand all the issues around that then you probably also understand enough to ignore Tptacek and use it anyway. No comment. > But if you don't, using the Tor Browser leaves you in a worse position than you'd otherwise be in - you're less secure and you're probably leaking PII anyway. Doubt it but again citations needed. > There are cases where using the Tor Browser makes sense, agreed. > but it's a terrible blanket recommendation. Citation needed. > using it will make you less secure than you would otherwise be. Citation needed.
  - hackuser 10y ago
    I've seen this advice before, but people need a better option: 1) Chrome over Tor? I've read that they don't integrate well (but I know very little about it). 2) Chrome to a (secure) VPN? How does a typical end user find a secure VPN? 3) ?
    - tedunangst 10y ago
      Re-evaluate whether the kind of privacy offered by tor is your number one priority. A lot of journalists have notes and work product and contact info they need to protect, but they're not living deep undercover. The information stored on their computer is far more sensitive than the list of sites they visit.
      - hackuser 10y ago
        > Re-evaluate whether the kind of privacy offered by tor is your number one priority A good point. Though in fairness, that's why I included Chrome over a VPN as an option. > The information stored on their computer is far more sensitive than the list of sites they visit. Not that it invalidates your points, but I wonder how true this one statement is. First, remember that in addition to metadata Tor hides content (which may be redundant in the case of HTTPS-secured websites, but that's not a bad thing). Also, a journalists' metadata could tell you a lot about the who, what, when, where, why and how they are researching, and expose sources. What is more valuable, knowing who a journalist is talking to and when, or knowing what was said? IM very HO, I think the former.

dguido 10y ago

Hi, my name is Dan, and I don't recommend anything on the privacytools website. Above all the many problems it has, it recommends using insecure hosted VPNs and advocates an app-centric approach to restoring your privacy (e.g., Install this app and you'll be safe!). This is no better than believing you can eat unhealthy food and fix it with weight loss pills. If you're looking for a better solution to a communications security problem, you're welcome to check out Algo, a self-hosted VPN that I support: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...

deleted 10y ago
[deleted]
ploggingdev 10y ago
Thanks for the link to Algo. First time coming across it. I was under the impression that PrivateInternetAccess was well regarded, but this link [1] which is in the blog post linked above was an eye opener. [1] https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa
claudiojulio 10y ago
Private Tools recommends using VPN for privacy rather than anonymity. For anonymity the page recommends Tor, Tails ...

hackuser 10y ago

EDIT: If this was crowd-funded (to help pay for the expert's time), I'd be happy to contribute. The reputation of this page emphasizes (epitomizes?) a need the public has: An authoritative, accurate, comprehensive, usable security guide for non-technical end-users. * Authoritative: There are too many pages, apps, and too much advice like the parent. Most end users - even most IT professionals, IMHO - have no good way to differentiate between good advice and bad. The solution is for one source of advice to become authoritative; i.e., it needs to be endorsed by people respected in the IT security industry and by names the public recognizes (e.g., the NY Times, ACLU, NRA, etc.). Its authority must stand out from the rest, and in a way the general public recognizes (endorsements on HN don't work), or it becomes just another voice among many. * Accurate: Written by true IT security professionals who do real homework for it. Not IT pros or devs who read about security and have some sense of it. Not even by cryptographers who don't know the implementation side. * Comprehensive: A one-stop shop. Otherwise, it loses authority and usefulness. * Usable: Something non-technical end users can grasp and implement, as easily as possible. The harder it is, the fewer people will use it and the more people will misuse it (i.e., misunderstand it and make mistakes). 'Easily' also means affordably; telling everyone to buy iPhones may not be realistic. Personally I wouldn't mind a guide for technical users, but that is a very secondary concern.