9 ms·

Privacy Tools – Encryption Against Global Mass Surveillance

267 points by selmat 8y ago

throw1984 8y ago
https://torrentfreak.com/proxy-sh-vpn-provider-monitored-traffic-to-catch-hacker-130930/ https://torrentfreak.com/proxy-sh-vpn-provider-monitored-tra...
chin123 8y ago
Prism Break is also worth taking a look: https://prism-break.org/en/ https://prism-break.org/en/ I like that it has OS-specific recommendations.
- buovjaga 8y ago
  Prism Break is actively maintained and a lot of thought is being put into curation. Privacy Tools recommends Claws Mail, but Prism Break removed it after investigating the code: https://gitlab.com/prism-break/prism-break/issues/2043 https://gitlab.com/prism-break/prism-break/issues/2043
  - holri 8y ago
    Claws was one of the few email clients not affected by efail because of its conservative design.
- xvector 8y ago
  One of the most frustrating things about this website is that it doesn't provide a reason for their "avoids." Why should I use KeePass over 1Password? Why should I use Mumble over FaceTime? It wouldn't be that hard to provide a sentence-long justification for their avoids in addition to their recommendations.
  - EduardoBautista 8y ago
    The only reason is because they are closed source.
jasode 8y ago
>All [vpn] providers listed here are outside the US, use encryption, accept Bitcoin, support OpenVPN and have a no logging policy. Yes but how does the average person really know if those suggested foreign VPNs are not CIA or other government coordinated honeypots? In terms of cyberspace cat & mouse games, I think VPNs can be useful to evade Netflix streaming restrictions to particular countries or to hide your DNS queries from your ISP. You don't need a lot of trust in VPN entities to evade commercial businesses. However, using VPNs to evade government surveillance is a whole different ballgame. Because of the far reaching tentacles of government agencies, there's no reliable method to determine which VPN to trust.
- DyslexicAtheist 8y ago
  exactly. it just shifts the trust from your ISP to the VPN (who ironically even has your credit card info in many cases ...). even Verizon now peddles VPN services to take their slice of the privacy snake-oil market https://www.verizonwireless.com/biz/security/wireless-private-network-vpn/ https://www.verizonwireless.com/biz/security/wireless-privat...
  - reshie 8y ago
    many accept bitcoin. as you say though it all comes to trust.
    - IggleSniggle 8y ago
      Bitcoin is not private. It is, in fact, a PUBLIC LEDGER, and at some point, most folks want to either convert to or from bitcoin to a government backed currency. Sure, you could argue that the transaction could be laundered, but no more than any other transaction could be laundered, so then you need to compare whether it is more or less private than other transactions internally. I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger.
      - 8y ago
mtgx 8y ago
One of my favorite lines against "I have nothing to hide" is from national security whistleblower, Edward Snowden: “Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.” https://www.goodreads.com/quotes/7308507-arguing-that-you-don-t-care-about-the-right-to-privacy https://www.goodreads.com/quotes/7308507-arguing-that-you-do... But ultimately, the idea that you want privacy because you have something bad to hide is a deeply flawed one, pushed by governments, maybe not necessarily because they are "evil" and want to abuse that power (although that certainly seems a factor to consider lately), but also because pretty much the only times they do want to bypass privacy laws is when they deal with criminals. So that gives them a very narrow view of the issue. When all you have is a hammer, every problem looks like a nail. Privacy is both about "keeping things to yourself" and not wanting others to know everything there is to know about you for no good reason, as well as to protect yourself against potential abuses (from governments, but also criminals, unscrupulous companies, etc) that can't be predicted ahead of time. There are thousands of potential uses for the data, like say using your data to manipulate you with ads during elections, make you buy anti-depressants, make you pay higher insurance, and so on.
- yura 8y ago
  "Privacy is both about "keeping things to yourself" and not wanting others to know everything there is to know about you for no good reason, as well as to protect yourself against potential abuses (from governments, but also criminals, unscrupulous companies, etc) that can't be predicted ahead of time." Yes. To put it succinctly: I may trust the current government to use this data for (mostly) good, but I don't trust all future governments.
  - Bizarro 8y ago
    A "government" is a big abstract entity that is made up of people and procedures. People come and go, and procedures/regulation are changed all the time without direct legislative efforts. You don't have the knowledge to know if you trust "that" government or "another" government. The best solution for all is always be suspicious of concentrated power....especially power that involves state-sanctioned violence against you.
mockingbirdy 8y ago
Using privacy-related software makes it more likely that you'll get specifically targeted for surveillance. [1] Simply visiting this site makes it more likely. [2] For anyone who fears state-level surveillance: Using a VPN or Tor and some privacy plugins isn't enough. Don't assume that you're safe just because of it. In fact, you make yourself identifiable if you rely on such plugins. I won't go into details on how to be able to have privacy that can compete with state-level surveillance, because you'll have to commit crimes to get it. If you think that your government is watching you - don't trust these simple instructions. It's way harder. Some people had to die because of this. Many (authoritarian) governments don't let you use a VPN without putting you on a watch list. If you try to keep a low profile, you need other measures. False sense of security can be dangerous in some countries. I hope that those who need this (a fraction of those who read it) keep themselves safe. edit: I think they should clearly state that this tutorial isn't suited for individuals who are in great danger w.r.t surveillance. It's for people who are interested in privacy, not for people in life-or-death situations. [1]: https://www.cnet.com/news/nsa-likely-targets-anybody-whos-tor-curious/ https://www.cnet.com/news/nsa-likely-targets-anybody-whos-to... [2]: https://www.makeuseof.com/tag/interest-privacy-will-ensure-youre-targeted-nsa/ https://www.makeuseof.com/tag/interest-privacy-will-ensure-y...
- throwaway654654 8y ago
  this is exactly right. the modern surveillance state (both government and corporate) is opt-out but the economic incentives are tuned to make sure that only a very few people opt-out, which then makes it easy to target and focus all of the resources on those people. if you are serious about security don't use digital devices at all. if you are willing to accept some security risk in exchange for using digital devices then you are best off using some obscure back channel, not some high tech "theoretically unbreakable" crypto. security by obscurity is, ironically, the only thing that actually works (until you get caught), even though in theory it is the worst. every crypto scheme is trivially broken by state level actors.
- commandlinefan 8y ago
  > Using privacy-related software makes it more likely that you'll get specifically targeted for surveillance. Which is a good reason for people who specifically don't have anything to hide to start using them - if you're not signal, you can't help out by being noise.
kawanu 8y ago
> Brave > privacy You are aware Brave is Chromium based and as thus can be fingerprinted as easily as Google Chrome? Listing it on a "privacy" list is a literal troll. Or simply a paid actor which wouldn't surprise me seeing how butthurt Mr. Eich must have been about the Mozilla story. And no the little font size 3 checkmark you have to hover over does not help contrary it only adds to the distrust. If it would have been as big as the header and inside the header that would make it trustable.
- yjftsjthsd-h 8y ago
  That doesn't necessarily follow. I don't know specifically what fingerprinting works against Blink, but as an extreme example consider that the chromium-based browser could easily enact the policy of only allowing first-party scripts to execute by default. I suspect that there's a lot more obvious API service to remove or protect that the browser can customize, as well.
  - kawanu 8y ago
    You are aware most sites nowdays first party the scripts? So if you block them you block the website itself. Congratulations. Also it still doesn't explain why they would add Brave and then a small little 2px checkmark that you have to hover over explaining that Brave is "experimental" aka placebo honeypot
- kawanu 8y ago
  > Downvoting me without even trying to argue Yes Brave is just Mr. Eich being frustrated with his life and paying the privacytools guys and paying people to post pro Brave propaganda and downvote everything contrary to it.
  - sctb 8y ago
    > Yes Brave is just Mr. Eich being frustrated with his life... Who can argue with vacuous conjurations like that? “That doesn't necessarily follow.” is the most charitable response you can expect.
ptero 8y ago
This is a great overview and a list of useful tools and technologies. Kudos to the author! However, I am afraid that using those tools to protect your own privacy is at best a temporary band-aid as long as the current trend of accepting more and more backdoors into our personal lives persists. To change this a significant portion of people need to see the government not as the main savior from terrorism (poverty, disease, crime, etc.) but as a big bureaucracy where a lot of clerks care more about their paycheck than the end results of their day's work (which is fine). And a large portion of public servants who do care, care more about their career, power and perception than about people who chose them to govern (which is bad). This view change, if it ever happens, should force government to justify their actions and pay more attention to real issues (poverty, crime, disease, terrorism) and less to scare tactics. A used car salesman can provide a useful service -- knowing that a customer suspects him to be a swindler forces him into a partial honesty. That said, I am not optimistic that this view change will happen soon.
- ignoramous 8y ago
  You'd find that a single Firefox addon uMatrix itself takes you a long way AFA as privacy is concerned (and breaks websites, too, unfortunately). You need to start somewhere.
skilled 8y ago
I am impressed with the amount of detail this page has, wonderful job by the author!
walterbell 8y ago
Brave (based on Chrome, minus Google tracking) includes optional Tor in private tabs, anti-tracking and ad blocking. By making Tor accessible to all users of Brave, it makes Tor users slightly less of an anomaly. Brave has also added capacity to the Tor network.
- Forbo 8y ago
  Brave users of Tor tabs have a different fingerprint than users of the normal Tor browser. Having a larger anonymity set may be preferable for some people's threat model.
  - number-sequence 8y ago
    Is there data out on the number of users of Brave compared to Tor?
    - jemas54 8y ago
      Setting aside all the privacy risks associated by using a Webkit/Blink based Browser, using Tor inside Brave is like someone with a mask screaming "HERE I AM". Even though they have a mask on everybody sees you and hears you and your mask looks different to everybody elses so what's the point of the mask after all? The mask only works if everyone is wearing the exact same mask. Which is the exact opposite of what Brave is doing.
  - walterbell 8y ago
    Alternately, being part of "people who don't download Tor browser" could be useful in some scenarios.
    - jemas54 8y ago
      If you are among "did not download Tor browser" but are among "produces Tor web traffic without downloading Tor browser" you are easier to identify than if you were among "Downloaded Tor browser and produces Tor (web) traffic". This would make you either more suspicious or your adversary (justifiedly) think you are an idiot.
Maximus9000 8y ago
Are those password managers listed really "better" than 1Password or lastpass? If so, why? Shouldn't I want to pay money for my password manager?
- Forbo 8y ago
  > Shouldn't I want to pay money for my password manager? The same argument can be made for any software. This horse has been beaten many times already, and I don't think we really want another open vs. closed source flamewar....
- iotku 8y ago
  >Are those password managers listed really "better" than onepass or lastpass? If so, why? The main point seems to be that they're either local or able to be self hosted. In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database. Encryption could be potentially worse than the more commercial offering if implemented wrong, but you can also restrict access better to local/self-hosted databases. >Shouldn't, I want to pay money for my password manager? Not if it's unnecessary to do so, and it also adds a paper trail relating your account to your passwords etc should they be compromised. Personally that's pretty far out of my threat model, but I still have my password DB locally because I figure if someone compromises my computer they'll get my passwords anyways (keyloggers, etc), but at least an online service I have no control of wont get compromised and affect me. Only real difficulty with local keepass databases is keeping them synced/up to date on my devices.
  - xvector 8y ago
    > In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database. Could they really, though? 1Password, for example, extensively details their client-side encryption protocol. Unless they were forced to distribute a compromised client, there's really no downside to using it.
    - 8y ago
tptacek 8y ago
Why is it not recommended to choose a US-based service? This is extraordinarily, almost axiomatically bad advice. The USG has an NSL process for obtaining information from US-based service providers. It has no process whatsoever for obtaining it from foreign providers. It can simply do it. We have the largest, best-funded signals intelligence agency in the world, and literally the only place in the world you have any procedural, legal defenses against them is here. I'm not being normative. You don't have to like this state of affairs. But it is the reality in which we live, and signing up with a European privacy service won't keep your data out of the hands of US surveillance if they want it. I think jurisdiction is the wrong question. The most important question to be asking about a service provide is "what information do they collect and retain about me". Sometimes these comparisons are hard to make from the outside, but other times you can make inferences just based on the features they offer and the protocols they use.
- ar-jan 8y ago
  But they at least have to make the effort to break into those systems. Presumably this takes more time/money than an NSL, and it possibly leads to detection of the vulnerabilities used in the hack.
- chopin 8y ago
  NSL's obtain data legally, whereas other methods are illegal (at least in most countries), and surely not well received when detected. In the latter case the hole will be closed. For me legality matters as well.
  - pvg 8y ago
    Law enforcement agencies in Europe cooperate extensively and legally with US ones. Just recently in the news - https://www.dutchnews.nl/news/2019/01/the-netherlands-tapped-el-chapo-phones-for-fbi-due-to-relaxed-privacy-laws/ https://www.dutchnews.nl/news/2019/01/the-netherlands-tapped... This is El Chapo getting burned by this exact bad advice, among other things.
  - tptacek 8y ago
    It is not meaningfully "illegal" for NSA to hack and continuously monitor a foreign information service. It is in fact half of NSA's charter to do exactly that. We spend untold billions of dollars every year making sure that happens. The legality doesn't matter at all; you get "legal" protection from the NSA only to the extent you use a service hosted in the US. Again: I don't think this is a good reason to pick US services. I think jurisdiction is simply of no use whatsoever in picking.
ericcholis 8y ago
A nice resource, but I think the links on the page should all open into a new tab. Reading through and clicking a link takes me away from the page, I'd rather that the links open in a new tab for later.
- freeflight 8y ago
  Clicking a link with the middle mouse button opens it in a new tab, at least on Chrome.
holri 8y ago
Isn't it bizarre that a privacy tools website uses Google Maps instead of Openstreetmap?
- jesterson 8y ago
  Yeah, good point actually
bungie4 8y ago
The only way to win the game is not to play.
yange 8y ago
Many file formats record creation timestamps, like in image, document, video, audio, executable, archive, and so on. If you create these formats and send the file to others, they would at least know when you created the file. Sometimes they even include timezone info, so they can even know something about your geo location. This applies to network protocols, application communications, database records and so on. Even Git will record your timestamp and timezone info for every commit, and it's very difficult to completely change or remove these info. You might think it's a trivial thing, but it actually tells a lot about you. If someone can trace your activities through time, it's essentially a detailed profile of you, and they can learn how you live and work. Sometimes it can even be used to de-anonymize you by cross referencing with your "real" online identity. In general it's impractical for users to fully understand what kinds of meta data were included in each file format or send by each application. EXIF data is often included in image files generated by cameras or image editing software. Your full file path to a source code file may be included in the executable you compiled, and it may leak your personal information. Your operating system may send regular health report to its company. A proxy service may append your real IP address in HTTP headers. Even for some encrypted services, they don't encrypt or sign everything. Like 1Password in the past didn't encrypt the URLs of your saved login sites. TLS 1.2 doesn't sign the cipher suites. TLS 1.3 doesn't encrypt client certificate. Most of these software and protocols were not designed with privacy as a primary concern. Even they do, there are info that they decided to be okay to leak. However, it should be up to the users to decide whether the design decisions were reasonable for their own use case. Even many of these meta data leak seem like targeted surveillance, it's actually scalable and can be adapted to mass surveillance.

267 points by selmat 8y ago

throw1984 8y ago

https://torrentfreak.com/proxy-sh-vpn-provider-monitored-traffic-to-catch-hacker-130930/ https://torrentfreak.com/proxy-sh-vpn-provider-monitored-tra...

chin123 8y ago

Prism Break is also worth taking a look: https://prism-break.org/en/ https://prism-break.org/en/ I like that it has OS-specific recommendations.

buovjaga 8y ago
Prism Break is actively maintained and a lot of thought is being put into curation. Privacy Tools recommends Claws Mail, but Prism Break removed it after investigating the code: https://gitlab.com/prism-break/prism-break/issues/2043 https://gitlab.com/prism-break/prism-break/issues/2043
- holri 8y ago
  Claws was one of the few email clients not affected by efail because of its conservative design.
xvector 8y ago
One of the most frustrating things about this website is that it doesn't provide a reason for their "avoids." Why should I use KeePass over 1Password? Why should I use Mumble over FaceTime? It wouldn't be that hard to provide a sentence-long justification for their avoids in addition to their recommendations.
- EduardoBautista 8y ago
  The only reason is because they are closed source.

jasode 8y ago

>All [vpn] providers listed here are outside the US, use encryption, accept Bitcoin, support OpenVPN and have a no logging policy. Yes but how does the average person really know if those suggested foreign VPNs are not CIA or other government coordinated honeypots? In terms of cyberspace cat & mouse games, I think VPNs can be useful to evade Netflix streaming restrictions to particular countries or to hide your DNS queries from your ISP. You don't need a lot of trust in VPN entities to evade commercial businesses. However, using VPNs to evade government surveillance is a whole different ballgame. Because of the far reaching tentacles of government agencies, there's no reliable method to determine which VPN to trust.

DyslexicAtheist 8y ago
exactly. it just shifts the trust from your ISP to the VPN (who ironically even has your credit card info in many cases ...). even Verizon now peddles VPN services to take their slice of the privacy snake-oil market https://www.verizonwireless.com/biz/security/wireless-private-network-vpn/ https://www.verizonwireless.com/biz/security/wireless-privat...
- reshie 8y ago
  many accept bitcoin. as you say though it all comes to trust.
  - IggleSniggle 8y ago
    Bitcoin is not private. It is, in fact, a PUBLIC LEDGER, and at some point, most folks want to either convert to or from bitcoin to a government backed currency. Sure, you could argue that the transaction could be laundered, but no more than any other transaction could be laundered, so then you need to compare whether it is more or less private than other transactions internally. I’m not a bitcoin person, but I still don’t understand why people think of bitcoin as more private than other transactional systems when the whole premise of bitcoin is a publicly shared ledger.
    - 8y ago

mtgx 8y ago

One of my favorite lines against "I have nothing to hide" is from national security whistleblower, Edward Snowden: “Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.” https://www.goodreads.com/quotes/7308507-arguing-that-you-don-t-care-about-the-right-to-privacy https://www.goodreads.com/quotes/7308507-arguing-that-you-do... But ultimately, the idea that you want privacy because you have something bad to hide is a deeply flawed one, pushed by governments, maybe not necessarily because they are "evil" and want to abuse that power (although that certainly seems a factor to consider lately), but also because pretty much the only times they do want to bypass privacy laws is when they deal with criminals. So that gives them a very narrow view of the issue. When all you have is a hammer, every problem looks like a nail. Privacy is both about "keeping things to yourself" and not wanting others to know everything there is to know about you for no good reason, as well as to protect yourself against potential abuses (from governments, but also criminals, unscrupulous companies, etc) that can't be predicted ahead of time. There are thousands of potential uses for the data, like say using your data to manipulate you with ads during elections, make you buy anti-depressants, make you pay higher insurance, and so on.

yura 8y ago
"Privacy is both about "keeping things to yourself" and not wanting others to know everything there is to know about you for no good reason, as well as to protect yourself against potential abuses (from governments, but also criminals, unscrupulous companies, etc) that can't be predicted ahead of time." Yes. To put it succinctly: I may trust the current government to use this data for (mostly) good, but I don't trust all future governments.
- Bizarro 8y ago
  A "government" is a big abstract entity that is made up of people and procedures. People come and go, and procedures/regulation are changed all the time without direct legislative efforts. You don't have the knowledge to know if you trust "that" government or "another" government. The best solution for all is always be suspicious of concentrated power....especially power that involves state-sanctioned violence against you.

mockingbirdy 8y ago

Using privacy-related software makes it more likely that you'll get specifically targeted for surveillance. [1] Simply visiting this site makes it more likely. [2] For anyone who fears state-level surveillance: Using a VPN or Tor and some privacy plugins isn't enough. Don't assume that you're safe just because of it. In fact, you make yourself identifiable if you rely on such plugins. I won't go into details on how to be able to have privacy that can compete with state-level surveillance, because you'll have to commit crimes to get it. If you think that your government is watching you - don't trust these simple instructions. It's way harder. Some people had to die because of this. Many (authoritarian) governments don't let you use a VPN without putting you on a watch list. If you try to keep a low profile, you need other measures. False sense of security can be dangerous in some countries. I hope that those who need this (a fraction of those who read it) keep themselves safe. edit: I think they should clearly state that this tutorial isn't suited for individuals who are in great danger w.r.t surveillance. It's for people who are interested in privacy, not for people in life-or-death situations. [1]: https://www.cnet.com/news/nsa-likely-targets-anybody-whos-tor-curious/ https://www.cnet.com/news/nsa-likely-targets-anybody-whos-to... [2]: https://www.makeuseof.com/tag/interest-privacy-will-ensure-youre-targeted-nsa/ https://www.makeuseof.com/tag/interest-privacy-will-ensure-y...

throwaway654654 8y ago
this is exactly right. the modern surveillance state (both government and corporate) is opt-out but the economic incentives are tuned to make sure that only a very few people opt-out, which then makes it easy to target and focus all of the resources on those people. if you are serious about security don't use digital devices at all. if you are willing to accept some security risk in exchange for using digital devices then you are best off using some obscure back channel, not some high tech "theoretically unbreakable" crypto. security by obscurity is, ironically, the only thing that actually works (until you get caught), even though in theory it is the worst. every crypto scheme is trivially broken by state level actors.
commandlinefan 8y ago
> Using privacy-related software makes it more likely that you'll get specifically targeted for surveillance. Which is a good reason for people who specifically don't have anything to hide to start using them - if you're not signal, you can't help out by being noise.

kawanu 8y ago

> Brave > privacy You are aware Brave is Chromium based and as thus can be fingerprinted as easily as Google Chrome? Listing it on a "privacy" list is a literal troll. Or simply a paid actor which wouldn't surprise me seeing how butthurt Mr. Eich must have been about the Mozilla story. And no the little font size 3 checkmark you have to hover over does not help contrary it only adds to the distrust. If it would have been as big as the header and inside the header that would make it trustable.

yjftsjthsd-h 8y ago
That doesn't necessarily follow. I don't know specifically what fingerprinting works against Blink, but as an extreme example consider that the chromium-based browser could easily enact the policy of only allowing first-party scripts to execute by default. I suspect that there's a lot more obvious API service to remove or protect that the browser can customize, as well.
- kawanu 8y ago
  You are aware most sites nowdays first party the scripts? So if you block them you block the website itself. Congratulations. Also it still doesn't explain why they would add Brave and then a small little 2px checkmark that you have to hover over explaining that Brave is "experimental" aka placebo honeypot
kawanu 8y ago
> Downvoting me without even trying to argue Yes Brave is just Mr. Eich being frustrated with his life and paying the privacytools guys and paying people to post pro Brave propaganda and downvote everything contrary to it.
- sctb 8y ago
  > Yes Brave is just Mr. Eich being frustrated with his life... Who can argue with vacuous conjurations like that? “That doesn't necessarily follow.” is the most charitable response you can expect.

ptero 8y ago

This is a great overview and a list of useful tools and technologies. Kudos to the author! However, I am afraid that using those tools to protect your own privacy is at best a temporary band-aid as long as the current trend of accepting more and more backdoors into our personal lives persists. To change this a significant portion of people need to see the government not as the main savior from terrorism (poverty, disease, crime, etc.) but as a big bureaucracy where a lot of clerks care more about their paycheck than the end results of their day's work (which is fine). And a large portion of public servants who do care, care more about their career, power and perception than about people who chose them to govern (which is bad). This view change, if it ever happens, should force government to justify their actions and pay more attention to real issues (poverty, crime, disease, terrorism) and less to scare tactics. A used car salesman can provide a useful service -- knowing that a customer suspects him to be a swindler forces him into a partial honesty. That said, I am not optimistic that this view change will happen soon.

ignoramous 8y ago
You'd find that a single Firefox addon uMatrix itself takes you a long way AFA as privacy is concerned (and breaks websites, too, unfortunately). You need to start somewhere.

skilled 8y ago

I am impressed with the amount of detail this page has, wonderful job by the author!

walterbell 8y ago

Brave (based on Chrome, minus Google tracking) includes optional Tor in private tabs, anti-tracking and ad blocking. By making Tor accessible to all users of Brave, it makes Tor users slightly less of an anomaly. Brave has also added capacity to the Tor network.

Forbo 8y ago
Brave users of Tor tabs have a different fingerprint than users of the normal Tor browser. Having a larger anonymity set may be preferable for some people's threat model.
- number-sequence 8y ago
  Is there data out on the number of users of Brave compared to Tor?
  - jemas54 8y ago
    Setting aside all the privacy risks associated by using a Webkit/Blink based Browser, using Tor inside Brave is like someone with a mask screaming "HERE I AM". Even though they have a mask on everybody sees you and hears you and your mask looks different to everybody elses so what's the point of the mask after all? The mask only works if everyone is wearing the exact same mask. Which is the exact opposite of what Brave is doing.
- walterbell 8y ago
  Alternately, being part of "people who don't download Tor browser" could be useful in some scenarios.
  - jemas54 8y ago
    If you are among "did not download Tor browser" but are among "produces Tor web traffic without downloading Tor browser" you are easier to identify than if you were among "Downloaded Tor browser and produces Tor (web) traffic". This would make you either more suspicious or your adversary (justifiedly) think you are an idiot.

Maximus9000 8y ago

Are those password managers listed really "better" than 1Password or lastpass? If so, why? Shouldn't I want to pay money for my password manager?

Forbo 8y ago
> Shouldn't I want to pay money for my password manager? The same argument can be made for any software. This horse has been beaten many times already, and I don't think we really want another open vs. closed source flamewar....
iotku 8y ago
>Are those password managers listed really "better" than onepass or lastpass? If so, why? The main point seems to be that they're either local or able to be self hosted. In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database. Encryption could be potentially worse than the more commercial offering if implemented wrong, but you can also restrict access better to local/self-hosted databases. >Shouldn't, I want to pay money for my password manager? Not if it's unnecessary to do so, and it also adds a paper trail relating your account to your passwords etc should they be compromised. Personally that's pretty far out of my threat model, but I still have my password DB locally because I figure if someone compromises my computer they'll get my passwords anyways (keyloggers, etc), but at least an online service I have no control of wont get compromised and affect me. Only real difficulty with local keepass databases is keeping them synced/up to date on my devices.
- xvector 8y ago
  > In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database. Could they really, though? 1Password, for example, extensively details their client-side encryption protocol. Unless they were forced to distribute a compromised client, there's really no downside to using it.
  - 8y ago

tptacek 8y ago

Why is it not recommended to choose a US-based service? This is extraordinarily, almost axiomatically bad advice. The USG has an NSL process for obtaining information from US-based service providers. It has no process whatsoever for obtaining it from foreign providers. It can simply do it. We have the largest, best-funded signals intelligence agency in the world, and literally the only place in the world you have any procedural, legal defenses against them is here. I'm not being normative. You don't have to like this state of affairs. But it is the reality in which we live, and signing up with a European privacy service won't keep your data out of the hands of US surveillance if they want it. I think jurisdiction is the wrong question. The most important question to be asking about a service provide is "what information do they collect and retain about me". Sometimes these comparisons are hard to make from the outside, but other times you can make inferences just based on the features they offer and the protocols they use.

ar-jan 8y ago
But they at least have to make the effort to break into those systems. Presumably this takes more time/money than an NSL, and it possibly leads to detection of the vulnerabilities used in the hack.
chopin 8y ago
NSL's obtain data legally, whereas other methods are illegal (at least in most countries), and surely not well received when detected. In the latter case the hole will be closed. For me legality matters as well.
- pvg 8y ago
  Law enforcement agencies in Europe cooperate extensively and legally with US ones. Just recently in the news - https://www.dutchnews.nl/news/2019/01/the-netherlands-tapped-el-chapo-phones-for-fbi-due-to-relaxed-privacy-laws/ https://www.dutchnews.nl/news/2019/01/the-netherlands-tapped... This is El Chapo getting burned by this exact bad advice, among other things.
- tptacek 8y ago
  It is not meaningfully "illegal" for NSA to hack and continuously monitor a foreign information service. It is in fact half of NSA's charter to do exactly that. We spend untold billions of dollars every year making sure that happens. The legality doesn't matter at all; you get "legal" protection from the NSA only to the extent you use a service hosted in the US. Again: I don't think this is a good reason to pick US services. I think jurisdiction is simply of no use whatsoever in picking.

ericcholis 8y ago

A nice resource, but I think the links on the page should all open into a new tab. Reading through and clicking a link takes me away from the page, I'd rather that the links open in a new tab for later.

freeflight 8y ago
Clicking a link with the middle mouse button opens it in a new tab, at least on Chrome.

holri 8y ago

Isn't it bizarre that a privacy tools website uses Google Maps instead of Openstreetmap?

jesterson 8y ago
Yeah, good point actually

bungie4 8y ago

The only way to win the game is not to play.

yange 8y ago

Many file formats record creation timestamps, like in image, document, video, audio, executable, archive, and so on. If you create these formats and send the file to others, they would at least know when you created the file. Sometimes they even include timezone info, so they can even know something about your geo location. This applies to network protocols, application communications, database records and so on. Even Git will record your timestamp and timezone info for every commit, and it's very difficult to completely change or remove these info. You might think it's a trivial thing, but it actually tells a lot about you. If someone can trace your activities through time, it's essentially a detailed profile of you, and they can learn how you live and work. Sometimes it can even be used to de-anonymize you by cross referencing with your "real" online identity. In general it's impractical for users to fully understand what kinds of meta data were included in each file format or send by each application. EXIF data is often included in image files generated by cameras or image editing software. Your full file path to a source code file may be included in the executable you compiled, and it may leak your personal information. Your operating system may send regular health report to its company. A proxy service may append your real IP address in HTTP headers. Even for some encrypted services, they don't encrypt or sign everything. Like 1Password in the past didn't encrypt the URLs of your saved login sites. TLS 1.2 doesn't sign the cipher suites. TLS 1.3 doesn't encrypt client certificate. Most of these software and protocols were not designed with privacy as a primary concern. Even they do, there are info that they decided to be okay to leak. However, it should be up to the users to decide whether the design decisions were reasonable for their own use case. Even many of these meta data leak seem like targeted surveillance, it's actually scalable and can be adapted to mass surveillance.