5 ms·

I recommend multiple layers. Why? Because some devices/apps will circumvent one of these layers one way or another. I use Pi-Hole plus WireGuard to route all m

by Fnoord 7y ago

I recommend multiple layers. Why? Because some devices/apps will circumvent one of these layers one way or another. I use Pi-Hole plus WireGuard to route all my devices through my home broadband connection (so even on a hotel/train WiFi, when on LTE, etc). I forward it to Unbound which uses DNSSEC and DNSCrypt. I'm using an EdgeRouter Lite for that purpose. It does add a little bit of latency, but I don't mind, as it also increases my privacy on the insecure link. It also works on say a smart TV or an official Android device (I use a rooted Android device with microG which doesn't implement GAds). My partner sees barely any ads at home due to this setup (I did not bother to setup WireGuard on her smartphone as of yet). On each individual client device I also use a layer 7 firewall ("personal firewall"). On macOS I use Little Snitch and LuLu. On Linux I use OpenSnitch. I don't use Windows, but if I would I'd at least remove all the tracking stuff (for example with O&O ShutUp). On Android, I don't use a layer 7 firewall which is my bad. For browser, on every OS I use a configured Firefox (which I did NOT document; my bad!) with a bunch of addons. uBlock Origin (mainly to manually block "you are blocking ads" notices). I use uMatrix, Cookie AutoDelete, Smart Referer, Privacy Badger, Decentraleyes, HTTPS Everywhere, containers for Amazon/Facebook/Google (would like to add Microsoft), CanvasBlocker, Tracking Token Stripper, Forget Me Not, Terms of Service; Didn’t Read, and Buster: Captcha Solver for Humans. uMatrix will break the web. However it is more user-friendly than NoScript ever was. You are going to have to configure such. For websites you regularly use, you can save the temporary changes, or just not use such bloated websites. Also, I recommend the addon Dark Reader and the feature Reader Mode. To test your setup on your browser, try ipleak.net. One of the things I configured in Firefox, is to disable WebRTC. I don't use an addon for that.

johnnycab 7y ago
It is a fairly good cross-platform list; would definitely recommend O&O Shutup 10 (Windows) - disables Telemetry and other intrusive features. Also, changing to DoH (Cloudflare) and enabling ESNI in Firefox is a good measure. I did not know about Buster, tried it with the reCAPTCHA demo; it works intermittently, which is better than nothing at all. Although I have a add-on for WebRTC, it would seem that the latest version of Firefox sets the attribute to false by default. media.peerconnection.enabled
drexlspivey 7y ago
I wrote a guide for the Pihole + Wireguard setup for anyone interested to try it https://drexl.me/guides/wireguard-pihole-vpn-setup.html https://drexl.me/guides/wireguard-pihole-vpn-setup.html
- ignoramous 7y ago
  Great guide. May I suggest: 1. Sending a pull-request to the official pi-hole project wiki to get this added to their docs? 2. Adding a small nugget about running just the DNS traffic through the VPN instead of all of it. It is a one-line config, IIRC.
ziddoap 7y ago
Be wary of too many. Your combination of extensions is likely quite unique and finger-printable.
- Fnoord 7y ago
  AFAIK Firefox does not share the extensions it uses; Chrome does. Using these tools [1] [2] [3] suggest I'm most profileable by the fact I use macOS. Which I can hide in the useragent string, but is then still detected. [1] https://ipleak.net https://ipleak.net [2] https://panopticlick.eff.org https://panopticlick.eff.org [3] https://amiunique.org https://amiunique.org
  - ziddoap 7y ago
    It's been awhile since I looked into it. From the last study I know on the topic [1]: It is much easier to fingerprint Chrome, however Firefox is susceptible to extension fingerprinting techniques. To be fair, these techniques may have been addressed since publishing - I haven't checked. It may or may not be worth considering depending on your threat model. There may also be novel techniques published since. Edit: It looks like amiunique is detecting extensions with Plugin Detector [2] which claims to work on Firefox, and at the very least can detect Adblock (per amiunique). [1]https://www.cse.chalmers.se/~andrei/codaspy17.pdf https://www.cse.chalmers.se/~andrei/codaspy17.pdf [2]http://www.pinlady.net/PluginDetect/ http://www.pinlady.net/PluginDetect/
    - rasz 7y ago
      [2] detects plugins, not extensions
    - Fnoord 7y ago
      The threat model is, IMO, pretty clearly defined. If the threat is 3 letter agencies, we'd be trying to fingerprint Tor Browser, and we'd be using Tor (with 2 use cases: one on *.onion only, other one on clearnet via exit nodes). So what we are trying to defend from, is fingerprinting by commercial entities such as FAANG. I don't use any special plugins; only the default ones (which are a practical, necessary evil). If I were to remove/disable the default plugins, that'd increase my fingerprint. I've been trying to let websites tell me which extensions I use in Firefox (remember we are using Quantum since Firefox 57, released in November 2017 which changed the way extensions work). The paper is from CODASPY’17, March 22-24, 2017. I haven't been able to reproduce detection of extensions. Keep in mind also, that I use some precautions. I block canvas via CanvasBlocker. I block Javascript via uMatrix. I even block domains via DNS (Pi-Hole) and uBlock Origin. If I want to be tracked less easily I'd need to not browse fullscreen, I'd need to not use a native Mac browser but run a Windows or Linux VM or a remote SSH connection (which, quite frankly, is quite possible in a terminal these days as per Browsh [1]), and I'd need to use only the default fonts (because I am using specific fonts in ~/Library/Fonts). Some of these fonts there are temporarily or backup fonts. I will remove these to a temporary directory, and load them ad-hoc. [1] https://www.brow.sh https://www.brow.sh
DavideNL 7y ago
Fun fact: i just found out that in Little Snitch, blocking a 'hostname' or 'domain', does NOT block the IP address this resolves to. Very weird. This is done, apparently, because sometimes multiple domains are hosted on the same server/ip. This way you can block only 1 of those domains and not the entire server. So, a good way for apps to circumvent common blocklists for trackers/ads, is to fall back/connect to a hard coded IP address if connecting to the domain doesn't work... It would be good if Little Snitch would have an option to disable this behaviour for specific blocklists.

by Fnoord 7y ago

johnnycab 7y ago

It is a fairly good cross-platform list; would definitely recommend O&O Shutup 10 (Windows) - disables Telemetry and other intrusive features. Also, changing to DoH (Cloudflare) and enabling ESNI in Firefox is a good measure. I did not know about Buster, tried it with the reCAPTCHA demo; it works intermittently, which is better than nothing at all. Although I have a add-on for WebRTC, it would seem that the latest version of Firefox sets the attribute to false by default. media.peerconnection.enabled

drexlspivey 7y ago

I wrote a guide for the Pihole + Wireguard setup for anyone interested to try it https://drexl.me/guides/wireguard-pihole-vpn-setup.html https://drexl.me/guides/wireguard-pihole-vpn-setup.html

ignoramous 7y ago
Great guide. May I suggest: 1. Sending a pull-request to the official pi-hole project wiki to get this added to their docs? 2. Adding a small nugget about running just the DNS traffic through the VPN instead of all of it. It is a one-line config, IIRC.

ziddoap 7y ago

Be wary of too many. Your combination of extensions is likely quite unique and finger-printable.

Fnoord 7y ago
AFAIK Firefox does not share the extensions it uses; Chrome does. Using these tools [1] [2] [3] suggest I'm most profileable by the fact I use macOS. Which I can hide in the useragent string, but is then still detected. [1] https://ipleak.net https://ipleak.net [2] https://panopticlick.eff.org https://panopticlick.eff.org [3] https://amiunique.org https://amiunique.org
- ziddoap 7y ago
  It's been awhile since I looked into it. From the last study I know on the topic [1]: It is much easier to fingerprint Chrome, however Firefox is susceptible to extension fingerprinting techniques. To be fair, these techniques may have been addressed since publishing - I haven't checked. It may or may not be worth considering depending on your threat model. There may also be novel techniques published since. Edit: It looks like amiunique is detecting extensions with Plugin Detector [2] which claims to work on Firefox, and at the very least can detect Adblock (per amiunique). [1]https://www.cse.chalmers.se/~andrei/codaspy17.pdf https://www.cse.chalmers.se/~andrei/codaspy17.pdf [2]http://www.pinlady.net/PluginDetect/ http://www.pinlady.net/PluginDetect/
  - rasz 7y ago
    [2] detects plugins, not extensions
  - Fnoord 7y ago
    The threat model is, IMO, pretty clearly defined. If the threat is 3 letter agencies, we'd be trying to fingerprint Tor Browser, and we'd be using Tor (with 2 use cases: one on *.onion only, other one on clearnet via exit nodes). So what we are trying to defend from, is fingerprinting by commercial entities such as FAANG. I don't use any special plugins; only the default ones (which are a practical, necessary evil). If I were to remove/disable the default plugins, that'd increase my fingerprint. I've been trying to let websites tell me which extensions I use in Firefox (remember we are using Quantum since Firefox 57, released in November 2017 which changed the way extensions work). The paper is from CODASPY’17, March 22-24, 2017. I haven't been able to reproduce detection of extensions. Keep in mind also, that I use some precautions. I block canvas via CanvasBlocker. I block Javascript via uMatrix. I even block domains via DNS (Pi-Hole) and uBlock Origin. If I want to be tracked less easily I'd need to not browse fullscreen, I'd need to not use a native Mac browser but run a Windows or Linux VM or a remote SSH connection (which, quite frankly, is quite possible in a terminal these days as per Browsh [1]), and I'd need to use only the default fonts (because I am using specific fonts in ~/Library/Fonts). Some of these fonts there are temporarily or backup fonts. I will remove these to a temporary directory, and load them ad-hoc. [1] https://www.brow.sh https://www.brow.sh

DavideNL 7y ago

Fun fact: i just found out that in Little Snitch, blocking a 'hostname' or 'domain', does NOT block the IP address this resolves to. Very weird. This is done, apparently, because sometimes multiple domains are hosted on the same server/ip. This way you can block only 1 of those domains and not the entire server. So, a good way for apps to circumvent common blocklists for trackers/ads, is to fall back/connect to a hard coded IP address if connecting to the domain doesn't work... It would be good if Little Snitch would have an option to disable this behaviour for specific blocklists.