5 ms·

Steps For Better Online Privacy

69 points by Sami_Lehtinen 6y ago

stekern 6y ago
> Soltani says he rarely recommends steps such as using ad blockers or VPNs for most people. They require too much attention and persistence to deliver on privacy, and even then they are limited in their effectiveness. Decent article, but a bit light on easy-to-use, practical details. They seem to make the case that ad-blockers are ineffective and too much of a hassle, but that's not my experience at all. I agree that tracking and privacy is a cat-and-mouse game, but I think ad-blocking currently is one of the easiest and most effective ways to block trackers. I installed uBlock Origin on my family's computers a couple of years back, and it has Just Worked™. The next logical step would probably be PiHole or NextDNS for deeper blocking than some browser ad-blockers, as well as for blocking outside of a browser. I have DoT set up on my router and most off my portable devices, and there haven't been any hiccups yet. All bets are off once tracking is implemented server-side though. The way GDPR currently has been enforced has led to a lot of bad practices by the tech industry, so we'll probably need new laws that regulate data gathering.
sneak 6y ago
This article is woefully short on actionable tips that aren’t already common knowledge. Some better ones: - uBlock Origin - Cookie Autodelete - a VPN
- 082349872349872 6y ago
  Snowden was in, what, 2013? Better late than never. (tim efa pash natim) Bonus watchlisting: https://en.wikipedia.org/wiki/IBM_7950_Harvest https://en.wikipedia.org/wiki/IBM_7950_Harvest Privyet ucbvax!decvax!mcvax!moskvax!kremvax!chernenko, kak dela?
- vector_spaces 6y ago
  Please for the love of Jobe stop giving people the advice to use a VPN without qualification A VPN won't stop you from being tracked online, and using a non-self-hosted VPN is a very, very bad idea if "not being tracked online" is something you care about.
  - sneak 6y ago
    VPNs help a lot in obscuring your physical location. Most people seem to forget that an IP is a coarse location. A VPN plus regularly deleting most/all cookies actually prevents most of the common and pervasive tracking online.
    - randomchars 6y ago
      It also gives access to all that tracking data to a single company who in turn ma - sell your data now - sell your data when they get acquired - get hacked - give your data to a government that would normally not have access to it
      - sneak 6y ago
        No, it doesn’t. The majority of traffic is TLS encrypted these days.
        vector_spaces 6y ago
        TLS won't cloak your IP address nor your browsing history from the VPN provider... so, even if the content is TLS encrypted, your VPN provider has to that metadata (+ more) across all sites you visit while connected to their servers. which they can then turn over to law enforcement on request[1], or leave on an unsecured S3 bucket (or similar) somewhere[2]. So yeah, in short, we shouldn't be recommending the use of third-party VPNs without qualification. There are valid use cases sometimes, but avoiding tracking is very much not one of them. [1] https://securitygladiators.com/fbi-purevpn/ https://securitygladiators.com/fbi-purevpn/ [2] https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leaked-their-logs-the-logs-that-didnt-exist/ https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leak...
      - novok 6y ago
        Today, your ISP is probably doing all of that now, with a real billing address & identity. Your ISP is your default VPN. For example comcast sells traffic data to marketing firms. And because they sell that data to adtech, private investigators, the govt and creeps can also buy the traffic log to whatever is in your house. At least with VPN services, you can change it easily AND you can make it all they know about you is a coarse IP set via paying cash (see mulvad) vs. a fucking billing address. And changing VPNs is a lot less work and has far more options than changing your ISP.
- moepstar 6y ago
  Don't forget something like Pi-hole - every device on your network benefits from blocking ads!
- toper-centage 6y ago
  Unfortunately not on mobile, but I'll add to you list Firefox Containers, and Self destructing cookies (use only the open source one!). In mobile I use Firefox focus as my default browser. These techniques mean that for most websites you'll look like a new user each time
gingerlime 6y ago
a bit ironic to be greeted with this note (at least in the EU): > By choosing “I agree” below, you agree that NPR’s sites use cookies, similar tracking and storage technologies, and information about the device you use to access our sites to enhance your viewing, listening and user experience, personalize content, personalize messages from NPR’s sponsors, provide social media features, and analyze NPR’s traffic. This information is shared with social media services, sponsorship, analytics and other third-party service providers. EDIT: to be fair to NPR at least they offer a plaintext alternative. You don’t see it much with other websites.
syntaxing 6y ago
I just set up pihole recently and it blows my mind how almost 15% of requests are trackers/garbage. I highly recommend setting one up and donating to them if possible. You can always use balena if you're not tech savvy enough [1]. The easiest solution is to use AdGuards DNS that has most of these blocked for you [2]. [1] https://www.balena.io/blog/deploy-network-wide-ad-blocking-with-pi-hole-and-a-raspberry-pi/ https://www.balena.io/blog/deploy-network-wide-ad-blocking-w... [2] https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- cgb223 6y ago
  I’ve been thinking about doing this as a weekend project. Does the hardware limitations of the pi mess with download or upload speeds at all? Any weird sites that don’t work with it running? How much better is it than something like ublock origin?
  - syntaxing 6y ago
    It's just a self hosted DNS so there shouldn't be any speed reduction (goes straight to Google's DNS if it's not blocked). It very different from ublock origin that reads the html directly from the website. Since it's DNS based, it's not perfect hence why they recommend using pihole + ublock origin. The nice thing about it is that it blocks most ads pretty well (even on your phone) without breaking anything if you use the right host list, and blocks all the telemetry network wide (if you change the DNS on the router).
    - cgb223 6y ago
      Do you have to use Google’s DNS? I’m currently trying to phase off my dependence on them. Gotta wonder what kind of ad tracking/targeting they do based on DNS lookups you send them
      - luc79 6y ago
        You can configure any DNS server you like
ferros 6y ago
This all feels like you’re getting a false sense of security. Great, you are reducing your footprint but what remains is undeniably vast.
- 082349872349872 6y ago
  We have an article in our constitution (ca. 1999?): > "Every person has the right to privacy in their private and family life and in their home, and in relation to their mail and telecommunications." > "Every person has the right to be protected against the misuse of their personal data." If yours doesn't already have one, I'd recommend the addition.
  - slimsag 6y ago
    Serious question, not trying to be snide, but aren't all the American companies tracking Swiss citizens anyway? Or is there some strong enforcement I am missing
    - 082349872349872 6y ago
      Exactly the selfish reason why I recommend the practice be more widespread :-) The trick to bootstrapping is to start with either a scratch chicken or a scratch egg. (not that there's much hope of the particular case you mention. The most recent amendment proposal to the US constitution that has actually been ratified dates from 1971: https://en.wikipedia.org/wiki/Twenty-sixth_Amendment_to_the_United_States_Constitution https://en.wikipedia.org/wiki/Twenty-sixth_Amendment_to_the_... ) Bonus image: https://c8.alamy.com/comp/ERH50D/the-adventures-of-baron-munchausen-illlustrated-by-alphonse-adolphe-ERH50D.jpg https://c8.alamy.com/comp/ERH50D/the-adventures-of-baron-mun...
- commoner 6y ago
  The article recommends basic security and privacy precautions, such as using strong passwords, being aware of phishing scams, and avoiding apps with excessive permissions. The article's slight against ad blockers is a mistake, since uBlock Origin on default settings is both effective and low-maintenance. Besides this, most of the recommendations seem like good suggestions for everyone, even if following them isn't enough to prevent all types of tracking.
nicbou 6y ago
My advice: install Firefox on your mobile device. I took way too long to get a mobile browser with an ad and cookie notice blocker. It also lets you block third party cookies. Pihole is also nice, but my router won't let me set it as the default DNS. Neither will my Chromecast.
- Dahoon 6y ago
  With a better router you can reroute Chromecast DNS requests. I'm aware many can't switch router though.
- BLKNSLVR 6y ago
  My network is setup so that all DNS requests are redirected to my Pihole. Understandably, if you can't even change your router settings then this probably isn't possible. I'd consider putting another router in front of the non-configurable router in order to give yourself and control of your own network (or, preferably, replace non-configurable router altogether).
- FreshFries 6y ago
  Your router most likely will allow you to set ITS DNS to your local PiHole. So the DHCP will hand out your home router's IP as DNS server, but that in turn will access the PiHole as DNS server. Your chromecast will NOT use your DHCP supplied DNS settings, it goes straight to google's.
thow2010190934 6y ago
I think this is a good place to talk about the fact that all U.S.-based technology companies have to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act This, with the huge amount of tracking from most tech companies means that the U.S. government basically can get almost unlimited information about anyone, wherever they are. Kinda scary if you ask me. Then again, after the Snowden revelations, this doesn't surprise me.
billysielu 6y ago
A site about privacy with a cookie approval wall. Couldn't make it up.
cesarosum 6y ago
To point 3 - Protect what matters most - please do check out Peergos (https://peergos.org https://peergos.org). We provide private and secure online storage that collects no metadata and is not dependent on DNS or TLS. Disclaimer: I am one of the Peergos devs.
blunte 6y ago
Most users can't or won't be bothered to take hardly any steps to improve their security or privacy. Only after they lose control of their email or bank account (or lose an entire physical device) do they confess to having followed none of the recommended prevention measures. Granted, it really is a drag and a time cost to try to follow good practices. I hate the extra password manager and authy steps on my phone when I'm in a hurry. It can be a real challenge to juggle apps and find your way back to the app which you are logging in on (twice or three times! - copying username from bitwarden, switching back to paste it in the username only page of the app, then repeating to do the password, and then finally switching to authy for the 2fa and back). No typical user is going to suffer this in the name of security. Some fundamental changes need to be made to devices, UIs, apps, and even legislation to improve this. Cookie popups are not the answer (especially when the pop-up is so large that it doesn't even fit entirely in the visible area of my giant phone).
- ignoramous 6y ago
  > Most users can't or won't be bothered to take hardly any steps to improve their security or privacy. An anti-virus was the first thing anyone installed on their PCs in the 2000s. I think we would soon see a similar trend for Mobile devices. Woefully enough, a lot of anti-virus vendors instead are now among some of the worst offenders in terms of not respecting their user's privacy. Their privacy policies are a stuff of nightmares.
Ecstatify 6y ago
Setup PiHole on a Raspberry Pi a day ago. It’s blocked so far 4800/20000 queries to the internet. Until I had PiHole I didn’t realise how prevalent tracking was. With the correct router that allows you to configure the DNS you can protect all the devices connected on your network without any other configuration, otherwise you have to configure in the individual devices. Great for mobiles and TVs where you can’t add an ad blocker. https://pi-hole.net/ https://pi-hole.net/ Definitely giving these guys a donation, doing the lords work
tjpnz 6y ago
Turning off ad personalisation requires you operate under the assumption that the ad companies can be trusted. If you're actually concerned about your privacy (and security) you should at the very least install uBlock Origin. After suggesting that to family members the amount of "tech support" I need to do each year went down substantially.

69 points by Sami_Lehtinen 6y ago

> Soltani says he rarely recommends steps such as using ad blockers or VPNs for most people. They require too much attention and persistence to deliver on privacy, and even then they are limited in their effectiveness. Decent article, but a bit light on easy-to-use, practical details. They seem to make the case that ad-blockers are ineffective and too much of a hassle, but that's not my experience at all. I agree that tracking and privacy is a cat-and-mouse game, but I think ad-blocking currently is one of the easiest and most effective ways to block trackers. I installed uBlock Origin on my family's computers a couple of years back, and it has Just Worked™. The next logical step would probably be PiHole or NextDNS for deeper blocking than some browser ad-blockers, as well as for blocking outside of a browser. I have DoT set up on my router and most off my portable devices, and there haven't been any hiccups yet. All bets are off once tracking is implemented server-side though. The way GDPR currently has been enforced has led to a lot of bad practices by the tech industry, so we'll probably need new laws that regulate data gathering.

sneak 6y ago

This article is woefully short on actionable tips that aren’t already common knowledge. Some better ones: - uBlock Origin - Cookie Autodelete - a VPN

082349872349872 6y ago
Snowden was in, what, 2013? Better late than never. (tim efa pash natim) Bonus watchlisting: https://en.wikipedia.org/wiki/IBM_7950_Harvest https://en.wikipedia.org/wiki/IBM_7950_Harvest Privyet ucbvax!decvax!mcvax!moskvax!kremvax!chernenko, kak dela?
vector_spaces 6y ago
Please for the love of Jobe stop giving people the advice to use a VPN without qualification A VPN won't stop you from being tracked online, and using a non-self-hosted VPN is a very, very bad idea if "not being tracked online" is something you care about.
- sneak 6y ago
  VPNs help a lot in obscuring your physical location. Most people seem to forget that an IP is a coarse location. A VPN plus regularly deleting most/all cookies actually prevents most of the common and pervasive tracking online.
  - randomchars 6y ago
    It also gives access to all that tracking data to a single company who in turn ma - sell your data now - sell your data when they get acquired - get hacked - give your data to a government that would normally not have access to it
    - sneak 6y ago
      No, it doesn’t. The majority of traffic is TLS encrypted these days.
      - vector_spaces 6y ago
        TLS won't cloak your IP address nor your browsing history from the VPN provider... so, even if the content is TLS encrypted, your VPN provider has to that metadata (+ more) across all sites you visit while connected to their servers. which they can then turn over to law enforcement on request[1], or leave on an unsecured S3 bucket (or similar) somewhere[2]. So yeah, in short, we shouldn't be recommending the use of third-party VPNs without qualification. There are valid use cases sometimes, but avoiding tracking is very much not one of them. [1] https://securitygladiators.com/fbi-purevpn/ https://securitygladiators.com/fbi-purevpn/ [2] https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leaked-their-logs-the-logs-that-didnt-exist/ https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leak...
    - novok 6y ago
      Today, your ISP is probably doing all of that now, with a real billing address & identity. Your ISP is your default VPN. For example comcast sells traffic data to marketing firms. And because they sell that data to adtech, private investigators, the govt and creeps can also buy the traffic log to whatever is in your house. At least with VPN services, you can change it easily AND you can make it all they know about you is a coarse IP set via paying cash (see mulvad) vs. a fucking billing address. And changing VPNs is a lot less work and has far more options than changing your ISP.
moepstar 6y ago
Don't forget something like Pi-hole - every device on your network benefits from blocking ads!
toper-centage 6y ago
Unfortunately not on mobile, but I'll add to you list Firefox Containers, and Self destructing cookies (use only the open source one!). In mobile I use Firefox focus as my default browser. These techniques mean that for most websites you'll look like a new user each time

gingerlime 6y ago

a bit ironic to be greeted with this note (at least in the EU): > By choosing “I agree” below, you agree that NPR’s sites use cookies, similar tracking and storage technologies, and information about the device you use to access our sites to enhance your viewing, listening and user experience, personalize content, personalize messages from NPR’s sponsors, provide social media features, and analyze NPR’s traffic. This information is shared with social media services, sponsorship, analytics and other third-party service providers. EDIT: to be fair to NPR at least they offer a plaintext alternative. You don’t see it much with other websites.

syntaxing 6y ago

I just set up pihole recently and it blows my mind how almost 15% of requests are trackers/garbage. I highly recommend setting one up and donating to them if possible. You can always use balena if you're not tech savvy enough [1]. The easiest solution is to use AdGuards DNS that has most of these blocked for you [2]. [1] https://www.balena.io/blog/deploy-network-wide-ad-blocking-with-pi-hole-and-a-raspberry-pi/ https://www.balena.io/blog/deploy-network-wide-ad-blocking-w... [2] https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html

cgb223 6y ago
I’ve been thinking about doing this as a weekend project. Does the hardware limitations of the pi mess with download or upload speeds at all? Any weird sites that don’t work with it running? How much better is it than something like ublock origin?
- syntaxing 6y ago
  It's just a self hosted DNS so there shouldn't be any speed reduction (goes straight to Google's DNS if it's not blocked). It very different from ublock origin that reads the html directly from the website. Since it's DNS based, it's not perfect hence why they recommend using pihole + ublock origin. The nice thing about it is that it blocks most ads pretty well (even on your phone) without breaking anything if you use the right host list, and blocks all the telemetry network wide (if you change the DNS on the router).
  - cgb223 6y ago
    Do you have to use Google’s DNS? I’m currently trying to phase off my dependence on them. Gotta wonder what kind of ad tracking/targeting they do based on DNS lookups you send them
    - luc79 6y ago
      You can configure any DNS server you like

ferros 6y ago

This all feels like you’re getting a false sense of security. Great, you are reducing your footprint but what remains is undeniably vast.

082349872349872 6y ago
We have an article in our constitution (ca. 1999?): > "Every person has the right to privacy in their private and family life and in their home, and in relation to their mail and telecommunications." > "Every person has the right to be protected against the misuse of their personal data." If yours doesn't already have one, I'd recommend the addition.
- slimsag 6y ago
  Serious question, not trying to be snide, but aren't all the American companies tracking Swiss citizens anyway? Or is there some strong enforcement I am missing
  - 082349872349872 6y ago
    Exactly the selfish reason why I recommend the practice be more widespread :-) The trick to bootstrapping is to start with either a scratch chicken or a scratch egg. (not that there's much hope of the particular case you mention. The most recent amendment proposal to the US constitution that has actually been ratified dates from 1971: https://en.wikipedia.org/wiki/Twenty-sixth_Amendment_to_the_United_States_Constitution https://en.wikipedia.org/wiki/Twenty-sixth_Amendment_to_the_... ) Bonus image: https://c8.alamy.com/comp/ERH50D/the-adventures-of-baron-munchausen-illlustrated-by-alphonse-adolphe-ERH50D.jpg https://c8.alamy.com/comp/ERH50D/the-adventures-of-baron-mun...
commoner 6y ago
The article recommends basic security and privacy precautions, such as using strong passwords, being aware of phishing scams, and avoiding apps with excessive permissions. The article's slight against ad blockers is a mistake, since uBlock Origin on default settings is both effective and low-maintenance. Besides this, most of the recommendations seem like good suggestions for everyone, even if following them isn't enough to prevent all types of tracking.

nicbou 6y ago

My advice: install Firefox on your mobile device. I took way too long to get a mobile browser with an ad and cookie notice blocker. It also lets you block third party cookies. Pihole is also nice, but my router won't let me set it as the default DNS. Neither will my Chromecast.

Dahoon 6y ago
With a better router you can reroute Chromecast DNS requests. I'm aware many can't switch router though.
BLKNSLVR 6y ago
My network is setup so that all DNS requests are redirected to my Pihole. Understandably, if you can't even change your router settings then this probably isn't possible. I'd consider putting another router in front of the non-configurable router in order to give yourself and control of your own network (or, preferably, replace non-configurable router altogether).
FreshFries 6y ago
Your router most likely will allow you to set ITS DNS to your local PiHole. So the DHCP will hand out your home router's IP as DNS server, but that in turn will access the PiHole as DNS server. Your chromecast will NOT use your DHCP supplied DNS settings, it goes straight to google's.

thow2010190934 6y ago

I think this is a good place to talk about the fact that all U.S.-based technology companies have to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act This, with the huge amount of tracking from most tech companies means that the U.S. government basically can get almost unlimited information about anyone, wherever they are. Kinda scary if you ask me. Then again, after the Snowden revelations, this doesn't surprise me.

billysielu 6y ago

A site about privacy with a cookie approval wall. Couldn't make it up.

cesarosum 6y ago

To point 3 - Protect what matters most - please do check out Peergos (https://peergos.org https://peergos.org). We provide private and secure online storage that collects no metadata and is not dependent on DNS or TLS. Disclaimer: I am one of the Peergos devs.

blunte 6y ago

Most users can't or won't be bothered to take hardly any steps to improve their security or privacy. Only after they lose control of their email or bank account (or lose an entire physical device) do they confess to having followed none of the recommended prevention measures. Granted, it really is a drag and a time cost to try to follow good practices. I hate the extra password manager and authy steps on my phone when I'm in a hurry. It can be a real challenge to juggle apps and find your way back to the app which you are logging in on (twice or three times! - copying username from bitwarden, switching back to paste it in the username only page of the app, then repeating to do the password, and then finally switching to authy for the 2fa and back). No typical user is going to suffer this in the name of security. Some fundamental changes need to be made to devices, UIs, apps, and even legislation to improve this. Cookie popups are not the answer (especially when the pop-up is so large that it doesn't even fit entirely in the visible area of my giant phone).

ignoramous 6y ago
> Most users can't or won't be bothered to take hardly any steps to improve their security or privacy. An anti-virus was the first thing anyone installed on their PCs in the 2000s. I think we would soon see a similar trend for Mobile devices. Woefully enough, a lot of anti-virus vendors instead are now among some of the worst offenders in terms of not respecting their user's privacy. Their privacy policies are a stuff of nightmares.

Ecstatify 6y ago

Setup PiHole on a Raspberry Pi a day ago. It’s blocked so far 4800/20000 queries to the internet. Until I had PiHole I didn’t realise how prevalent tracking was. With the correct router that allows you to configure the DNS you can protect all the devices connected on your network without any other configuration, otherwise you have to configure in the individual devices. Great for mobiles and TVs where you can’t add an ad blocker. https://pi-hole.net/ https://pi-hole.net/ Definitely giving these guys a donation, doing the lords work

tjpnz 6y ago

Turning off ad personalisation requires you operate under the assumption that the ad companies can be trusted. If you're actually concerned about your privacy (and security) you should at the very least install uBlock Origin. After suggesting that to family members the amount of "tech support" I need to do each year went down substantially.