Contact me for feedback or questions! I reply to everyone.
There's probably hundreds of guides to Internet privacy
out there now, and most of them are terrible. They recommend browsers from evil companies like Mozilla Firefox; E-mail providers that collect LOTS of your data, such as Mailfence or Runbox; useless or malicious addons like
Privacy Badger or NoScript; communication software that ask for your phone number like Signal or Telegram; suspicious VPNs like Proton; care too much about where a service is hosted instead of
its policies or functionality; fall for false advertising; have "sponsored" recommendations; ignore very good providers and fail to mention essential things that you SHOULD do. My aim here is
to create an ultimate guide which will hopefully not suffer from any of these issues. And the best thing is, you can do everything here for free! Why the
Ninja's guide? Well, they hide in the shadows (archive). And it sounds fucking
cool, doesn't it?
Can't avoid talking about them since that's what all your software runs on in the first place. Obviously, do not use Windows - it spies on almost everything you do (archive) and has auto-updates that cannot be turned off in the Home edition. Apparently some newer updates have allowed to disable some more of the spying, but that still doesn't salvage this system. Even if you disable all of the telemetry, Windows still sends 11 unsolicited requests per minute (archive). Of course Linux has its own problems too - Ubuntu has had spyware issues (archive) in the past, and systemd is pretty much an attempt at a takeover of Linux (archive) by big corporations. The best thing to do here is to use a Linux distribution without systemd, like Salix.
Briefly, most browsers don't care about your privacy or even are actively malicious; many of those that aren't suffer from usability issues like no extension support. Ungoogled-Chromium or IceCat send no unsolicited requests and support add-ons. However they are dependent on the evil giants Google and Mozilla, respectively, so I suggest using a de-spyware'd and addon-hardened Pale Moon - which is independent from those. For more information read this article.
The most important one, offering almost complete control of your browsing, is uMatrix. Decentraleyes is another essential one that works in the background, preventing connections to Content Delivery Networks (that could track you all over the Internet, due to being embedded on so many sites). WebRTC Control is essential for Chrome-based browsers to not leak your real IP through VPN / Tor. More information here.
Most so-called "private" search engines rely on either Google, Bing or Yahoo for results and can be considered compromised by default. Even worse is that many of them are doing their own tracking or have other flaws. The only ones which have their own indexes are Mojeek and Wiby - but both have very weak results. If you don't mind relying on the violators - a good SearX instance is your best bet. More information here.
RiseUp is the best, and it's free - but you need an invite code. It does not require personal information to sign up, has onion domains, supports mail clients and unlimited aliases (allowing you to sign up in many places with different identities), as well as having a great privacy policy. Disroot does not need an invite code, but has no onion domains and a terrible spam filter which blocks legitimate providers; its alias feature is also paid for. From the commercial ones, Posteo is your best bet. Click here for a report which reviews the main players in depth.
Don't venture out without this! But be sure to get a trustworthy one. The only free provider worth its salt is RiseUp. Of course, you can always pay for a good one such as Mullvad - which will provide you with more servers all over the world, allowing you to bypass various blocks and bans. The VPN industry is dirty as fuck, though - so watch out when choosing one. Avoid custom "apps" that rob you of control - stick to WireGuard or OpenVPN. Here's how to configure the latter:
sudo ufw allow out to [IP] port [PORT]. Of course replace IP and PORT with the relevant values. This will let the system connect to the VPN through the firewall.
dev tun. Change the
tunto something recognizable, like
tun_myvpn.
sudo ufw allow in on tun_myvpnand
sudo ufw allow out on tun_myvpn. This will allow both incoming and outgoing connections through the VPN.
sudo ifconfig. Take note if the IP that appears after
inet. This is your local (router) IP.
sudo ufw allow out to [LOCAL_IP]. This will enable actually establishing the VPN connection.
sudo resolvconf -l. Now copy the nameservers and put them into /etc/resolv.conf (
nameserver 172.27.0.1for RiseUp, for example). Without this step, your ISP will still know every site you visit.
chattr +ior putting
nohook resolv.conf wpa_supplicantinto /etc/dhcpcd.conf (my preferred option). This will prevent the system from overwriting your VPN's DNS servers with the ISP's.
sudo ufw allow out to [DNS_IP](you've just typed the addresses into resolv.conf, so just allow all those). Without this step, you would not be able to connect to any domain unless you knew their actual IP address (since we've blocked the ISP's resolver).
sudo ufw default deny incomingand
sudo ufw default deny outgoing. This is the part that actually keeps your shit secure.
/etc/rc.d/rc.local:
This is for Slackware-based distros and might not necessarily work on others. Search around for equivalents.if [ -x /lib/ufw/ufw-init ]; then
/lib/ufw/ufw-init start
fi
That's it for OpenVPN! However, web browsers can also leak your real IP address through WebRTC, so you're going to have to disable that as well. Firefox uses the media.peerconnection.enabled
about:config entry, while Chrome-based browsers need an extension such as WebRTC Control (Pale Moon users do not need to do anything). An
earlier version of this guide suggested turning off IPv6 system-wide, but it doesn't seem to be necessary if you do everything else right. However, some VPNs apparently do leak if you don't do
that, so if yours is one of those, do all these steps just to be safe (earlier version had only step 1, but it seems it's not always sufficient):
net.ipv6.conf.wlan0.disable_ipv6 = 1
se net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
sudo sysctl -pto load the changes (should be valid immediately)
Now run your VPN with a command such as cd /etc/openvpn; sudo openvpn [vpn_config_file.conf]. Then visit https://ipleak.net to check for leaks. A leakless result for RiseUp VPN, for example, would look like this.
Keep in mind you're still relying on trust for any VPN you use - theoretically they could choose to spy on you if they wanted to - but eventually, you'd think that information would come out (and has for some VPNs). Still, they are way superior to barebacking your ISP - who has your real name and address, stores all your logs, and will almost certainly work with the police. In case you don't think VPNs are enough - there fortunately are ways to improve your privacy even further:
A network that allows (relatively) anonymous web browsing - read the first section of my article if you want to know more (but don't get discouraged - it is still useful). First, find the Tor package in Gslapt and install it. The default configuration requires a separate user for running it - so let's create it. If using Salix XFCE, click the Salix button at the lower left corner and go to System > Users and Groups (other distros should have similar tools). Click the Manage groups button, then Add, and type tor in Group name. Now that you've added the tor group - time to create the tor user and add him to that group. Close the Groups menu and click Add. Type tor in the Username field and anything you want as his Real Name. Now switch to the Groups tab and choose tor as his main group. Click OK and you're done here. Now type these commands into the terminal: sudo chown -R tor /var/log/tor, then sudo chown tor /var/lib/tor. This will make the newly created user the owner of some directories Tor requires, so that he has the permissions to use them.
Now the fun part - setting up your web browser to use the network. In Pale Moon, go to Tools -> Preferences -> Advanced -> Network -> Settings. Choose Manual proxy configuration
and
- in the SOCKS Host
field - type 127.0.0.1
as the server and 9050
for the port. There is no need for the Use proxy to perform DNS queries
option, since we'll
be setting up TorDNS system-wide anyway; but do mark SOCKS5 instead of 4. Now you will automatically visit all clearnet sites through the Tor network. You can also add the Proxy Privacy Ruler extension on top of this config so that Tor is enabled only for Private Windows or certain domains. Either way - since Tor resolves onions
through its own DNS - you need to enable that functionality to connect to those. First, add these two lines at the end of your /etc/tor/torrc
file:
DNSport 53
AutomapHostsOnResolve 1
Then, put this line: nameserver 127.0.0.1
into your /etc/resolv.conf
to use Tor as the DNS resolver. Without this, .onion domains would simply fail to resolve, since a
regular DNS server does not "understand" them. Now, the Tor network is not limited to web browsing - any application that has proxy settings (for example, instant messengers
or feed readers) can be configured to use it. Even if they don't, a tool called proxychains-ng
can get around that. Just install it from your repository (most distros should have it)
and run it from the terminal like this: proxychains4 filezilla
(replace filezilla with the program you want to launch). For extra protection, pair your Tor network with the
VPN you've configured earlier. Compared to Tor alone, this setup has the advantage of still keeping your real IP hidden in case of a Tor leak or just an application that doesn't
support it (anything that uses UDP). Also, read my Avoiding "The Botnet" - impossible? article before getting too confident about either VPNs or Tor (in fact
anything you do electronically or even IRL).
XMPP + OMEMO encryption is the gold standard. Newfangled shit keeps coming out, but it is still the best. PSI, Dino, Pidgin (weak implementation), Gajim and Conversations are some of the clients that support it. Don't use Signal or Telegram (despite their sustained shilling) - they ask for your freaking phone number! Discord is even worse. WhatsApp is owned by Facebook - enough said. Skype works directly with the Prism program and used to redirect Chinese people to a modified version, which allowed the Chinese government to implement censorship and surveillance. XMPP is decentralized - anyone can run a server, so you should choose one with good privacy such as RiseUp (insider info - they seem to be planning to deprecate it), Snopyta or Autistici (which you get if you sign up for their E-mail account). Don't skip out on the encryption even if you're using secure software and server! That's the main takeaway here.
Get into the habit of storing everything locally! And make fucking backups, holy shit - don't be the clown who loses everything because of malware, hardware failure, theft,
or whatever. All you need is a spare USB drive or SD card. Anyway, I've researched most of the available free cloud storage providers and they either require your private data like name or
phone number, don't support the English language, pretend to be free but are actually paid, or have other issues. Disroot is the only one with a passable grade - but Nextcloud is bloated and
they will also delete your whole account if you upload something they think is against their ToS (unless you remove the offending file in 24 hours). If you do decide to use
such services anyway, remember that you can password protect your files (for example, with the command gpg -c terrorism_manual.pdf
) from the admins or other snoops,
and still share them with the people you want to.
AKA the famous pastebin. Deep Paste (onion only) is the best - simple, with no JS requirement; supports public, private and self-destructing pastes - and doesn't delete anything. Snopyta's service (onion), or some other PrivateBin, is another option but requires JS (though you do get more features, including password protection and encryption - but anyone who knows the link can decrypt). Don't use Ghostbin (uses cloudflare, no privacy policy), 0bin (admits they don't care about protecting your uploads), or pastebin (the worst - stores your IP and other data, is not encrypted, admits to censorship [archive], uses Google Analytics and has targeted advertisements).
Coinsh (onion) is the only good one - No data will be recorded on who inserts what coin-- all I'll get is
a timestamp.
Doesn't require JavaScript, and is also integrated with IPFS (this means that the image will never go down as long as enough people are viewing it - similar
to what Freenet does). UPDATE: been gone for a long time, now it's back up but does not allow uploads. Use lainsafe until
someone makes another coinsh instance.
Unfortunately, nothing tops YouTube in terms of the amount of users and content. Regardless of its Google integration, absolutely terrible privacy policy, cluttered UI,
shitty "features" like autoplay / auto-load next video as well as advertisements and massive censorship issues (archive)
- we have to deal with it if we want the videos. There are two good ways of doing this - one is Invidious which debloats the UI and now does
not require google connections to watch the videos (if you choose the dash
quality as preferred in the settings). The other is youtube-dl, which, by downloading the video instead of using someone's server, completely avoids their issues like throttling etc. The video is now just a file on your drive - you do
whatever you want with it. Of course, if you want "features" like comments, you have to succumb to the botnet and sign in with your google account (which I don't recommend, of course). What
about the so-called youtube alternatives? Briefly - they all suck. Vimeo and Dailymotion have much less content and their privacy policies aren't good anyway. Bitchute
requires a cloudflare browser check before you can even access it. Brighteon is anti-censorship but requires an invitation (really like the content
there though). You can try some peertube instances but those could die at any time (obviously, since they are not supported by a big corpo) and there is so many of them that you can forget
about gaining popularity as a content creator (since there is no big, centralized database for people to find your videos - a problem common to mostly any decentralized service). Unfortunately
I do not foresee this solved until Google fucks with content creators so hard they all decide to pack up, leave and create their own YouTube alternative - which they aren't going to do as long
as they earn the ad money - so capitalism has to die first.
Swisscows translator used to be recommended here, but it died. There are some local ways to do it, though I know nothing about them. UPDATE: one of our chat members has managed to install Apertium and said it works okay. UPDATE 2: a lean proxy for Botnet Translate now exists.
Cockfile allows you to store a file for 24 hours and alleges to keep no logs. The size limit is 5GB and there are some filetype restrictions. Disroot's Lufi is a similar kind of service with an up to 60 day timespan and 1GB size limit. It also encrypts your files so even the admins can't see the contents. Snopyta, in addition to what I've mentioned before, provides various other services such as Git, a YaCy instance (weak search results though, but completely decentralized), a Mumble (voice chat) server, collaborative editing and others - many of which have hidden services.
Neocities stands head and shoulders above other clearnet hosts - it has free 1GB storage, IPFS integration, in-built bitcoin donation as well as some quasi-social media features that allow you to find other interesting sites, post comments, etc. However, in terms of privacy or censorship, it is a black box (though I have not heard of any real case of the latter). Everyone else suffers from crippling flaws such as being paid for, requiring personal data, slow speed, enforced downtimes or ads (especially if free), and most importantly - shitty censorship policies (archive). Your best bet is to store your site on Freenet or find a host on the Tor network. And with that, we move on to the most important section...
In the end, whenever we use a clearnet service, we're relying on some server controlled by a stranger or big corpo that can install any policies it wants to and change them at any time. It can also die of course, and take your data with it (big corpos kind of resist that but still...). The Internet is being consolidated in the hands of a few players like Cloudflare, Amazon, Google, Twitter and Facebook. Did you know that, for example, even if the site you're connecting to has no elements from any of those, it can still go through their data centers (you can confirm that through a network monitor)? Not to mention the fact that all connections go through a few ISPs, which can not only install their own policies, but are also subject to the governments' increasing crackdown on free speech (or even free read) and privacy. To bypass these, we need to rely on decentralized solutions that are harder to censor or block. Some of them are ZeroNet, RetroShare, Tor and IPFS (all these have serious flaws), and Freenet, which is, IMO, the only decent one out of those (though not all that great either). Decentralization has many inherent flaws in general (some I've touched on in the Video section) - however, if the clearnet becomes unusable, we will have no choice but to move onto them, and wait for their inevitable improvement (or help make it happen if you can!). Freenet is the oldest and the only one available that allows hosting a site without being online 24 hours per day. It cannot be censored and can be made highly anonymous with proper security settings (you choose the level of compromise you're going to make). I recommend moving to it right now since I don't give the clearnet too much time from now on. But also read Avoiding "The Botnet" - impossible? for some clarification on decentralization and the internet in general (short summary: we will need the physical infrastructure eventually). But for now, Freenet is our hope!
Security / privacy is not just about software or services, but your behavior as well. Try not to put your personal data on the internet - such as name or phone number - as well as, preferably, any real life details which could connect your Internet activity to your real persona (people got their lives ruined by failing to heed this advice). Unless those details are something you want to be revealed - but then, do it with a new account on a platform that won't use it against you. E.g if you have a Reddit account with a thousand posts, you might not want to attach that to an event you've been at in real life, like a protest or something. It's a good idea to have several identities on the Internet anyway, even so that an account you care about is not "tainted" by something stupid you've said on a video game forum, or whatever.
Obviously, make regular backups of your data so that malware, a hack or disk failure doesn't destroy you. Have several layers of security - use Tor for any program that supports it, along with a VPN and trusted providers. Encrypt your communication as well as the data on your disk. For the really sensitive stuff, you might even want to use another installation or a whole new computer with a public WiFi network way away from your house (heads OS is often used for such purposes). Use different passwords for every account you care about. Delete all registration E-mail so that, in the event it got hacked, the attacker couldn't just "Remember password" for all your accounts. Obviously, don't download untrusted software, like scripts from shady imageboards (lol) unless you can read and understand the code (still, malware has happened even in official Linux repos (archive)). If you're hardcore, you could also sandbox certain applications with Firejail, or even use a security-oriented distro like Qubes or Whonix (since by default, applications in Linux have all the permissions of the user account they're run from). There's way more to cover here - entire books have been written about OPSEC - but this is a good start. However, if you're trying to do something that could really get you in trouble - go on the darknet, find people with experience, ask questions. Don't rely on this entirely unprofessional guide.
