Secret services are spying on us. Companies call us consumers and consider us slaughter cattle. Governments invent tales of terrorists to ensure they keep the powers that they don’t deserve. I used to be reviled as paranoid – but nothing is for free. Face it: the golden age of cloud services over where we deliver our intimate data to untrustworthy organisations “just because it’s free and easy” or because we have legal agreements that we rely on.
So why not increase your privacy bit by bit? Here is your checklist for the post-cloud era.
| Problem | Severity | Solution |
| Contacts and calendar entries in Android | High | Set up OwnCloud and use CardDAV and CalDAV to store your data in your own private cloud. Works reliably. Or maybe your NAS at home (like Synology) has such DAV services built-in. |
| Social networking (Google+, Facebook, Twitter) | High | Just cancel your accounts. You won’t miss them after a while. They are a waste of time. |
| Email account at a public webmail provider (Google Mail, GMX, Freenet) | High | Rent your own Linux server. Starts at less than 8€ per month. Set up your own mail server. |
| Dropbox | High | Remove your files and cancel your account. You don’t really need your files in several places. Carry an encrypted external USB drive with you if your computer does not provide enough room. It is much faster anyway. If you totally need a cloud storage then install OwnCloud on your own Linux server. |
| Google Analytics | High | If you want to get beautiful statistics about your web site then use Piwik. But often it’s enough to just analyse your access log. |
| Ads and tracking in browser | High | Ads are annoying. They steal your time. And sometimes they even carry malware. Install the |
| User-agent tracking in browser | High | The identification of your browser is so unique nowadays (try it) that analytics companies trust them more than putting cookies on your disk. Hide yourself by randomizing your user-agent string. There are add-ons for Firefox but I didn’t find anything decent for Chrome. |
| Untrusted browser add-ons | High | Configure your browser for click-to-play plugins. |
| Google search | Medium | Use startpage.com as your search engine. You will still get Google’s good results but with less tracking. |
| Skype | High | Uninstall it. Install Pidgin and sign up for an XMPP (aka: Jabber) account at any server – e.g. jabber.workaround.org. Enable the Off-The-Record (OTR) plugin to encrypt your chats. |
| High | Uninstall WhatApp. Get Threema (proprietary encrypted client) or Xabber (XMPP-based) on your smartphone. Signal (formerly known as TextSecure) is a free and pretty good alternative that also encrypts voice calls. Never allow any messenging program to transfer your address book. | |
| Closed-source software | Medium | Get rid of as much of it as possible. You hardly need Adobe Photoshop and Microsoft office – I bet you can live with Gimp and LibreOffice. |
| Windows | Medium | Throw away Windows and use a free operating system. Unfortunately Ubuntu has too much spyware nowadays – I recommend plain Debian for the nerd and Linux Mint for the casual users. If you want to use Windows for playing games then dual-boot and don’t use Windows for anything relevant. |
| Online Banking | High | Never do banking with your smartphone and avoid closed-source operating systems like MacOS and Windows. Avoid software like StarMoney that only runs on Windows and is famous for its bad user interface. Try Jameica. |
| WiFi | Medium | Change your WiFi password now. I bet you haven’t done that in years. Use a long password. |
| Router | High | Update your router firmware now. |
| Unencrypted media | High | If you are carrying your computer (e.g. laptop): Encrypt your hard drive and any external disks and USB sticks that contain your data. Decent Linux distributions offer effortless full-disk encryption. Encrypt external media using cryptfs. If you find those solutions too complex then use |
| OpenID authentication (Google, Yahoo) | Medium | Don’t use OpenID authentication providers. Get your own account on the web sites you use and use different passwords everywhere. |
| Password uniqueness | High | Never use the same password for multiple different purposes. Web sites get hacked pretty frequently and you don’t want anyone to try your password in other places. |
| Password complexity | High | Always make passwords as long as possible and save it on your computer (e.g. encrypted in your browser). The length of your password matters more than the complexity. “s3cr3t” is a ridiculously simple password. A good password is “l(S.e/>oOVE~N>c+BO>P~(“. The more is looks like garbage the better. (The previous password was made using “apg -m 22 -a 1”. See also XKCD. Let your browser save the password if you want. |
| Keeping passwords | High | Don’t put your passwords in an unencrypted text file or on paper. Console nerds use VIM and a script. Graphical users use KeypassX. |
| Your own website | Medium | Configure your own websites to use HTTPS. Forward any HTTP requests to HTTPS. Either create a self-signed certificate or get a free certificate at StartSSL if you want your certificate to be accepted by other visitors. But always create your own key and certificate request – don’t let the certification authority create your private key. |
| Unencrypted email | High | Create a PGP keypair (4096 bit) and start sending encrypted email. Persuade your family and friends to switch to use PGP. A proven and easy solution is Thunderbird with the Enigmail add-on. Use obscure subjects because they are not encrypted. If you don’t like Thunderbird then on Linux you may like Evolution which is way more stable and performant and supports PGP. |
| Google Maps | Low | It’s great for navigation. But if you just need a map or browse around then use Openstreetmap. |
| IP address | Medium | Your IP address can easily be tracked down to your home and your person. If you are serious about security consider using Tor. |
| European ISPs | Medium | Try to avoid US-american ISPs. Of course other countries like the UK are not that much better. But apparently the US are monitoring most parts of the internet so your chance to accidentally get under suspicion is the greatest there. Unfortunately an increasing number of european countries is stacking up their surveillance of the people. At least Germany and France cannot be considered good hosting countries either. |
| Browser fingerprinting | Low | Some browsers like Firefox already warn you from fingerprinting attempts. Basically they try to track you even though you have cookies switched off. Not many sites do this. See Panopticlick and this article for more details. |
Further ideas? Comment!
See also: https://www.privacytools.io/
Thanks for bringing this topic up – good list!
Hurts to say, but i think you’ll have to add my Mac OS X into the Windows section.
I’m missing tor browser (torproject.org) on your list.
It’s not fast – but an convenient all round solution for browsing the web.
Hello and thanks fot your post. Can you please suggest some provider to rent Linux servers? Another skype alternative is Jitsi. Bye, M.
The cheapest server I know costs 8€/month. The performance is good enough for chat and email servers. However it feels pretty sloppy even for web sites. And working in the shell is tedious (e.g. package updates).
The best value for money in my opinion are the dedicated servers from server4you servers. Starting at 25€/month you get a cheap but dedicated server. Dual-core, 320 GB disk in a RAID-1, 4 GB RAM. That's what this server runs on.
I can't promise that these servers are rented to citizens living outside of Germany though.
You could also consider running your own server. Thanks to DynDNS/NoIP-style services you can point a DNS record to your home server and are free to put in disks and RAM as you like. Many people have an old desktop/tower computer in their closet that is perfect as a server. Just do a fair calculation of your power bill – sometimes 7€/month is just the electricity.
Same offer from Hetzner http://www.hetzner.de/hosting/produkte_vserver/vq7
And it’s not only for german people. I’ve multiple of them since two years and have never had any problems.
Just 4 info
Cheapest server at 8€/month ? You can get a dedicated server for 4€/month.
See http://www.kimsufi.com/ … Now they are sold-out, but check their offer.
there’s a similar, but more comprehensive list here: https://prism-break.org/
Right. Although Prism-Break is rather focused on software and less on general behavior.
I’d use Disconnect over Ghostery since Ghostery is closed-source and there’s been some controversy about it lately. Other than that, I’d add “RequestPolicy”, “BetterPrivacy”, “AdBlock Edge”, “NoScript” and of course “HTTPS Everywhere” to the list of Firefox extensions
Hello Christoph, please be aware, Firefox 37 is blocking your site claiming it’s insecure. I’ve found it’s due to the poor implementation of OSCP and turning it off via about:config overcomes the problem. The problem is, although the more technical adept folk will be able to solve this, many thousands won’t and will be blissfully unaware or even more worryingly think your site is a dangerous virus infested place not to be.
Thanks for the hint. I keep having trouble both with Firefox and with StartCom who issue the free certificates. Firefox seems increasingly broken which is why I'm looking for a personal alternative. And I have just requested a new TLS certificate from gandi.net for workaround.org. I have never paid anything to StartCom and have enjoyed their service. But I find their service confusing and often broken. As much as I dislike paying the certification mafia this is the least painful thing to do at the moment apparently. The new certificate should be up later today.
If you are a bit more paranoid, consider using a server outside your own country (at least in Germany, you can escape “Vorratsdatenspeicherung” that way). Edis.at offers a wide range of reasonably priced servers in different countries.
LetsEncrypt is a nice alternative to StartCom. I found it after I renewed my server cert with the wrong name, and couldn’t revoke it without paying. They have a nice command line client to (auto) renew certs, too.
True. However I have gone back to StartCom. They have improved their web site and offer a similar service. Although I totally endorse LetsEncrypt I object to that Git-driven Python mess. Besides StartCom certificates are valid for a year.
“Hmm is anyone else encountering problems with the images
on this blog loading? I’m trying to determine if its a problem on my end or if it’s the
blog. Any feed-back would be greatly appreciated.”
Thanks for the hint. There was just one image that was not that important. I have just removed it. 🙂