Going dark: online privacy and anonymity for normal people

Edit: While I'm musing on this, I wonder if NoScript could use a UI overhaul. A little icon that says "Something broken? Try activating these domains" with some heuristics e.g. first try allowing the current domain, then stuff on common CDNs, then maybe digging into DNS records or SSL certs for common ownership...

Strong consumer protections exist in many developed nations which limit your liability, it is the banks who stand to lose. No doubt it can be a hassle if your credit card number is stolen, But that card is the bank's property. You just report any fraudulent transactions and get a new card if necessary. The more important thing to protect is your private data, you can't get that privacy back.

Also, NoScript is awesome and I highly recommend people try it. It can be fiddly to get working at first but a surprisingly high percentage of websites work better without having to white-list anything. It also helps with privacy by blocking trackers like Google Analytics, especialy on sites like Troy's which lack a privacy policy and do not provide any warning at all about third-party trackers to site visitors. Pretty new site redesign, same lack of transparency as before.

* By 'regular users' I mean when I say "Try an ad-blocking extension with your browser, add it from the menu" and they say "What is the menu?" and we build their knowledge up from there... . It can be frustrating for all but I highly recommend it as it keeps you grounded and provides balance for the HN bubble I sometimes find myself in.

I also cover basics like using better passwords, not reusing them and ways to keep them safe (keepass, last pass, a password memo book, etc.). And I emphasize over and over again to keep your software up to date. Let companies that have experts on staff do the work for you. Update Windows, your web browser and all Internet connect applications regularly (also applicable to iOS, the App Store and the Play Store).

Finally, I cover basic anonymity tools like ad-blockers and Disconnect.

The final paragraph loses a lot of my clientele, so NoScript is a non-starter for them.

Is that your choice or user demand?

Confidentiality is one of the pillars of security, and beyond a doubt the most common attack on user security is on confidentiaility by commercial and government organizations.

Optionally, retain craigds@host.tld for personal and professional communication/correspondence, and move everything else to craigds1+{something}@host.tld (or a different host).

Operational security and Tor is such an interesting and frankly, quite scary subject. I've mainly used and instructed people on Tor for read-only uses of the web.

For my own needs, masking the origin of an actively participating persona is out of scope. I generally warn people about doing anything that requires sign-on/nicknames etc without very careful research.

I recognize that my lack of a need for serious anonymity for basic political activism etc is a huge privilege. So I try to give back by running a bunch of Tor middle relay myself.

For serious anonymity, I'd really be strict about using a forensically clean Tails USB boot environment, on varying public Wi-FI hotspots with a dedicated laptop that never has touched my regular network. The laptop must not ever be powered on near my house. Lots of systems, like Cisco Meraki business Wi-Fi APs take note of all nearby Wi-Fi and Bluetooth devices for 'location analytics'.

Javascript and stuff must be disabled of course. Carrying any cell phone, burner or otherwise is out of the question.

The reasons are many, but for starters, you don't want to be identifiable as the only person at your location making Tor connections, if you're doing something important.

Here are some good points on the subject. https://www.youtube.com/watch?v=eQ2OZKitRwc

My approach for promoting Tor to regular people around me is through describing it as a way to do random googling on subjects people don't necessarily want linked back to them, through analytics and ad companies.

I'm personally pretty convinced that insurance companies around the globe are looking pretty seriously at how far they could push their use of intelligence from data brokers. For purposes like identifying people with potential inherited diseases, recreational drug use habits, mental health problems etc.

So, I think Tor is important for all of us.

The difference between a cash transaction and, say, a bitcoin transaction is one of scale. To make a cash transaction requires us to be in the same place and to have at least a basic understanding of identity. A fraudster can obviously profit in this situation, but their targets are limited to who they can physically meet.

The Internet is an order of magnitude larger scale. Fraudsters can work in bulk and hide their transactions easily. It's wholesale and not retail, so to speak. That is a problem worth at least considering.

Maybe it would go into comment threads, Google the title, and post a blurb paragraph from a top result? Use karma and elastic search to machine learn which sites and topics to post?

It might even respond to questions with the specific random data for that site from when it signed up, to keep it consistent.

Also, the whole "once it happens to someone, they care" applies to pretty much anything. Find someone who invests a lot of their time speaking in public for any cause you can imagine. Someone who talks to audiences about the perils of alcohol, drugs, any cancer or disease - basically anything that is harmful/dangerous/deadly. How many of them do you think ever gave a second thought to their cause, before it affected their lives personally (themselves, a family member, or close friend)? Practically none of them. People generally don't care about the consequences of anything until they've been slapped in the face by it.

P.S: Dark is cool ;-)

Apparently, HN is a joke.

(Note that the only way to view the Forbes article you linked is through the cached version.)