Ways to protect yourself from the NSA and other eavesdroppers
zdnet.com
zdnet.com
You're better off reading Grugq's post[1] on developing good OPSEC, and even then you're far and away from it.
[1] http://grugq.github.io/blog/2013/06/14/you-cant-get-there-fr...
>If we really want to protect our privacy on the net what we need is more than better technology, we need fundamental changes in our laws and how we enforce the privacy laws we do have. Then, and only then, will we have a fighting chance of keeping our privacy on the Internet.
Changing the laws and/or enforcing them would be ideal but then it seems we'd end up right where we are again. Part of the reason for the secrecy of these programs isn't only national security but a way to circumvent the laws. From what we know about the current NSA controversy, these programs are mostly legal and being enforced just fine. Courts are ruling in favor of these things. That's not to say a debate over the 4th amendment isn't unreasonable.
Sometimes I feel there's a part of me that believes we could change the laws. The problem may not be our representatives exactly but rather the power that's been given to the military industrial complex. It's like a totally separate government unto itself, creating problems to solve to justify its own existence.
Correct me if I am wrong, but a common sense tells me, that if they are able to monitor all Internet traffic, and also can run their own Tor nodes, and also possess software to analyze those big amounts of data that the monitoring will produce, I just can't see how you cannot be ultimately tracked even on Tor.
As I see it, many of those defenses just assume that your adversary is not able to "cache" the whole Internet traffic, and that he also don't have such a strong computer to crack PGP. But relating to nation-state agency, those are already nothing more than assumptions.
Anyway, the points in the article are quite efficient against the lesser capable hackers. It never hurts to put less amount of private data to the Internet, for example.
However, and as we all agree, it's much difficult putting them into use. We need these services. If I get lost, I need Google Maps to find the way. I need GPS. These are things that have no other alternative.
Likewise, if I want to talk with a friend over video and I tell him I don't want to use Skype, he laughs at me. Will he download and install Jitsi just for me? No, that is not how it works.
If we are using these tools for ourselves, say personal browsing using Tor, that is fine. But the moment you start interacting with someone else and expect them to send you PGP encrypted emails, not to use Google Talk/Skype, people just don't care and will not switch to other alternatives. Also, you will get laughed at for being a paranoid nut. Unless these secure alternatives become the norm, good luck expecting others to change. That means your family and friends who just want to use a service and don't care about the privacy problems behind it.
TL;DR: our reliance on these technologies makes it difficult to completely let go of them. And for most of them, there are no privacy-preserving alternatives.
No you don't. These services didn't even exist ten years ago and people got along just fine. Get rid of them and I guarantee your intrepid little human resourcefulness will find ways of managing without them. They're first world luxuries, nothing more.
Then maybe just use with your spouse . since those conversations are very private, maybe you could Convince him/her. And it does buy you protection from law and inadvertent snooping by friends(if I understand otr correctly).
Now talk about this with your friends. They might want to use the same strategy.
And now some of you're friends have the software, it's just a matter of setting keys. Seems possible.
It's always better to use alternatives to the eavesdropped service, but the benefit comes from minimizing and eliminating the amount of eavesdropped data, so it's always good to minimize the usage. If it means to use Skype only in strictly required cases, I think it's acceptable as long as you realize that whatever you say or imply directly or indirectly or whatever can be gathered through metadata or side-channels, it's a no biggie really.
The best hide is to hide in the crowd and realize the situation and act accordingly.
That's why instead of looking for ways to ditch these services, we need to make sure they are audited on a regular basis, and that government agencies don't feel they are above the law; to remind our masters that only our consent gives them the power they crave.
However, the end-to-end encryption is what we need, so that we don't have to rely or expect service providers to change. Things like PGP for sending emails, OTR for IM, Jitsi for video conferencing. All these do end-to-end encryption and this is what we should be moving to. So if you are using Gmail, but you only send PGP emails, great. You are using Google's services while not giving them anything.
The worry has to be the data they have on us from the past. We now know to be careful, so presumably those wanting to be careful, will be.
I now don't care what they do from now on. The key thing is that I am now 100% sure the internet and electronic comms are insecure. If I need to be secure, I'll find other ways to communicate, or do all I can to lower the risk, act accordingly, and accept the risk.
But what I do want, as a non terrorist/pedophile/bogyman, is all the data they have that relates to me to be purged.
Wont happen.
I hate to say it but what you're saying is like telling a 17-year-old that the only way to protect themself from STD/pregnancy is to never have sex. I mean, you're right, but you're also failing to cope with the reality of the situation. ;)
At the end we probably need both, the public constantly controlling politics and technical solutions to make surveillance generally harder, but it all requires the public interest reaching at least the critical mass.
If 99% of people didn't want surveillance, then governments would have virtually no chance to install it, but at the moment many people think surveillance is good for them.
Only technical savvy people can do something like that, and from those few will ever bother. Besides if I’m to set-up my own XMPP server why not hangout at IRC.
Quit social networks, all of them
Try telling that to a 20 something. Social networks are the Internet for them, they don’t just quit.
Advices like these are absolutely useless. HTTPS Everywhere is probably the only usable advice in the whole article. Everything else can’t be proposed to the average user.
IMHO privacy is one thing and protecting yourself from NSA a whole different. While you can protect your privacy following some simple rules, making yourself invisible from NSA is practically impossible-unless you're willing to forgo many of the conventions of modern life.
Considering that the so-called Average User doesn't care aboit his/her privacy in the first place, is this much of an issue really?
https://graph.facebook.com/search?q=my%20cell%20number&type=...
Become your own NSA!
Which still doesn't prevent you if the service provider is rogue.
But not a word, yet. Not one word.
Smart.
Using Tor or a VPN are definately good things to obfuscate traffic, but you basically have to use them ALL the time otherwise your activity can be corrolated.
Using your own IM isn't a requirement either, you can use OTR for semiprivate conversation.
They will grab your private servers too, if they have probable cause to do so. I don't see this particular argument being very persuasive.