Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
learn:how-tos [2019/09/02 16:09] – [Tor Browser] 127.0.0.1learn:how-tos [2020/07/16 04:35] – old revision restored (2020/06/12 20:27) 127.0.0.1
Line 1: Line 1:
 **Brief How-tos** {{  :cp-logo-100x33.png?nolink&}} **Brief How-tos** {{  :cp-logo-100x33.png?nolink&}}
  
-This page briefly explains how to use various tools which enhance your privacy, anonymity and overall security. The guides are written in an easy to understand, step-by-step manner. The difficulty & time required for most of them don't provide any reason to //not// secure your communications and blurring your digital traces.+This page briefly explains how to use various tools which enhance your privacy, anonymity and overall security. The guides are written in an easy to understand, step-by-step manner. The difficulty and time required for most of them don't provide any reason to //not// secure your communications and blurring your digital traces.
  
 FIXME This page has grown and is hard to navigate in. Recommended re-arrangement: FIXME This page has grown and is hard to navigate in. Recommended re-arrangement:
Line 8: Line 8:
   * Make this a landing page with short explanation of each tech and add link to actual article(s).   * Make this a landing page with short explanation of each tech and add link to actual article(s).
  
 +
 +====== Why is mass surveillance a problem? ======
 +
 +  * [[:masssurveillance|cryptoparty.in/MassSurveillance]]
 +
 +====== Quotes ======
 +
 +"//Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on//." \\ <wrap lo>~[[http://www.theguardian.com/world/2013/jun/17/edward-snowden-nsa-files-whistleblower|Edward Snowden]] (on [[http://www.theguardian.com/world/the-nsa-files|NSA surveillance]])</wrap>
 +
 +"//All the headlines saying [[https://twitter.com/search?q=#NSA&f=realtime|#NSA]] breaks encryption are wrong; correct phrase is NSA works with vendors to sabotage security technology//." \\ <wrap lo>~[[https://twitter.com/doctorow/status/376011707643994112|Cory Doctorow]] (on [[http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security|NSA Backdoors & 'cracking' encryption]])</wrap>
 +
 +----
  
 ====== Security warning ====== ====== Security warning ======
  
-Note, however, that security is a process, not a tool. You need at least basic understanding to assess the degree of security or [[:connect:resources#why_there_is_no_100_anonymity|anonymity]] a tool can give you. That said, treat it like a game. The worst thing which can happen, if you use these tools for your everyday business, is that you are just as unsecure, unencrypted or in the open as you would be anyway.+Note, however, that security is a process, not a tool. You need at least basic understanding to assess the degree of security or [[:connect:resources#why_there_is_no_100_anonymity|anonymity]] a tool can give you. That said, treat it like a game. The worst thing which can happen, if you use these tools for your everyday business, is that you are just as insecure, unencrypted or in the open as you would be anyway.
  
-The use of security sensitive activity (which is both prohibited and can be persecuted by society and/or government) without deep understanding is **strongly** discouraged.+All security sensitive activity (which is both prohibited, and prosecutable by the society and/or the government) without deep understanding is **strongly** discouraged.
  
  
 ====== Guides to Crypto Tools ====== ====== Guides to Crypto Tools ======
 +
   * [[:learn:handbook|The CryptoParty Handbook]]   * [[:learn:handbook|The CryptoParty Handbook]]
   * [[https://securityinabox.org/|Tactical Technology Collective - Security-in-a-Box]]   * [[https://securityinabox.org/|Tactical Technology Collective - Security-in-a-Box]]
-  * [[http://www.tcij.org/resources/handbooks/infosec|Center for Investigative Journalism - Information Security for Journalists]]+  * [[https://ssd.eff.org/en | Surveillance Self-Defense - Tips, Tools and How-tos for Safer Online Communications]] 
 +  * [[https://files.gendo.ch/Books/InfoSec_for_Journalists_V1.1.pdf|Center for Investigative Journalism - Information Security for Journalists]]
   * [[https://flossmanuals.net/an-open-web/|FLOSS Manuals - An Open Web]]   * [[https://flossmanuals.net/an-open-web/|FLOSS Manuals - An Open Web]]
-  * [[https://www.privacytools.io/|Privacy Tools]]+
  
 ====== Alternatives to common online services and programs ====== ====== Alternatives to common online services and programs ======
  
 +  * [[https://www.privacytools.io/|https://www.privacytools.io]]
   * [[https://prism-break.org|https://prism-break.org]]   * [[https://prism-break.org|https://prism-break.org]]
   * [[https://alternatives.tacticaltech.org/|https://alternatives.tacticaltech.org/]]   * [[https://alternatives.tacticaltech.org/|https://alternatives.tacticaltech.org/]]
   * [[https://github.com/redecentralize/alternative-internet|https://github.com/redecentralize/alternative-internet]]   * [[https://github.com/redecentralize/alternative-internet|https://github.com/redecentralize/alternative-internet]]
 +  * [[https://switching.software/|https://switching.software/]]
  
-====== Why is mass surveillance a problem? ====== 
- 
-  * [[:masssurveillance|cryptoparty.in/MassSurveillance]] 
- 
-====== Quotes ====== 
- 
-"//Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on//." \\ <wrap lo>~[[http://www.theguardian.com/world/2013/jun/17/edward-snowden-nsa-files-whistleblower|Edward Snowden]] (on [[http://www.theguardian.com/world/the-nsa-files|NSA surveillance]])</wrap> 
- 
-"//All the headlines saying [[https://twitter.com/search?q=#NSA&f=realtime|#NSA]] breaks encryption are wrong; correct phrase is NSA works with vendors to sabotage security technology//." \\ <wrap lo>~[[https://twitter.com/doctorow/status/376011707643994112|Cory Doctorow]] (on [[http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security|NSA Backdoors & 'cracking' encryption]])</wrap> 
- 
----- 
  
 ====== Web Browsing ====== ====== Web Browsing ======
  
 To get an idea of what web browsing actually is, read the chapter **[[http://cryptoparty.is/handbook/chapter_02_understanding_browsing/chapter_02_understanding_browsing.html|Understanding Browsing]]** of the CryptoParty Handbook. In brief: To get an idea of what web browsing actually is, read the chapter **[[http://cryptoparty.is/handbook/chapter_02_understanding_browsing/chapter_02_understanding_browsing.html|Understanding Browsing]]** of the CryptoParty Handbook. In brief:
 +
  
   * When you visit a website you give away information about yourself to the site owner, unless precautions are taken.   * When you visit a website you give away information about yourself to the site owner, unless precautions are taken.
-  * Your browsing on the Internet may be tracked by the sites you visit and partners of those sites. 
-  * Visiting a website on the Internet is never a direct connection. Many computers, owned by many different people are involved. Secure connections ensure that your browsing can not be read in between you and the server. 
   * What you search for is of great interest to search providers (mostly for targeted advertising).   * What you search for is of great interest to search providers (mostly for targeted advertising).
 +  * Your browsing on the Internet may be tracked by the sites you visit and partners of those sites.
 +  * Visiting a website on the Internet is never a direct connection. Many computers, owned by many different people are involved. 
 +  * Encrypted connections (HTTPS a.k.a TLS) ensure that your browsing can not be read in between you and the server.
 +  * TLS is important, but since the server belongs to an untrusted third party, your primary protection when browsing the web and publishing to web is **anonymity**.
 +
  
-Then you can see what you just learned by facing a virtual mirror to yourself on+See what companies know about you by facing a virtual mirror to yourself on
  
-  * [[http://ip-check.info|http://ip-check.info]] 
   * [[http://ifconfig.me|http://ifconfig.me]]   * [[http://ifconfig.me|http://ifconfig.me]]
   * [[http://smart-ip.net/geoip|http://smart-ip.net/geoip]]   * [[http://smart-ip.net/geoip|http://smart-ip.net/geoip]]
   * [[https://panopticlick.eff.org|https://panopticlick.eff.org]]   * [[https://panopticlick.eff.org|https://panopticlick.eff.org]]
 +  * [[https://webkay.robinlinus.com/]]
 +  * [[https://clickclickclick.click/]]
 +  * [[https://iknowwhatyoudownload.com/en/peer/]]
  
-===== Browser ===== 
- 
-[[https://www.mozilla.org/en-US/firefox/|Firefox]] is an open source web browser that respects your privacy. If you're not using it already you should do so from now on. It's as good as Chrome, fast and the most extendable browser with most AddOns. It's available for Windows, Mac & Linux. 
  
 ===== Tor Browser ===== ===== Tor Browser =====
  
-Most possibly the best option you can and will ever have if you like your privacy, freedom and anonimity in your hands, and not in the hands of trackers, companies -like your personal ISP-, governmental systems and programs, and other potential snoopers, where they don't belong. +Tor Browser is  
-  * [[https://www.torproject.org/download/download-easy.html.en|Download the Tor Browser]] +    * Anonymous and secure by default. For more information, see [[https://2019.www.torproject.org/about/overview.html.en|this]] and [[https://www.eff.org/pages/tor-and-https|this]] article 
-  * Install & [[https://www.torproject.org/download/download-easy.html.en#warning|read the warning]] +    * The best option out there 
-  * Use! (instead of your normal browser) +    * Based on the [[https://www.mozilla.org/en-US/firefox/|Mozilla Firefox]], an open source web browser that respects your privacy 
-  * Before browsing [[:learn:how-tos#Tor Hidden Services|.onion sites]] make sure to click on the {{https://i.imgur.com/wPP9v0M.png?nolink&30x24}}in the upper left of the browser and choose "Forbid Scripts Globally". This prevents JavaScript from leaking potentionally personally identifiable information - disable for individual sites if needed.+    * Designed to protect you against surveillance done by companies and governments
  
-  * You should also set the security level to High and lower it only if it has major effect on your browsing experience. The Security setting can be found under the Tor logo in navigation bar.+Setup 
 +   - [[https://www.torproject.org/download/|Download the Tor Browser]] 
 +   - [[https://tb-manual.torproject.org/installation/|Install the Tor Browser]] 
 +   - [[https://tb-manual.torproject.org/running-tor-browser/|Launch the Tor Browser]]
  
-  * [[https://www.eff.org/pages/tor-and-https|Here is an animated diagram to help explain more]] +Before browsing 
-  * [[https://media.torproject.org/video/2012-10-21-cryptoparty/UsingTorByAndrewAndSteve.mov|"Using Tor"]] from CryptoParty Boston.+   - [[https://tb-manual.torproject.org/|Have a look at the manual]] 
 +   - Watch the [[https://media.torproject.org/video/2012-10-21-cryptoparty/UsingTorByAndrewAndSteve.mov|"Using Tor"]] from CryptoParty Boston.
  
-===== Browser Plugins =====+Adjust security settings 
 +   - Before accessing [[:learn:how-tos#Tor Hidden Services|.onion sites (i.e. Onion Services)]], make sure to click on the {{https://i.imgur.com/wPP9v0M.png?nolink&30x24}}in the upper left of the browser and choose "Forbid Scripts Globally". This prevents JavaScript from leaking potentially personally identifiable information - disable for individual sites if needed. 
 +   - set the [[https://tb-manual.torproject.org/security-settings/|security setting level]] to ''Safest'' and lower it **only** if it has major effect on your browsing experience. The Security setting can be found under the Tor logo in navigation bar.
  
-==== HTTPS Everywhere ====+**WARNING! Do not install any browser add-ons to Tor Browser. The anonymity Tor provides is based on the fact all users look identical. If you install an add-on that makes your browser fingerprint unique, it means you will stand out from the crowd, and you can be tracked.**
  
-  * [[https://www.eff.org/https-everywhere|HTTPS Everywhere]] has a big list of websites that support encrypted connections, and whenever you connect to them silently switches to the encrypted variant. That little "s" in the URL is what it is about. 
  
-==== Block Advertising and Tracking ==== +==== Firefox Browser ====
-  * [[https://adblockplus.org|Adblock Plus]] blocks banners, pop-ups and video ads. +
-  * For Firefox there also is [[https://addons.mozilla.org/​en-us/​firefox/​addon/​adblock-edge/​|Adblock Edge]] which is a fork of AdBlock Plus without ​the [[https://​adblockplus.org/​en/​acceptable-ads|'​acceptable ads']] feature  +
-  * [[https://​disconnect.me/​|Disconnect.me]] ([[https://​github.com/​disconnectme/​disconnect|free and open source with GPLv3 license]]). +
-  * [[https://github.com/gorhill/uBlock|uBlock Origin]] is an add-on for Firefox and Chrome that blocks a variety of advertisement and tracking companies – which are one and the same in many cases. +
-  * [[https://www.eff.org/privacybadger|Privacy Badger]] does a similar job, but based on heuristics rather than block lists.+
  
-==== Scripting ====+For browsing that doesn't require anonymity (i.e. browsing that requires you to log in), switch to Mozilla Firefox. It's as good as Chrome, fast and the most extendible browser with most add-ons. It's available for Windows, Mac, and Linux. Firefox supports many useful security privacy enhancing plugins discussed next.
  
-Advanced. Only enable JavaScript, and especially plugins like Java, and Flash for sites you //trust.//+**Ad block plugins** 
 +    *[[https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/|uBlock Origin]]
  
-  * [[https://github.com/gorhill/uMatrix|uMatrix]]+**Security plugins** 
 +    * [[https://www.eff.org/https-everywhere|HTTPS Everywhere]] has a big list of websites that support encrypted connections, and whenever you connect to them silently switches to the encrypted variant. That little "s" in the URL is what it is about.
  
-==== Identifiable Browser configurations ====+**Privacy plugins to block tracking** 
 +  * [[https://​disconnect.me/​|Disconnect.me]] ([[https://​github.com/​disconnectme/​disconnect|free and open source with GPLv3 license]]). 
 +  * [[https://github.com/gorhill/uBlock|uBlock Origin]] is an add-on for Firefox and Chrome that blocks a variety of advertisement and tracking companies – which are one and the same in many cases. 
 +  * [[https://www.eff.org/privacybadger|Privacy Badger]] does a similar job, but based on heuristics rather than block lists.
  
-  * The only serious attempt to thwart browser fingerprinting is the [[https://torproject.org|Tor Browser]].+**Advanced plugins**
  
-==== Request Policy ==== +WARNING! Only enable JavaScript, and especially plugins like Java, and Flash for sites you **trust**.
- +
-Advanced.+
  
 +  * [[https://github.com/gorhill/uMatrix|uMatrix]]
   * [[https://www.requestpolicy.com/|Request Policy]] is an open source Firefox extension to control cross-site requests.   * [[https://www.requestpolicy.com/|Request Policy]] is an open source Firefox extension to control cross-site requests.
  
-==== Certificate Patrol ==== 
  
-Your browser trusts many certification authorities and intermediate sub-authorities quietly, every time you enter an HTTPS web site. The Firefox AddOn [[https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/|Certificate Patrol]] reveals when certificates are updated, so you can ensure it was a legitimate change.+**Certificate plugins** 
 + 
 +Your browser trusts many certification authorities and intermediate sub-authorities quietly, every time you enter an HTTPS web site. The Firefox add-on [[https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/|Certificate Patrol]] reveals when certificates are updated, so you can ensure it was a legitimate change.
  
-//FIXME Please review AddOns such as [[https://addons.mozilla.org/en-us/firefox/addon/betterprivacy/|BetterPrivacy]], [[https://addons.mozilla.org/en-us/firefox/addon/beef-taco-targeted-advertising/|BeefTaco]], [[https://addons.mozilla.org/en-us/firefox/addon/smart-referer/?src=dp-dl-othersby|SmartReferer]], [[https://addons.mozilla.org/en-us/firefox/addon/anonymox/|anonymoX (proxies!)]]//+//FIXME Please review add-ons such as  
 +* [[https://addons.mozilla.org/en-us/firefox/addon/betterprivacy/|BetterPrivacy]] 
 +* [[https://addons.mozilla.org/en-us/firefox/addon/beef-taco-targeted-advertising/|BeefTaco]] 
 +* [[https://addons.mozilla.org/en-us/firefox/addon/smart-referer/?src=dp-dl-othersby|SmartReferer]] 
 +* [[https://addons.mozilla.org/en-us/firefox/addon/anonymox/|anonymoX (proxies!)]]//
  
 ===== Web search ===== ===== Web search =====
Line 140: Line 157:
   * Use antivirus software and a firewall. Do regular scans & updates   * Use antivirus software and a firewall. Do regular scans & updates
   * Regularly update all of the software you find on this page   * Regularly update all of the software you find on this page
 +  * Check if you have an account that has been compromised in a data breach on [[https://haveibeenpwned.com/|HaveIBeenPwned.com]]
  
  
Line 851: Line 869:
 ===== Web Browsing ===== ===== Web Browsing =====
  
-  * [[https://itunes.apple.com/us/app/ghostery/id472789016|Ghostery]] stops third-party sites from tracking you. + * [[https://itunes.apple.com/au/app/onion-browser/id519296448?mt=8|Onion browser]] is a Tor-capable web browser that lets you access the internet privately and anonymously.
-  * [[https://itunes.apple.com/au/app/onion-browser/id519296448?mt=8|Onion browser]] is a Tor-capable web browser that lets you access the internet privately and anonymously.+
  
 ===== Chat ===== ===== Chat =====