Computer Security and Privacy.     42     Please send any comments to me.

This page updated: November 2017

Online Security section
Online Privacy section
Privacy In General section
Theft recovery software section
Miscellaneous section

TL;DR about computer privacy, security and safety:

Levels of privacy, security and safety (my opinion):
  1. No backups, no passwords on devices, same password on many online accounts.

    A disaster waiting to happen. Accidentally delete many files, hard disk crashes, or someone steals your phone, and you're in a world of pain.

  2. Backups, passwords on devices, software auto-updating, anti-virus.

  3. Password manager to handle online accounts, ad-blockers and script-blockers on browsers, credit freeze, use HTTPS web sites, set privacy settings on accounts.

  4. Full encryption on devices, two-factor authentication on important online accounts, VPN.

  5. Change to Linux, use secure email and messaging, special firewall/router, redirected email and phone numbers and credit cards, postal-mail forwarding service.

  6. TOR browser, burner phones, clean OS every time, run your own mail server and VPN, fake ID, gift-cards, Bitcoin.


Online Security

  1. Password security:

    Use the password and security features of your device and software; many people don't even bother to set a password !

    But some passwords are fairly easy to bypass; don't expect them to protect you from every threat:
    Computer Hope's "How to clear an unknown BIOS or CMOS password"
    Mark Wilson's "How to crack Windows and OS X passwords"
    Hack Cave's "Hack Windows 10 Login Password In 2 Minutes [Works For All Windows Versions]"
    Hack Cave's "Hacking/Bypassing Android Password/Pattern/Face/PIN"

    Use a password manager:

    Password manager makes it easy to use a different password for every web site, can generate hard-to-guess passwords, can remind you to change passwords periodically.

    Some passwords they don't help manage: your PC's BIOS and Windows passwords, encrypted disk drive's password, physical-world passwords such as ATM PIN. You can store those passwords in the password manager, but not drag them out to apply them.

    Don't use a browser's password-saving features; the security level is unknown, it's not cross-browser, features will be minimal. Use a dedicated password manager.

    Features to consider:
    • Price.
    • Type:
      • Online: your passwords are stored online, which is bad (have to trust that place; what if they go bankrupt) and good (accessible from any device; backed up). Usually there will be a synchronized local copy of your password database, too.
      • Local application: your passwords are stored only on your device.
      • Feature of a security suite: same as local application.
      • Browser feature: first implementations of this had some holes/bugs, no way to sync across different brands of browsers, maybe no way to sync across multiple devices.
      • Browser add-on, or bookmarklet (Javascript): maybe same issues as browser-feature type.
    • Devices supported (PC, smartphone, tablet, etc).
    • OS's supported.
    • Browsers supported (almost all managers use a related add-on in your browser).
    • Syncing devices to each other.
    • Cloud backup.
    • Handles credit card info.
    • Handles application passwords.
    • Supports two-factor authentication.
    • Supports fingerprint (biometric).
    • Miscellanous: form-filling, import from other managers, automatic login capture, profile info, notes, credit report monitoring, etc.

    One major risk: if you store your bank login info in a password manager, and it gets hacked, and the thief empties your bank account, neither the password manager company nor your bank will compensate you. Both will deny any liability, according to their terms of service. Your money will be gone.

    Wikipedia's "Password manager"
    Slant's "What are the best offline password managers?"
    Davey Winder's "How to: Manage your passwords offline"
    Alan Henry's "Five Best Password Managers"
    How-To Geek's "Password Managers Compared: LastPass vs KeePass vs Dashlane vs 1Password"

    Some free password managers:
    Blur (more than just a password manager)

    I don't want a manager with a browser add-on that watches every web page I load. And an offline manager is more secure.

    So I chose KeePass 2.x, and use just the application, not any browser add-ons for it. I drag-and-drop username and password from KeePass application into login web page.

    In my cloud backup application, I disabled backup of the KeePass database file; I want to back it up to my own devices (external hard drive, etc) only.

    On Android phone, I installed Keepass2Android Offline. Emailed KeePass database file and read email on phone to get the file into Downloads, then have Keepass2Android Offline access it from there. Some strange things: there is no "log out" in the Yahoo Mail app; you have to "remove" your email account, and then when you add it back later, you're asked for your phone's PIN, not your Yahoo Mail password. Similar for GMail app, but even worse: removing your GMail account could affect many other services on the phone. Reddit app has a "log out" button, but then when you log back in, it doesn't ask for a password, you're just back in ! The Tripadvisor, AirBNB, and FaceSlim apps do have a proper sign-in/sign-out behavior. The WhatsApp app has no sign-out at all. I guess you could use the browser and web sites instead of installing these apps, but then you lose a lot of functionality and nice UI.

    Reasons to use a password manager on a smartphone, despite the app issues I listed:
    From /u/VividVerism on reddit:
    Logging into web pages. Signing into apps for the first time. Signing into apps after deleting data and/or reinstalling and/or factory reset. Banking apps and similar high-security apps that do require a password either to log in or confirm a purchase/transfer/etc. Storing Wi-Fi passwords. Having your passwords handy for manually logging into sites on computers you don't own, or while traveling. Storing things other than passwords, such as credit card information, social security numbers, or library card information. Installing plugins to let you transfer passwords via QR code or to plug your phone into a computer via USB to type your passwords for you. Using the TOTP features to generate 2FA codes instead of a dedicated app. Storing passwords for any new accounts you set up on your phone. Keeping a database backup with you.

    I'm probably missing a few use cases. In short, yes: there are plenty of reasons a password manager can be useful on a phone.

    Dan Goodin's "'Severe' password manager attacks steal digital keys and data en masse"
    Martin Vigo's "Even the LastPass Will be Stolen, Deal with It!"

    Don't let Windows store passwords and apply them automatically. If someone cracked your Windows password, they would get automatic access to those things. I set my backup application to not "remember" me, so I have to log in to it manually every time I run it. If you have an encrypted external hard disk, don't let Windows hold the password and apply it automatically (auto-unlock); you should type it in manually each time you plug in the disk drive.

    Don't let your browser store passwords and apply them automatically. The quality of their security is unclear, and that method works only inside that browser. Not sure how backup and restore would work. Much better to use a dedicated password manager application.

    Passwords, from article by Jacob Bernstein in The New York Times, June 24 2012:

    ... it is less clear to cybersecurity experts that having a password with extra numbers or special characters actually makes customers safer.

    "People's choice of passwords is not the real problem today", said Dr. Joseph Bonneau, a University of Cambridge researcher who studies cyber security. "The real problem is typing in passwords to the wrong Web site, which is stealing them."

    So why are Web sites suddenly requiring users to add special characters or numbers ? "It's security theater", Dr. Bonneau said. "So people feel safe. It makes the Web sites seem like they're taking things more seriously, when in fact most of them have no control if you have malware. In absence of a way to tackle bigger problems, it's easy to add restrictions. They don't want to seem less secure than competitors."

    Two-factor authentication:

    Some sites offer two-factor authentication, where you can't log in unless you possess both knowledge (password) and your registered device (phone or dongle or token). When logging in to the site, you have to type in your usual password, plus some one-time passcode you get through the device.

    For standard web sites, usually that requires you to have a phone that does SMS (text messaging); the site will SMS the passcode to your device, and then you type in the passcode on the web site. [Note: SMS is expensive in Europe.] Sometimes phones also can get the passcode via voice call or through a mobile app.

    There is at least one application that doesn't require using a phone: VeriSign "VIP Access Desktop". Runs on a computer, generates the passcode you need. But only works on a few sites. Most sites do SMS to a phone.

    Some people have tried using an SMS application or site (such as Google Voice), instead of a phone. Often doesn't work.

    However you do it, check ahead of time to see what happens if you lose your device (or it dies, or the battery runs out), or have to reinstall the security application (which may change the security ID), or want to log in through some other computer (if using the no-phone option). I guess you'd have to contact each vendor and answer security questions to get them to set a new password and security ID on your account. This could be a real pain if you change phone number or upgrade to a new phone or laptop; you'd have to contact all of the vendors you use. Some systems have a way to print out verification codes to use if your device fails; don't skip this step when turning on two-factor security.
    Eric Ravenscraft's "What Happens If I Use Two-Factor Authentication and Lose My Phone?"
    (Found these instructions for VeriSign VIP Access: "You need to save the VIP.tok from \Application Data\VIPAccess. You also need to save the registry keys HKLM\Comm\Security\Crypto\UserKeys\Microsoft Enhanced Cryptographic Provider v1.0\VipAccessKeyContainer and HKCU\Software\VIPAccess".)

    None of the consumer/free solutions seem to work for cases where multiple people would be sharing the same account, or where you switch around a lot and carry only one of your multiple devices (phone, tablet, laptop) at a time. If you use a computer (non-phone) app, how would that work with multiple computers (home desktop, work desktop, laptop) ?

    As of 9/2013, it seems some major sites that support two-factor authentication are Google, Facebook ("Login Approvals"), EBay, PayPal, ETrade, Twitter, Dropbox, Wordpress, Yahoo! Mail, (as of 11/2015) Amazon.
    Not supported on Citigroup, my credit union (a smallish place), my 401K manager (a large national corp).
    Two Factor Auth (2FA) (list of sites that do/don't support 2FA)
    VeriSign "VIP Member Sites"
    Whitson Gordon's "Here's Everywhere You Should Enable Two-Factor Authentication Right Now"

    Lucian Constantin's "5 things you should know about two-factor authentication"
    Internet2's "Two-Factor Authentication"
    Wes Siler's "Traveling With Two-Factor: How To Access Your Accounts Abroad"

    Eric Ravenscraft's "Google Adds a USB Key Option to Two-Factor Authentication"
    Robert Lemos's "Google offers USB security key to make bad passwords moot"

    Some serious security guys like YubiKey. Another prominent company is Feitian.

    Important places to use two-factor authentication:
    • Password manager.
    • Email accounts.
    • Financial accounts.

    Downsides of two-factor authentication:
    • If you lose your authentication device or it dies or it runs out of battery charge, now you can't access email etc through your computer too. Unless and until you have some emergency method, and it's close to hand.
    • If you take your laptop somewhere, you have to take your phone with you too.
    • Some carriers charge for SMS messages.
    • Login is slower.
    • There may be a charge for the authentication device or service.
    • If the authentication device plugs into a USB port, some places (internet cafe, library, etc) may not allow that.

    Russell Brandom's "Two-factor authentication is a mess"

  2. Use fake data as answers to the "security questions".

    If you give fake data as your mother's maiden name, town where you were born, etc, no attacker can look that up somewhere and know what answer to give. Of course, you have to write down those answers yourself.

  3. Computer security:

    Run the newest or newest-but-one version of your operating system, and turn on auto-updating.

  4. But this is a major problem for Android smartphones: on older phones, you can't update the OS to a later version, unless you "install a custom ROM". Android's update mechanism is somewhat broken, because phone vendors have no incentive to test and provide updates.

    See Android Custom ROMs section of my Android page.

  5. Anti-virus software:

    Install it, set it to update automatically, run a full scan every now and then.

    Things that loosely fall into this category:
    I use AVG (free) and Malwarebytes (free).

    If you use Adblock Plus, you can then install a malware site filter.

    Aurelian Neagu's "10 Warning Signs That Your Computer is Malware Infected"
    /r/techsupport's "Official Malware Removal Guide"

  6. Browser:

    Set your browser to update automatically; browsers contain security features that should be kept up to date.

    Enable security features in your browser: IE's "SmartScreen Filter", Firefox's Options/Security tab, Chrome's "Enable phishing and malware protection", Opera's "Enable Fraud Prevention".

    Use an "ad-blocker" add-on in your browser to protect against ads that contain malware (malvertising).
    uBlock Origin (get from here ?)
    Adblock Plus

  7. Computer firmware:

    Maybe check for updates to the firmware ?

    Intel's "Management Engine":
    Intel ME seems to be a big problem; maybe just avoid Intel chip-sets next time you buy a computer ?
    Lily Hay Newman's "Intel Chip Flaws Leave Millions of Devices Exposed"
    Erica Portnoy and Peter Eckersley's "Intel's Management Engine is a security hazard, and users need a way to disable it"
    From someone on reddit:
    "Do you have an Intel CPU from the last 10+ years? If so, then yes ME is enabled. If it weren't via HAP, you'd know."
    Shane McGlaun's "Here's How To Disable Intel Management Engine And Slam Its Alleged Security Backdoor Shut"
    "Sakaki's EFI Install Guide / Disabling the Intel Management Engine"
    Steven J. Vaughan-Nichols' "Computer vendors start disabling Intel Management Engine"

    From someone on reddit:
    "After I did the firmware update for my version of IME, I just made sure and disabled everything relating to IME/vPro in my BIOS/UEFI settings and also disabled its related services and related serial port in device manager in Windows."

    AMD's "Secure Processor" (previously known as PSP):
    Chiefio's "For deep security, use ARM, avoid Intel & AMD processors"

  8. Turn off the computer:

    When not using the computer, turn it off, so attacks can't get in.

    Maybe put critical data on a thumb-drive or external drive, and only mount that drive for brief periods when you need to use that data.

  9. Connection security:

    Use encryption on your connection: encrypted Wi-Fi, HTTPS web sites, maybe VPN (see VPN section later on this page).

    On your home network, make connections using Ethernet cables instead of Wi-Fi where possible (client device is close to router/modem). Wired connection is faster and more secure than wireless.

    Consider having separate home networks for your critical (computers, file server, phones) and untrusted (TV, refrigerator, security camera, baby monitor, game consoles, etc) devices. This may mean having to use two routers.

    When choosing a name for your home Wi-Fi network, choose something bland such as "network27". Don't include your name or address or brand of router in the network name; that information would help an attacker.

    EFF's "HTTPS Everywhere" browser extension

    wikiHow's "How to Secure Your Wireless Home Network"
    Eric Griffith's "12 Ways to Secure Your Wi-Fi Network"
    Decent Security's "Router configuration - easy security and improvements"
    Lifehacker's "Top 10 Ways to Stay Safe On Public Wi-Fi Networks"
    Smart Home Gear Guide's "17 Lockdown Strategies To Secure Your WiFi Network From Hackers"
    Who's On My Wifi (free app to scan your network)
    UIC-ACCC's "How can I secure my internet connection?"
    But: Nick Mediati's "The EFF wants to improve your privacy by making your Wi-Fi public"

    From discussion on reddit:
    Securing home Wi-Fi:
    • Use the WPA2 protocol. It has now been broken but the chances anyone will use it against you are slim.
    • Use a strong passphrase. Longer is better than more complex.
    • If you have a guest network, isolate it so it can access your internet but not your local network.
    • Where possible, use 5Ghz. It doesn't have good penetration so it's less likely to broadcast your network to your neighbors. Otherwise some routers will let you adjust the power of your broadcast.
    • Don't bother with MAC address filtering. It's just a headache and it's easy to bypass.
    • Apply any patches that are available, to clients and router.
    • Turn off WPS and uPnP and access to web interface/console from Wi-Fi.

    Alan Henry's "Why You Should Start Using a VPN (and How to Choose the Best One for Your Needs)"
    That One Privacy Site (VPN and email comparisons)

  10. Application-level encryption:

    For communication apps, person at other end has to use same software.

    Browser add-ons:
    Encrypted Communication (Firefox only; encrypt/decrypt blocks of text in web pages or docs)
    SafeGmail (GMail only; Chrome only) (Chrome add-on, or client app; encrypt/decrypt blocks of text in any web page)

    Other solutions require you (and person at other end) to change email providers or use different applications. Not feasible, in my opinion.

    We need transparent encryption of email:

    I wish some large email provider, such as GMail or Yahoo Mail, would start using end-to-end (client-to-client) encryption routinely, and transparently. When you click the Send button, software (maybe an open-source browser plug-in) looks to see if your recipient has a preferred encryption method and public key registered anywhere (or if one is cached locally, via prior key-exchange). If recipient does, the message gets encrypted (by open-source browser plug-in) via that method before sending. If recipient is not registered anywhere, message goes unencrypted, as usual. Simple ! And now the email provider itself can't read or decrypt the messages, and can't decrypt them for the government.

    The company that does this first could seize the mantle of "privacy champion".

    They still could do targeted advertising based on keywords: the plug-in that does the encryption first extracts a few keywords, and then passes them on along with the encrypted message.

    Searching your messages on the server would be affected; the server wouldn't be able to read the text of the messages. I suppose you could do a search by sending all of the encrypted messages to the client (browser), and decrypting them and doing the search there, but that would be horribly inefficient (but possible). Or search-keywords could be sent to the server along with each encrypted message (compromising security a fair amount, but enabling searching).

    Spam-filtering would be affected. If a spammer is willing to look up your public key and encrypt their message to you, it will have to be caught on the client, not the server. That's an issue. Need an open-source spam-filter plug-in or something.

    The reason I want an existing large provider to do this, as opposed to new secure-email startups, is that the change by an existing large provider would immediately make encryption easily available to hundreds of millions of existing users. No need for users to change providers, with new UI and new email addresses and having to transfer their contact lists. Most users will NOT move to new secure-email services; we need to get encryption into existing services.

    Mailvelope is a bit like what I want, although it's far from as transparent and integrated as what I outlined (which requires changes by Google, Yahoo, etc).

    Google and Yahoo were working on a couple of end-to-end things, but as of 2/2017 seem to have dropped their efforts.

    Once we have end-to-end encrypted message bodies, a few changes could secure the meta-data better. Move the subject line inside the message body before encrypting, and move it back out when decrypting, so all of the servers and middlemen see only a dummy subject line. Encrypt the destination user's email address in some way that the destination server can decrypt, so only the originating client and the destination server and destination client know the full destination address (all other servers and middlemen can see the destination server name, but not the real destination user name). Do same with originating user's email address, in way that only originating server and originating client and destination client can decrypt. Example: a middleman would see "From: 5$33!8* To: 7^h$ Subject: none".

    GitHub's "Overview of projects working on next-generation secure email"

    Secure messaging (text, chat, voice, video):

    Some people say that internet email fundamentally can not be made very secure, without a total redesign. So they use non-email messaging.

    There is a convergence between text-chat and voice-call and video-call applications. Text-chat applications are adding voice and video, Skype has text, etc.

    Some major choices:
    Google Voice and Allo and Duo ?

    Nate Drake's "Top 10 best secure messaging apps of 2017"
    Micah Lee's "Battle of the Secure Messaging Apps: How Signal Beats WhatsApp"
    Thorin Klosowski's "Secure Messaging App Showdown: WhatsApp vs. Signal"
    Hiding From The Internet's "Signal – Private Messenger"

  11. Specific problems:

    Remote-access software:
    Be very careful if you have remote-access software installed on your computer for some reason. If someone hacks it or it's misconfigured, the attacker can do anything you can do sitting at the computer, and it will look just like you doing it.

    Jason Fitzpatrick's "How to Lock Down TeamViewer for More Secure Remote Access"

  12. Keep account security info up-to-date:

    If your bank or credit card company sends you a security alert, but they send it to your old email address or old postal address, it doesn't do any good.

    If you never receive routine communications or verifications from your account at some company, figure out why and fix it, don't let it slide.

  13. Monitor your accounts for evidence of problems:

    At this point, there have been so many and such huge breaches (e.g. at OPM, Equifax, Anthem, more) that you should assume your Social Security number and DOB and credit-card info and email address have been stolen.

    Check the activity in your credit card and bank accounts every week or two. Check your credit record annually (free), or use a credit-monitoring service. Maybe use an identity-theft warning service. Maybe freeze your credit (a "credit freeze" or "security freeze"; usually free to apply and $5 to remove) or institute a fraud alert (free, but not as good).
    Kristin Wong's "Keep Your Identity Secure With a Credit Freeze or Fraud Alert"
    Jason Lloyd's "Why You Should Freeze Your Credit Report"
    FTC's "Credit Freeze FAQs"
    Check your status in a bank-account-monitoring service:
    ChexSystems' "Consumer Disclosure"
    LexisNexis' "Access Your Full File Disclosure"
    Apparently there is a salary-history database too; freeze that:
    KrebsOnSecurity's "How to Opt Out of Equifax Revealing Your Salary History"

    You can opt-out of some of this tracking:
    LexisNexis' "Lexis Nexis Opt Out/Information Suppression Request"
    SageStream Opt Out
    Advanced Resolution Services: see William Charles' "Two Credit Bureaus You Should Freeze Before You Apply For A U.S Bank Credit Card"

  14. Simplify your life:

    Do you really need email accounts at N different providers ? Each one has to be secured. Really need accounts at Twitter, LinkedIn, Facebook, Google+, Instagram, YouTube, 20 different online stores, etc ? Each one is a possible security or privacy problem. Really need 5 credit cards and accounts at 5 banks ? Reduce, simplify.

  15. Be smart:

    Be aware of security threats, and don't fall for them. Know how to recognize spam, scams, phishing attempts. False alerts that say "something is wrong with your computer, better run this scanning software right away !". Be especially careful when downloading and installing software.

    Max Eddy's "How To Protect Yourself From Social Engineering"
    Alan Henry's "Why Social Engineering Should Be Your Biggest Security Concern"
    IC3's "Internet Crime Prevention Tips"
    Decent Security's "How Computers Get Infected"

    If someone says "I got a strange email from you, your account must be hacked !":
    This does not necessarily mean someone has been "hacked". Perhaps some software scanned Facebook, found that A and B are Friends, and found A's email address in A's Facebook profile. Then a scammer sends an email to A, claiming to be from B.

    One way to check: A's email client may have a "show details" button or link, where you can see the actual email address the email originated from. It probably isn't B's email address, even though the displayed "from" name is "B".

    And of course scams are not just online, they also can come via phone or snail-mail or in person.
    Alan Henry's "Five Common Scams Directed at Seniors (and How to Avoid Them)"

Kashmir Hill's "10 Incredibly Simple Things You Should Be Doing To Protect Your Privacy"
Andrew Cunningham's "A beginner's guide to beefing up your privacy and security online"
Decent Security's "Windows Security From The Ground Up"
Wired's "Guide to Digital Security"
Haelan Man's "Digital Wellness? How I Found Peace of Mind in My Digital Life."
Kashmir Hill's "Journalist Invited Hackers To Hack Him. Learn From The Mistakes."
Adam Clark Estes' "How to Encrypt Everything"
Spread Privacy's "How to Set Up Your Devices for Privacy Protection"
Justin Carroll's "Thirty-Day Security Challenge"
Filippo Valsorda's "I'm throwing in the towel on PGP, and I work in security"
Fried's "The Ultimate Guide to Online Privacy"
Andy Greenberg's "How To Bust Your Boss Or Loved One For Installing Spyware On Your Phone"

Online Privacy

  1. Don't put really private stuff online. At all.

    Naked pictures of yourself or your spouse ? Personal embarrassments ? Dark secrets ? Something illegal ? Just don't put it online, or transmit it over the internet. Maybe don't even put it on your computer or phone or camera.

  2. Give "them" as little data as possible.

    Don't fill in all of those "profile" fields. Why tell Facebook where you've worked, where you went to school, who your family members are ?

  3. Give them fake data.

    Don't give them your real birthday, or real mailing address, or real phone number. Misspell your name slightly.
    [But: if Facebook or whoever later challenges you to produce real ID to verify your account, and your info doesn't match, you'll lose the account.]

    Similar when installing an OS, or using a brand-new PC for the first time. Give your PC a generic name like "laptopJ", create a user account with a generic name like "userK", instead of using your real full name. Those names will appear on networks and other places.

    But you can't give fake data to police or government or schools or insurance or banks. That may be illegal, or may come back to bite you later in some way.

    Email address:

    It may be a good idea to have separate email addresses for family, work, financial, social, shopping.
    Hiding From The Internet's "Compartmentalization"

    You can get a disposable email address, which exists just long enough to finish registering somewhere: 10 Minute Mail, Mailinator, others.

    A service which will "screen" your real email address, phone number, credit card number by giving out different info which relays to your info: MaskMe (Stop giving out your real personal info online with MaskMe, a new privacy tool). [Maybe name has changed to "Blur" ? Blur]

    A service which will "screen" your real email address, phone number, credit card number by giving out virtual info (but not relaying to your existing providers, I think): Sudo

    Another: "PlusPrivacy feature email identity management"

    End-to-end encrypted email:
    Highly recommended by security people: Protonmail
    Eric Mann's "End-to-End Crypto: Secure Email"

    But they may have quirks. For example, apparently Protonmail is incapable of sending a normal, plaintext email; only HTML-plus-plaintext or HTML-encrypted or internal-encrypted are supported ? Because the Protonmail server can't decrypt your messages, it can't do vacation-forwarding or server-based content-based filtering.

    On any service where you aren't the sole holder of the keys, there are vulnerabilities: Wired's "Mr. Robot Uses ProtonMail, But It Still Isn't Fully Secure"

    That One Privacy Site's "Email Section"
    PrxBx's "Privacy-Conscious Email Services"

    Phone number:

    It may be a good idea to have separate phone numbers for family, work, financial, social, shopping.


    Credit-card info:

    Virtual Credit Cards:
    You can get one or more Virtual Credit Card numbers. You may be able to set a purchase limit or time limit on the number. You might be able to get such a number from your existing credit card company.

    Such a number is virtual, not physical, so you can use it only online, not in a store. Don't use it for something you buy online but then pick up in person: air travel, hotel, rental car. Virtual numbers often don't work for overseas transactions, only within the country of origin. If your real number and all virtual numbers are issued by the same company, that company still can see all of your activity.

    Neil J. Rubenking's "5 Things You Should Know About Virtual Credit Cards"
    Alan Henry's "Privacy Lets You Create 'Virtual' Credit Card Numbers, Deactivate One Instantly If It's Stolen"
    Rebecca Lake's "Why Virtual Credit Card Numbers Aren't Worth It"
    Simon Zhen's "Virtual Account Numbers: What You Need to Know"


    Prepaid (debit) cards:
    You can get a physical card, so not just for online use. But refunds may get complicated. Any balance you load into the card might not be protected by banking laws, certainly not at the $50 limit of protection on a credit card.


    Photo ID card:

    Official government ID that doesn't give away your address: passport, or US passport card (available for $55 when you renew your passport).

    Some people carry a fake ID, to show to businesses that demand photo ID. I think it's legal as long as it's not a fake of a government ID, and you're not committing fraud. A fake corporate employee ID card from a fake corporation, maybe. Maybe add this fake person as an authorized user to your real credit card ?

    Maybe in the future we'll get "decoy" tools or services: something that posts fake info online to make it harder for others to figure out your true info. Fake pictures of you, fake address, fake postings, etc.

  4. Maybe use login/password info from elsewhere, instead of using your own.


  5. Use "blockers".

    Several ways to do this:

  6. Set the "do not track" option in your browser to (maybe) stop "ad tracking".

    In FireFox 10, it's: Options - Options - Privacy - Tell websites I do not want to be tracked.

    But: Jon Brodkin's "Yahoo is the latest company ignoring Web users' requests for privacy"

  7. Avoid "browser fingerprinting".

    When you use a browser to fetch a web page, the browser sends a "user agent" string that may say something like "firefox 54.0 on Windows 10". Same happens when a game console or media player application etc accesses the web. See WhoIsHostingThis's "What's My User Agent?". Other information is sent: an "accept header" saying what types of media can be returned, your preferred language(s).

    Then after the page is retrieved, Javascript code in the page can access your browser and determine more details about your configuration, such as what add-ons are installed in the browser, your time-zone, your screen resolution, what fonts are installed in your system.

    All of this information can be used to form a "browser fingerprint" that may be unique to you, or close to unique.
    Am I Unique?'s "What is browser fingerprinting?"
    Lance Cottrell's "Browser fingerprints, and why they are so hard to erase"

    This fingerprint can be used to track you, even across multiple web sites, even if you turn off cookies, change IP address, use a VPN, etc.

    Key ways to avoid fingerprinting:
    • Use an ad-blocker.
      uBlock Origin
    • Turn off Javascript.
      But this will break some sites (mostly some banks and govt sites), even if you whitelist them. Sometimes I have to switch to a different browser that does not have NoScript installed.
    • Fake or random user-agent string.
      Paul Ferson's "How to Change the User Agents in Firefox, Chrome and IE"
    • Minimize the number of browser add-ons you use.
    • Use a common browser and keep it updated.
    • Install multiple different browsers on your system, and use each for a different set of web sites.
    • Set the "do not track" option in your browser to (maybe) stop "ad tracking".
    • New features coming in Firefox, from Tor: set privacy.resistFingerprinting to true.

  8. Use the privacy controls in the ISP and social networks and sites you use.

    Very important: Log on to the web site for your ISP and find any privacy settings they have for your account.

    Facebook lets you control the access that Apps and external sites get to your data: go to Account - Privacy Settings - Apps and Websites - Edit your settings.
    Melanie Pinola's "The 'Nuclear' Option for Total Facebook App Privacy"

    Turn off your Google search history: here
    YouTube: profile - Video Manager - History - Clear All Viewing History, and then History - Pause Viewing History, and then Search History and do the same clear-and-pause.
    See and turn off data aggregating by BlueKai: here

    Handy central places to start:
    Stay Safe Online's "Check Your Privacy Settings"

    Instead of Google Search, use a service that promises not to track you:
    StartPage (but image search is slow)

    Privacy settings in Firefox browser:
    Privacy Settings add-on

  9. Apparently, "opting out" via NAI stops targeted ads, but does not stop companies from tracking your activities.

  10. Delete most cookies every now and then.


    Or delete all cookies every time you close the browser:
    Ian Paul's "How to automatically delete your cookies every time you close your browser"
    Chris Hoffman's "How to Automatically Clear Private Data When You Close Your Browser"
    But if you do this, you'll probably want to be using a password manager, because you'll be logging in to sites a lot.

  11. Encrypt your traffic: use HTTPS web sites, and/or a proxy or VPN.

    Definitely use HTTPS on all of your sensitive sites: email, financial.

    But not every HTTPS site implements security to the same level; you can test a site using Qualys SSL Labs' "SSL Server Test".

    See next section about proxy and VPN.

  12. Don't always use the same IP address, or hide your IP address via a proxy or VPN.

    Changing IP address periodically:

    If you're connecting through a home Wi-Fi and cable router/modem (and no VPN), you probably can't change your external IP address. The router/modem probably is using one external IP address for all devices on your home network. To test this, open browsers on two devices simultaneously and go to on both devices. You'll probably see the same (external) IP address for both devices.

    Try power-cycling the fiber router/modem, and see if it comes up with a new external IP address. It may not. Try powering it off for longer, such as overnight.

    Try contacting your ISP and asking if they can change your IP address. If they ask for a reason, I guess you could say "to increase my privacy, to make it harder for advertisers to track me" ?

    If you're connecting some other way, you may have a chance of changing IP address. On Windows, create a CMD file containing "ipconfig /release && ipconfig /renew" and run it as Administrator. Check before and after, using

    WikiHow's "How to Refresh Your IP Address on a Windows Computer"


    • If you use:Who can see what domains you accessWho can see your content
      HTTP to ISPLocalDevices + YourISPLocalDevices + YourISP + DestISP + DestSite
      HTTPS to ISPLocalDevices + YourISPDestSite
      HTTPS to VPNclient to ISPVPNDestSite
      HTTP to VPNclient to ISPVPNVPN + DestISP + DestSite

    • If you use HTTP and Wi-Fi to ISP, anyone spying on the Wi-Fi also can see every site and every web page and URL you visit and every search you do. If the Wi-Fi is in your house and encrypted, probably no one is spying on it. If it's public Wi-Fi in a cafe or something, there's a reasonable chance that someone will be spying. Also, your ISP knows your name and address, and can see every site and every web page and URL you visit and every search you do. They could log and monitor and sell this data.

    • If you use HTTP and wire or fiber ISP, your ISP knows your name and address, and can see every site and every web page and URL you visit and every search you do. They could log and monitor and sell this data.

    • If you use HTTPS encryption to ISP to sites, HTTPS encryption is used between you and the web sites. Your ISP knows your name and address, and can see every site (domain) you visit, but NOT web pages and URLs and searches. They could log and monitor and sell this data.

    • If you use HTTPS to ISP to VPN to sites, HTTPS encryption is used between you and the web sites, and an additional layer of HTTPS encryption between you and the VPN server. So your ISP knows your name and address, and can see only that you're talking to the VPN server; ISP can't see any site (domain) or page or URL or search data. The VPN may not know your true name and address, and can see every site (domain) you visit, but not web pages and URLs and searches. Also the VPN exit may be in another country, so no one on that end knows what country you're in. And all of your traffic to site X will be mixed with traffic from other users of the same VPN to that same site, so it's harder for a spy on the site connection to separate out your traffic.

    • If you use HTTP to ISP to VPN to sites, a layer of HTTPS encryption is used between you and the VPN server. So your ISP knows your name and address, and can see only that you're talking to the VPN server; ISP can't see any site (domain) or page or URL or search data. The VPN may not know your true name and address, and can see every site and every web page and URL you visit and every search you do. They could log and monitor and sell this data. Also the VPN exit may be in another country, so no one on that end knows what country you're in. And all of your traffic to site X will be mixed with traffic from other users of the same VPN to that same site, so it's harder for a spy on the site connection to separate out your traffic.

    • Not all web sites support HTTPS.

    • "The ISP" could be your home ISP, or one used by your school or library or restaurant where you use Wi-Fi. So a VPN is not just protecting against your home's ISP.

    • Some VPNs may sell your data.

    • Some drawbacks of using a VPN:
      • You will pay a performance penalty, the only question is how much.
      • You may pay money for the VPN.
      • Some sites may not work or may impose a CAPTCHA if they see your traffic is coming out of a VPN. 7/2017 this is becoming more common.
      • Some sites (such as govt or credit-reporting companies) may not work if they see your traffic coming from a foreign country.
      • Some sites (such as bank or PayPal) may trigger a security flag if they see your traffic coming from an unusual country.
        My bank said this:
        We do not prohibit the use of a VPN per se, but VPN use often triggers our automated high-risk login protocols which lead to temporary account restrictions.

        We strongly suggest if you choose to use a VPN that you also enable two-factor authentication on your account. An account with active two-factor authentication should be exempt from automated restrictions.
        But your VPN may always have its traffic coming from a certain country, and you may be able to specify a static IP address. So you could reduce or avoid this problem.
      • [To avoid the last three issues, you may be able to add VPN exceptions or a proxy so that some sites don't go through the VPN, or set one browser or browser profile to use the VPN and another to not use it.]
      • Some networks (such as a school or library network) may ban/block VPN use.
      • You're adding another layer, another point of failure, to your system. If the VPN or its ISP is down, you're down.
      • Your ISP has to obey the laws of your country; the VPN may be located in some foreign country under a different legal system. The VPN company may be less regulated than your ISP.
      • If the VPN shares IP addresses among many customers, you may suffer from the bad behavior of other users. For example, suppose user X uses address N to do spamming, Google tags that address as a spammer, then you connect to the VPN and start using address N ? Maybe Google tags you as a spammer. Avoid VPNs that share IP addresses among customers ?
      • Some networks (e.g. hotels, schools) may disable use of a VPN, and some VPN clients may not inform you of this. So you could browse for a while thinking you're using the VPN, when you're not. The feature where the VPN client software disables all internet access if the VPN disconnects is called a "kill switch".

    • Many of the advantages of HTTPS and VPN can be lost via Javascript or user's own actions. What good is it to have the VPN hide your originating country if Javascript on the web page gets your location from the browser and sends it to the web site ? What good is it to hide your real name and address from ISP and VPN if you just go ahead and post those things on Facebook anyway ? In each case, you're not giving the info directly to the ISP or VPN companies, but you're revealing it. So HTTPS and VPN by themselves are not cure-alls.

    • I think there is a vulnerability if your computer connects to internet automatically at startup, and your VPN client is running in the computer (not in the router). When the OS boots, various services and apps on the computer my access the internet directly before the VPN client starts up, revealing your true IP address to some sites.

    • VPN client software:

      To use a VPN, you have to have some client-side software installed at some level. Could be:

      • Add-on in browser (so works only for that application, similar to a proxy), or

      • A layer in OS networking stack on client computer (so each computer in the house has to install it), or

      • In router used by all client devices in the house.

        Some VPNs have client software that can be installed in your home router/modem. Only a few home routers support this, and maybe only pre-installed before you buy the router. Advantages: nothing has to be installed on each client device, some client devices (such as game consoles) are locked down and you can't install VPN client software on them, new devices automatically use the VPN, you administer the VPN client in only one place. But if that home router/modem is owned by your ISP, they may be able to see your traffic before it goes into the VPN. And if you need to disable the VPN to play a game or stream video or something, it may get disabled for all devices. Sometimes you can put a list of domains into the VPN router client, so access to those sites does not use the VPN. Another disadvantage: if you take your phone/laptop to another network, it no longer has access to the VPN.

        From someone on reddit 6/2017:

        > I want to buy a used router/modem for $100
        > that would run a VPN client.

        On a $100 budget you won't be able to get a new modem and router and have a router that is decent for VPNs.

        Consumer-level routers are generally woefully underpowered for OpenVPN, so you need the best router CPU that you can get for the budget you have. An underpowered CPU in the router will severely limit your performance to all devices connected through the router while on the VPN.

        Also consider the OS of the router. Asus has done a lot of work to make the OpenVPN install process very easy on their routers, and many other vendors do not support OpenVPN out of the box and require flashing the router to DD-WRT or Tomato, which can be hit and miss with support for your router hardware and also be an older build that contains security vulnerabilities.

        DD-WRT does have the advantage of being open source, unlike AsusWRT, but it really is a sh*tshow for first-time VPN users.

        Based on your budget, i'd get a mid-range consumer-level router from your preferred brand, and connect to the VPN using a regular OpenVPN client on the devices that you want protected. This is because a typical PC (even an old one) has many times over faster CPUs for VPN usage.

        This setup would give you the protection of a VPN, with decent speeds (if your VPN provider is fast) and not break your budget.

        Router specifically built to run a VPN client: InvizBox

      The client software could be:

      • Proprietary to the VPN vendor, or

      • Built into the OS, or

      • Open-source standard (OpenVPN)

      OpenVPN is:
      • A standard communications protocol, and
      • An open-source protocol layer in the 7-layer stack, and
      • An application to start and manage the OpenVPN protocol layer.

      It seems to me that if the client piece is proprietary software from the VPN vendor, you're trusting it to a great degree: it can see all of your unencrypted traffic and encrypted traffic.

      Michael Horowitz's "An introduction to six types of VPN software"

    • Some VPNs have server software that can be installed in your home router/modem, so while traveling or working you can access a shared disk or devices on your home network.

    • Who can monitor/log your activity ?
      The choice is:
      • Your home ISP, if you use no VPN.
      • The VPN service, if you use a commercial VPN.
      • The cloud service, if you use your own VPN server hosted on a cloud service.
      • Your home ISP, if you use your own VPN server hosted at home.

    • Summary:
      • Definitely use HTTPS on every site that supports it.
      • Using a VPN hides HTTP traffic from your ISP, and others on your network.
      • Using a VPN has costs, in performance and functionality and maybe money.
      • Even if the VPN is logging and selling your data, that may be better than your ISP doing the same, if you give fake ID info to VPN.

    Alan Henry's "Why You Should Start Using a VPN (and How to Choose the Best One for Your Needs)"
    Thorin Klosowski's "The Biggest Misconceptions About VPNs"
    Max Eddy's "The Best VPN Services of 2017"
    TheBestVPN's "Best VPN Services"
    Amul Kalia's "Here's How to Protect Your Privacy From Your Internet Service Provider"
    Troy Wolverton's "No perfect way to protect privacy"
    Jonas DeMuro's "7 good reasons why a VPN isn't enough"
    VPN Scam's "How to Avoid VPN Scams in 2017-2018"
    reddit's /r/VPN
    Private Internet Access (PIA) VPN
    Wikipedia's "OpenVPN"

    General complaint, from /u/wombtemperature on reddit 5/2017:

    This VPN industry needs a wake-up call, ELSE a better way at helping the average joe at Starbucks. Guys. Like. Me.

    I read. As such, I know the importance of a VPN. In fact, I have spent hours/days reading up on them. I have made excel spreadsheets to compare them (and looked at the ones on "that site"). I even WANT to give you my money to insure I have a good one. As such, I have tried 4 paid popular ones I won't mention as I don't want to call them out, and spent a ton of time testing them on my PC and mobile.

    They all are frustratingly SLOW. Or interfere with connections.

    No matter what, all I want is a FAST secure connection I don't have to think about. Yet, I can't find a VPN that doesn't bring my public and often home networks connections to a crawl. The expected "30% drop" is BS. And none automatically find me the best servers, and in fact often I can get faster servers 5000 miles away, but I have to manually select them.

    I understand its complicated. But I have stuff to do. Seriously. Which is why I want to pay someone else to think about these things and give me a good product.

    You all sales-pitch me the "fastest speeds" but then I watch as my connection up and down speeds drop to pathetic - and I have the spreadsheets to prove it.

    To anyone listening I speak for the masses ... take my money and give me a decent, secure VPN connection.

    And if I am just not "reading enough" to know how to get what I am looking for, then it highlights my point that there is a problem out there for the non-technical guys like me who just want security without massive compromise and hours of research.
    From /u/Youknowimtheman on reddit:

    When we talk about speed drops, you're going to lose ~9% just because of how the encapsulation and encryption works. You're also going to lose about 10ms on pings because the actual encrypting and decrypting takes time.

    It is also important to manage expectations when we talk about privacy networks that are based on shared connections. We have had a rash of users on our service that are unhappy with our "slow" performance because their gigabit connection slows down to 190Mbit. They don't understand the nature of VPNs and that in order to keep their information private, their traffic has to be mixed with other users on a server, and these servers are running the same 1Gbit connection that they have. Yes, it is 20% of your line speed, but at the same time it is extremely fast for the market generally, and pretty much the limits of what you'll see on a server with proper user densities to protect your information.

    If you're talking about a 30% drop on 10Mbit that is significant. If you're getting a 30% drop on 200Mbit that's absolutely normal.

    There's also other factors that play into VPN performance like distance from the server, which protocol they are using, etc.

    In other words, you're always going to have some loss. If all factors are good, you can minimize that loss up to a limit in speed. More than 200Mbit just isn't going to happen on a safe and private connection generally.

    IPv6, from someone on reddit 6/2017:

    > why do many VPN setup guides advise you to disable IPv6 ?

    A lot of VPNs only handle IPv4 so on those any IPv6 traffic bypasses the VPN.

    Easiest fix is to disable IPv6. Better long-term solution would be to get a VPN that properly handles IPv6.


    ... the main reasons are:

    • Many ISPs still do not support ipv6 to clients. Unlike retail ISPs, VPN providers tend to be global services, so this is not a small deal.

    • Less than 20% of server sites support ipv6 - google conveniently tracks these sorts of stats.

    • ipv6 has very different configuration and security characteristics than ipv4, especially in extensibility at a protocol level. It is very easy for network and stack providers, i.e. including your OS, to mess up on both fronts, leading to an insecure network potentially at multiple levels. These issues are several factors worse on mixed networks, i.e. tunnelling ipv6 through ipv4 or ipv6 and ipv4 on same networks.

    • Related to the above, ipv6 is still maturing. Even the hardware tech to support both the equivalent level of configuration and security at scale for ipv6 is not readily available or is more costly than ipv4.

    • By default ipv6 uses globally routable addresses, i.e. every client gets an address that uniquely identifies them perhaps forever for a given ISP-client combination. Any leak there would be bad news. Since many VPN providers cannot even maintain leak-free status in ipv4, ipv6 over a VPN is not something to be carelessly keen about.

    • OpenVPN, the most popular retail VPN protocol, has been slow to add ipv6 support and it is still incomplete.

    That's why, if you really care about security, your first concern is finding a strong VPN provider. Something like supporting ipv6 is not on most people's priority list, including not your VPN provider, except the best-in-class ones that at least prevent leaks at the client no matter which IP protocol they use.


    Most budget/end user VPNs only cover IPv4 traffic, and anything sent over IPv6 is ignored.


    I have seen anecdotally IPv6 messing up network applications. On more than one occasion.

    Campbell Simpson's "CSIRO: Most Mobile VPNs Aren't Secure"
    Sven Taylor's "VPNs are Using Fake Server Locations"
    Violet Blue's "Is your VPN lying to you?"

    If you want to host your own VPN, you shouldn't do it on your home network, because you'll still be using your home ISP. Instead, you need to have a different ISP for your VPN server. Which probably means hosting the VPN server in a cloud service.
    Jim Salter's "How to build your own VPN if you're (rightfully) wary of commercial options"

    I tried ProtonVPN 9/2017:
    I don't see any slow-down, but I am in Spain and mostly using USA web sites, so my speeds probably already were slightly low.

    If I'm using a VPN server in another country, and do a Google search, Google changes country to France or Latvia or wherever the VPN server is. So I get results in French or Latvian or whatever.

    Each time I change to a VPN server in a new country:
    • Yahoo Mail may warn about new time zone, sends email about login from new location.
    • FB says suspicious activity, answer questions, or sends email about login from new location.
    In Windows 10, if you run the VPN and then click on the Network icon in the system tray and connect to Wi-Fi, it's possible to get connected to both the VPN and the normal Wi-Fi simultaneously. To fix this, I think you have to disconnect from both, then connect to Wi-Fi, then run the VPN.


    A proxy just redirects your traffic, making it come out from a different computer with a different IP address. Doesn't add any encryption. And typically must be configured for each application where you want to use it, whereas a VPN affects all internet traffic.

    Proxies have most of the same drawbacks as VPNs (added point of failure, some sites may not allow, have to trust provider, etc), but the performance penalty for a proxy should be much less than that for a VPN.

    Jason Fitzpatrick's "What's the Difference Between a VPN and a Proxy?"

    Hide My Ass! (free proxy server)
    Public CGI (Web, PHP) anonymous proxy free list
    search for Firefox proxy add-ons


    A firewall lets you control what kinds of traffic flow in and out of your network.

    Cisco's "What Is a Firewall?"
    Palo Alto Network's "What Is a Firewall?"
    Chris Hoffman's "Do I Need a Firewall if I Have a Router?"

    A firewall could be:

    Torrent Seedbox:

    A Seedbox is a torrent client on a cloud/server computer. All torrents go to that server, then you FTP from that server to your computer. So if your ISP doesn't allow torrenting, or you're downloading copyrighted material, this evades those problems.

    Seedbox Guide's "What is a seedbox?"


    Most likely, your computer is using either Google's Public DNS ( or, or a DNS run by the ISP you are using, or is set to find a DNS automatically (which probably means: DNS run by the ISP).

    The DNS can see what sites (domains) you are connecting to, but not which pages or URLs or searches you are doing on those sites.

    If you're using Google's DNS, and don't want Google to know what sites (domains) you visit, you can change to another DNS.

    If you're using the ISP's DNS, and are not using a VPN, there's no point in changing DNS, the ISP sees all of the sites you use regardless of the DNS.

    If you're using the ISP's DNS, and are using a VPN, you could change to another DNS, accessed through the VPN, and the ISP will not be able to see anything except that you're accessing the VPN. No sites (domains), no pages or URLs or searches.

    If you're using a VPN or proxy or Tor to hide your normal traffic from your ISP or someone spying on your network, yet your DNS traffic is NOT going through the VPN etc, this is called a "DNS leak". A web page may be able to use Javascript to find out your real IP address, even though you're using a VPN etc.
    Wikipedia's "DNS leak"
    DNS leak test

    Some good reasons to use Google's Public DNS:
    Joseph Caudle's "Why and How to Use Google's Public DNS"
    Vijay Prabhu's "How to Change Your Default DNS to Google DNS for Fast Internet Speeds"

    Choosing a DNS by speed:
    John E Dunn's "Best 6 free DNS services"
    Remah's "How to Find the Best DNS Server"
    Chris Frost's "Clearing the DNS Cache on Computers and Web Browsers"

    My computer (running Windows 10) was set to "find DNS automatically", which meant it was using the DNS run by my ISP. I ran namebench several times, and results varied, but generally the DNS run by my ISP was fastest or among the fastest. So I left my computer set to "find DNS automatically".

    From someone on reddit:
    "some routers ignore individual device settings, so if that's the case you have to change the DNS settings on your router to whatever server you want to use"


    If you're doing illegal things, don't expect a VPN or proxy company and their ISP to shield you if they're served with a court order. They may be forced to log your activity and trace you and give the data to law enforcement.

    MAC Address:

    This is an address unique to the network access card/hardware in your device.

    Your MAC address doesn't get out to the Internet. Only people on the same LAN as you can see your MAC address. (That sometimes includes people sharing Wi-Fi with you.) But if you're using public or store or hotel Wi-Fi, now the operator of that network knows your MAC address, and can sell that info. It can be used to track your activity across networks and sites.

    Mac Makeup or Technitium MAC Address Changer can change your MAC address.

  13. Stay logged out of Google and Facebook et al as much as possible, as you browse other sites.

  14. Don't use everything from one company.

    If you use Google Apps, Google Docs, Google Sites, Chrome browser, GMail, Google search, Google Maps, and Google+, then of course Google is going to know a lot about you. Instead, spread it around: Yahoo Mail, Facebook, some free web hosting service, Firefox browser, Google search, etc.

  15. You can delete your accounts on various services, although often they make it hard to find out how to do that.

    Some people say: instead of just deleting an account, first go in and delete as much of your data as you can, and change as much of the rest as you can to fake data. Maybe let it sit in that state for a couple of weeks. Then delete your account.

    David Nield's "The Complete Guide to Dumping Google"

  16. Turn off features you don't use.

    Either turn them off permanently, or enable them only when you want to use them.

    Don't use Bluetooth, NFC, infrared, Cortana, Siri, location/GPS services ? Turn them off completely, at the OS level. Don't use some old applications ? Uninstall them, or turn off their update background services.

    Maybe turn off location-monitoring services and apps in your smart-phone and browser. But your cell-phone company will always know where your phone is, if it's turned on, or maybe even just if it has a battery in it.

    Turn off the whole device if you're not going to use it for a while. Does your internet-connected computer need to be running 24/7 ?

    Put tape over the webcam on your laptop.
    Or software:
    Kioskea's "Windows 8.1 - Prevent apps from using your webcam or microphone?"

    Turn off the microphone on your laptop or smartphone.
    Maybe put a dummy plug into the external microphone jack.
    Tape over the built-in microphone opening doesn't really work.
    Or software:
    Alan Henry's "How to Stop Web Sites from Potentially Listening to Your Microphone" (Chrome only)
    Jignesh Padhiyar's "How to Find and Prevent Apps from Accessing Your iPhone's Microphone in iOS 7"
    Kioskea's "Windows 8.1 - Prevent apps from using your webcam or microphone?"

  17. Know the features of your devices.

    Using router/modem supplied by your ISP:
    Parts of a router/modem:
    • WAN connector: connects to outside cable or phone line.
    • Modem: from WAN connector, converts fiber or phone signal to digital, sends to router.
    • Router: intelligence that converts between internal (LAN) and external (WAN) IP addresses, using NAT.
    • LAN Switch: connects all the parts of the local network: LAN side of router, Ethernet ports, Wi-Fi AP.
    • LAN Ethernet connector: wired connection to client device in home.
    • Telephone connector: wired connection to telephone in home.
    • USB connector: for a disk drive to be shared on the LAN.
    • Wi-Fi access point: wireless connection to Wi-Fi devices in home.

    From someone on reddit:
    If your ISP can access your modem (and if you're using an ISP-supplied modem, it'd be foolish to assume they can't), they can see anything your modem can potentially log (think SSIDs, MACs) via a little-known protocol known as CWMP. And this is to not even begin the implications that they could not simply be retrieving logs, but actively tampering with data. So yes, do not use ISP-given devices, get your own. This is critical.

    Ways to avoid the ISP-supplied router/modem:
    • Ask ISP if you can replace it with a router/modem you own yourself.

      From someone on reddit:
      "Google for modem compatibility lists. You can generally find a site that sorts by state and ISP and lists which current model modems would or should work."

    • Ask ISP if they can set their router/modem into "bridge mode", so you can add your own router behind it.

      This amounts to turning off the router and Wi-Fi in the ISP-supplied router/modem box, using router and Wi-Fi in your own new router box, and connecting the two boxes via an Ethernet cable. Connect all home devices (except telephone ?) to your box, not the ISP's box. Now the ISP-supplied box doesn't have access to your LAN, it just sees what comes out of the bridge-Ethernet port of your new router box.

    Keep it simple. If you have your smartphone controlling your door-locks and security-cameras and automatically uploading photos to Google+ and accessing your LAN and the internet, you really don't know everything that is happening and everything that can go wrong. Better to have some compartmentalization, some things that happen only on one device or happen only manually.

  18. Know the vulnerabilities of your devices.

    Are there any known security flaws in your internet-connected devices, especially devices you can't update ? For example, security cameras: article1, article2. And home Wi-Fi routers: article3.

    For each of your devices, read the manual, and do some internet searches for "exploit/vulnerability/hack/problem MFR model NNN".

  19. In Windows, don't routinely use an Administrator-privileged account, use a non-Administrator account.

    From someone on reddit:
    > If I already have my account as admin
    > is there a way to demote it?

    Create another user account. Name it Admin or Bambi or whatever floats your boat at that particular second. Set that account as a system administrator. Log out of your current account and into the new account. Change your normal account to a a standard user. Log out of the new admin account and back into your regular account.

    All of this is done through the 'User accounts' control panel applet.

  20. Deleting browser history really does nothing for your privacy, unless someone steals your computer and looks at your history.


  21. Anything you store on a server may reduce your privacy. Your contact list in email, buddy list on instant messaging, Friends list on Facebook, etc. Any emails in your Inbox, or saved long-term in a "folder" within your email service. Okay, email or IM or Facebook won't function without those contact lists. But maybe you shouldn't use your email as a data store.

  22. You have few rights to anything you store on or do with your employer's computers or networks. Don't use them for private things.

    Kashmir Hill's "How To Tell If Your Boss Is Spying On You"

  23. There are more-aggressive things you can do, but I think the cost/inconvenience is too high for the benefit, in most cases. (And some of them require your friends to use the same applications, or adapt to your behavior.) Tor browser, run Linux (because you don't trust Microsoft or Apple), use a clean-boot OS, use a virtual machine inside your real OS, multiple throwaway email accounts, encryption everywhere, prepaid throwaway phones, email and VoIP services and social networks specifically designed to be more private, run your own email server, use two computers (one networked and other not), etc.
    Peter Bright and Dan Goodin's "Encrypted e-mail: How much annoyance will you tolerate to keep the NSA away?"
    "The Hostile Email Landscape" (maybe from Jody Ribton)

    Windows user trying Linux:

    The Ultimate Linux Newbie Guide
    Distro Chooser

    From /u/Im-Mr-Bulldops on reddit 5/2017:

    • Pick a newbie/popular distro like Mint or Ubuntu(or one of the derivatives[Kubuntu, Lubuntu, Xubuntu, etc]) and install it to a flash drive to test it out. They're designed to be easy to use and come with plenty of community support for any and all problems you might have.
      • Start by making a live USB:
        • Download a live USB creator. [I recommend Rufus]
        • Download the ISO file for the distro you want. [Start with Mint, it's so easy to use and similar in style to Windows that my mother can use it and she can't even add contacts to her phone] [I also suggest downloading your distros via torrent as it's much, much quicker]
        • Launch Rufus, select your flashdrive (make sure it's empty), select "create a live USB using:[ISO Image]", browse to where the ISO is located (click the little disk icon to the right of the dropdown menu), select it, and click "Start".
      • When it's done, reboot your computer and boot into BIOS (usually by pressing F2/F10/F12/ESC --- if you have any problems, search for "[computer manufacturer] boot into BIOS" and you should be able to find what key you need to press at startup).
      • Navigate to Boot Options, move the USB option up to the first position, then save and exit, it'll reboot and you should shortly see the boot menu.
      • Select "Try [distro] without installing" and it'll boot up into a live version of the OS so that you can give it a try without any changes to your computer.
      • Keep in mind that the live version will run slower than the installed version but it'll give you a chance to test it to make sure you like the look and feel of the distro and also that it works with your hardware. In my experience, most hardware will work fine without any tweaking. The only exception to this is that Ubuntu seems to be lacking certain drivers lately, for instance my laptop's SD card reader doesn't work out of the box while Mint and other distros recognize it fine. Another reason I suggest Mint for new users, plenty of hardware support and it comes with a variety of codecs so your foray into Linux will go as smoothly as possible and require very little tweaking.
    • After you figure out which distro you wanna use, look up a guide on how to install it on your hard drive. They're all very straightforward and they should come with pictures so you can easily see exactly what you need to do. Since you're just starting, I would suggest trying a dualboot. That way you've still got Windows if you need it (eg: for a Windows only app).

    From someone on reddit 6/2017:
    "Fedora is bleeding edge. if you want stability, then go with an LTS distro like Ubuntu 16.04 or CentOS 7".


    Tor is a network, where the Tor browser talks to an entrance node, which talks to a middle node, which then talks to either an exit node (for normal internet traffic) or an onion web site.

    It is possible to use Tor and still not have privacy or anonymity. If you're the only person on your network using Tor, perhaps your activity can be correlated with the traffic coming out of the exit node. If you log in to a web site using your real info, that site will know who you are. If you use HTTP, the exit node and its ISP can see your traffic.

    If you're using Tor browser instead of a VPN, only the browser's traffic is going through the Tor network; traffic from other applications does not.

    Tails is a Linux system where all internet traffic goes through the Tor network.

    Andy Greenberg's "The Grand Tor: How to Go Anonymous Online"

    Virtual Machine:

    You can run a VM inside your real OS. It will look like a real machine to software, but then when you're finished doing stuff, you end the VM, and anything that happened inside it (including any bad stuff) is deleted.

    But some things I don't understand about this: So you can't bookmark any sites, unless you hop out of the VM and update the browser in your real OS ? If you download a picture or something, you can't get it out to the real machine, it's going to disappear when you shut down the VM ? If you want to copy something from web email to the clipboard, then save it in a file, that file will be in the VM, not the real OS ? If you log in to web email or reddit in the VM, and have a virus in the VM, it could do something nasty to your web email or reddit ? Do you never run a browser in the real OS ? Or you do only lightweight, throwaway browsing in the VM and do "serious" web stuff in the real OS ?

  24. Your friends and relatives are a threat to your privacy. They may post about you on social networks, put pictures of you online, mention you in emails.

  25. There is no such thing as total privacy, or perfect security. If the government or a spy agency or law enforcement really wants to get your data, they can get it.
Paul Bischoff's "75+ free tools to protect your privacy online"
Fried's "The Ultimate Guide to Online Privacy"
Karegohan-And-Kamehameha's "privacyguide"
Noah Kelley's "A DIY Guide to Feminist Cybersecurity"
Sarah Jeong's "The Motherboard Guide to Avoiding State Surveillance"
"The Motherboard Guide to Not Getting Hacked"
xkcd's "Security"

My desktop computer configuration:

Smartphones: Android, iPhone, etc
Fieke Jansen and Helen Kilbey's "Cybersecurity Self-Defense: How to Make Your Smartphone More Secure"
Spread Privacy's "How to Set Up Your Devices for Privacy Protection"

My smartphone configuration:

Facebook is a special case, because they know so much about you, and they have code on many other web sites, and they buy data about you from other services. Vicki Boykis' "What should you think about when using Facebook?"

How do companies justify selling your information ?

  1. They are giving you a great free service, and they need to make money to keep it going.

  2. With more info, they can give you more relevant ads and news items and pointers to new Friends.

  3. They give you lots of ways to control the privacy/selling of your info.
    [But sometimes have been caught cheating on this.]

  4. You agreed to it when you signed up for the service. And you could stop using their service and close your account.

  5. They sell your info in general/aggregate, not your specific name, address, phone number, etc.

Minimizing knowledge and connections

Privacy In General

Why should I care about privacy ? I have nothing to hide. I'm not a criminal.

Privacy matters because there are criminals and corporations out there trying to rip you off.

From HFTI:
Privacy isn't about hiding something. It's about being able to control how we present ourselves to the world. It is the right to keep things to yourself. It's about personal dignity.

"All human beings have three lives: public, private, and secret."
-- Gabriel Garcia Marquez

Suppose you do some searches about cancer, or diabetes, or alcoholism. Do you want that info popping up the next time you apply for health insurance or car insurance or a job ? Even if you don't have cancer, diabetes, or an alcohol problem ? Easiest for the company to just deny you the insurance or the job, rather than investigate or take a risk.

Suppose you're a woman with an abusive ex-husband, or a creepy ex-boyfriend ? Do you want them to be able to track your location in real-time, or track you even if you move to another city ? Or to know where your new job is, or who many of your friends are ?

Suppose some of your friends or family care much more about their privacy than you do about your privacy. Exposing your info to the world could expose some of their info to the world. It even could affect future generations of your family: suppose you post about some genetic disease you have, and years or decades later this affects your descendants ability to get medical insurance ?

Some people do depend on privacy for their profession, or their life. They work in journalism or activism or investigations. Maybe they live under oppressive regimes, or investigate organizations which have a history of retaliation against opponents, or work in the justice system (where criminals might retaliate against them). If the rest of us don't value our privacy, there will be fewer tools to protect them, too.

From noir_lord on reddit:

Some people (including myself) are not comfortable with a faceless corporation knowing Now each of those on its own is somewhat unsettling, but when you combine all that together and then you don't really know how your data is handled now and how it might be handled in the future, then it starts to get really unsettling.

The thing with all this data is that it just accumulates, and over time the companies can really build up an accurate profile of you, and that is just f***ing creepy.

From Daniel J. Solove's "Why Privacy Matters Even if You Have 'Nothing to Hide'":

Some responses to the "I've got nothing to hide; you have something to hide only if you're doing something wrong" argument: ...

... the nothing-to-hide argument stems from a faulty "premise that privacy is about hiding a wrong." Surveillance, for example, can inhibit such lawful activities as free speech, free association, and other First Amendment rights essential for democracy.


Another potential problem ... is one I call exclusion. Exclusion occurs when people are prevented from having knowledge about how information about them is being used, and when they are barred from accessing and correcting errors in that data.


Yet another problem ... is distortion. Although personal information can reveal quite a lot about people's personalities and activities, it often fails to reflect the whole person. It can paint a distorted picture [and that can have consequences].


What if the government mistakenly determines that based on your pattern of activities, you're likely to engage in a criminal act? What if it denies you the right to fly? What if the government thinks your financial transactions look odd - even if you've done nothing wrong - and freezes your accounts? What if the government doesn't protect your information with adequate security, and an identity thief obtains it and uses it to defraud you? Even if you have nothing to hide, the government can cause you a lot of harm.

"'Nothing to hide' only works if the folks in power share the values of you and everyone you know, entirely, and always will."
from Tom Scott's "Why The Government Shouldn't Break WhatsApp"

Reasons someone might want to attack you:

Srikrishna Sekhar's "Why worry about privacy?"
Ruth Coustick-Deal's "Responding to 'Nothing to hide, Nothing to fear'"
Patrick Allan's "Why Your Privacy Matters, Even If You're Not 'Doing Anything Wrong'"
New Yorker cartoon

Another way to look at it: will anyone ever develop a grudge against you, and look for ammunition against you ? Ways to embarrass you, or harass you ? Perhaps you'll get involved in a divorce, get in a dispute with a neighbor, get in a feud with a coworker. Or some idiot on the internet might come after you. How much information do you want to make available to them ?

From someone on reddit 1/2014:

As an employer I run every name and email address I am given by a potential hire through Google and Facebook. I look at everything public to make sure there isn't something completely f**king insane.

Things I don't do: I don't hold what their friends say against them. I don't Friend them or try to look at things that are private. I don't hold it against them if they don't have an account or I can't find it.

I do look at public photos and statuses. I don't care if they go to parties. I do care if they skip work to do so or because of it.

So far I'd say 80% of the applicants are fine. But in that other 20% I have found obvious racists, people who actively hate gays, people who play games every working minute (while at work).

Funniest was someone who had set their account to public and constantly complains about being at work FROM work and asked friends to come by and visit and talk, at a job where that was not appropriate.

For people who apply as interns, I let their school know to have them remind the student to lock down their account. For people who apply for real jobs, I don't say a word.

Some people say: Innocent people have nothing to fear from government spying.

I'd certainly feel uncomfortable and creeped-out if someone followed me around all day, videotaping everything I did, documenting every place I went and everything I did, watching me. Should it be okay for the govt to do this ?

Why was protection from unreasonable search put in the Bill of Rights (4th Amendment) ? It fits this situation exactly: govt is supposed to have a good reason for invading your privacy.

Some huge government investigations have targeted and ruined the lives of innocent people: the McCarthy hearings, the Atlanta Olympics bombing (Richard Jewell was innocent), and the anthrax attacks (Steven Hatfill was innocent) come to mind.

Government powers have been used to target people with unpopular views, or journalists reporting news that politicians didn't want reported: FBI under Hoover, Nixon's enemies list.
Wikipedia's "COINTELPRO"

My response to someone who asked "Why is this NSA scandal such a big deal ? I'm not doing anything illegal.":

Some reasons:

1- NSA scandal is just one symptom of a bigger issue: govt checks and balances have broken down. Intelligence spending and activities are out of control, military spending is out of control, citizens got panicked by 9/11 and let govt take major new powers and now govt is out of our control.

2- NSA is just one point along a spectrum of threats to you. It is the least likely but most powerful threat. It points out that you are vulnerable to scammers, stalkers, eavesdroppers, online criminals, etc. It reveals that our online security and privacy tools and laws are weak.

3- Technology, and the threats from it, will only get more powerful and more invasive in the future. Insurance companies and advertisers and your wacky neighbor will all get more powerful tools to threaten your privacy.

4- Things you do that aren't illegal still may be private. Why do you have curtains on your windows ? Why do you close the door when you go to the bathroom ? Would you mind if someone published your tax returns, your salary and net worth numbers, your credit-card statements, your bank account statements, your medical records ? Why ? You're not doing anything illegal.

Eva Blum-Dumontet's "Winning the debate on encryption - a 101 guide for politicians"

Future threats to privacy will be greater:

From Intelensprotient on reddit:
... you do not need to be registered with Facebook for them to make a profile for you. Once you have visited any page that is affiliated with them, they will create a file about you and collect each and every visit to every site that has a "Like" button or a Facebook plugin. The amount of data collected this way can be tremendous, which few people realize. Google is even more extreme, as they collect data from every place that has AdSense, Analytics and similar services, which basically covers almost everything the average person visits. Those services may not always be as obvious as a "Like" button - for instance, some are implemented by displaying a single transparent pixel image.


You cannot know what kind of surveillance methods and laws will be implemented in the future. Already, biometric information gathering such as the identification of people from video recordings is becoming more and more successful, even prompting for the EU to begin implementing a system that can link people in public places to their Facebook pages and other photographs. Similar plans are implemented by the US. Other technologies include public voice surveillance, supervision of vehicle movement or behavioral analysis in public spaces. All this data can and will be linked and combined with what is collected about you online.


More about the future: new technologies such as Google Glass and face-recognition and license-plate-recognition and CCTV will connect your "real" life and your online life more tightly, and in real-time. Facebook, law enforcement, even big retail stores are starting to do facial recognition. Things you do in public without giving your name, or giving fake data, and using cash, may still be connected back to your personal info. What you do online won't stay only online; what you do offline won't stay only offline.
Michelle Starr's "Facial recognition app matches strangers to online profiles"
George Dvorsky's "How Your Body's Unique Biosignatures Are Used for Surveillance"

In the future, CCTV and consumer cameras only will get better and better. In public, or through your window, cameras may be able to read the screen on your phone, hear your conversation from a distance, photograph you in infrared at night. One of the first users of this is the police force that brought us "stop and frisk": Joe Coscarelli's "The NYPD's Domain Awareness System Is Watching You".

And "The Internet Of Things" is coming: your own devices (car, house, refrigerator, toilet, etc) will make more and more data available, and some of that could be used to reveal your activities.

Another hint about where tech may go in the future: scanning your face and posture and movements to diagnose your health: Ben Amirault's "Diagnosing depression with facial recognition technology". Maybe a good thing in a doctor's office. Maybe a bad thing when a retailer is doing it and selling the data to insurance companies.

Some ideas gleaned mostly from lifehacker's "How You're Unknowingly Embarrassing Yourself Online (and How to Stop)":

Will Oremus's "Of Course Colleges Are Reading Kids' Tweets and Facebook Posts"
Katie Lobosco's "Facebook friends could change your credit score"
Karl Bode's "Banks Now Eyeing Cell Phone Metadata To Determine Your Loan Risk"
Ralph Nader's "Corporate espionage undermines democracy"
Yasha Levine's "What Surveillance Valley knows about you"
Justin Jouvenal's "The new way police are surveilling you: Calculating your threat 'score'"
Brett Thomas's "Online Porn Could Be The Next Big Privacy Scandal"
Grady Johnson's "With New Medical Technologies, Opting Out May No Longer Be an Option"
David Auerbach's "We Can't Control What Big Data Knows About Us. Big Data Can't Control It Either."
Cindy Cohn and Trevor Timm's "Busting Eight Common Excuses for NSA Mass Surveillance"
Ben Amirault's "Diagnosing depression with facial recognition technology"
Thor Benson's "We Need to Regulate Technology That Can Detect Your Emotions"
Yaniv J Turgeman and Eric Alm and Carlo Ratti's "Smart toilets and sewer sensors are coming"
Brendan I. Koerne's "Your Relative's DNA Could Turn You Into a Suspect"
Rick Falkvinge's "What's Privacy Good For, Anyway?"
Neil J. Rubenking's "5 Ways Identity Theft Can Ruin Your Life"

Some societal nuances to privacy:

My response to an article saying "Google and Facebook and Twitter have not created new products that stand alone like a car or a new house; they have created things that invade every other aspect of the economy and our culture. That is a different level of power.":

I think this is overblown. I could stop using Facebook and Google and Twitter tomorrow, with some effects but not big effects on my life. I can give them false info, give them minimal info, use alternatives to them, do without them.

Government and military and police have the potential to have unavoidable, huge effects on my life. They take some of my money (and give me services) without much choice on my part. Sometimes they cause other people to attack our country. They have access to my tax information, credit info, bank account info, phone records, etc.

Some companies have large physical effects on my life and my health. Fossil-fuel power companies, and other companies that put who-knows-what into the air I breathe and the food and drink I consume.

Other companies have pervasive effects throughout our economy and/or culture. TV networks. Phone companies. Walmart. Exxon.

The two political parties control much of what happens in the government and culture and economy.

Super-rich people could destroy me with lawsuits, or buy laws that affect me severely.

No, I think Facebook and Google and Twitter are pretty low on the list of powerful entities to worry about.

Companies that could have large access to your activities:

Some ways technology is stretching old notions of privacy:
Technology makes possible:

Key data you might want to keep private:

In places where it's not illegal to lie, such as stores requiring you to give data, and wrong data would not hurt you, you might want to:

Jay Stanley's "Plenty to Hide"
John C. Dvorak's "On Privacy: It's Not What I'm Hiding (Or Not Hiding) That Matters"
Evgeny Morozov's "Your Social Networking Credit Score"
The Economist's "Lenders are turning to social media to assess borrowers"
Sarah Kessler's "Think You Can Live Offline Without Being Tracked? Here's What It Takes"
This Modern World's "Sensible Thinkers Think About Leaks"
Kashmir Hill's "10 Incredibly Simple Things You Should Be Doing To Protect Your Privacy"
Dave Greenbaum's "New Tax Fraud Scam Reminds Us: Protect Your Social Security Number"
Wired How-To Wiki's "Protect Your Data During U.S. Border Searches"
EFF's "Digital Privacy at the U.S. Border: Protecting the Data On Your Devices and In the Cloud"

Evan Dashevsky's "Admit It, You Don't Care About Digital Privacy"

The law (in USA):

[Mostly from Daniel Zwerdling's "Your Digital Trail: Does The Fourth Amendment Protect Us?"]

Two legal ways the govt or others can get your data: Fourth amendment of the Constitution protects against search and seizure.

But location of your data matters:
But there are other standards. For example, once NSA collects masses of phone-metadata, it isn't supposed to search within it and use pieces of it without a "reasonable, articulable suspicion" (RAS) that it is related to terrorism. [from Ryan Lizza's "State of Deception"]

And your cell-phone data may get swept up with that of criminals, with each phone company applying its own rules about what data is given to police. [from David Kravets's "Cops and Feds Routinely 'Dump' Cell Towers to Track Everyone Nearby"]

There are special legal protections for some kinds of data. HIPAA protects health status and medical records of individuals.

Of course, legal protection doesn't mean much if your data is collected and then the database is stolen. See for example Wikipedia's "Office of Personnel Management data breach" and Dan Munro's "Data Breaches In Healthcare Totaled Over 112 Million Records In 2015". But if you don't let them collect it in the first place, it can't be stolen.

Theft recovery software


All of these products work by your computer sending "here I am" messages over the internet to a central site. But if the thief breaks up your computer to sell for parts, or uses it but never connects to the internet, the product won't work.

One note: if someone (a hacker or ex-spouse) finds out your theft-recovery password, they might be able to tell the software to delete all of your data, even though your device hasn't been stolen !

Password / login issues:

All of these theft-recovery products work by your computer sending "here I am" messages over the internet to a central site. But a computer running Windows 7 Home can't access the internet until the user has logged in to Windows. So the thief has to be able to get past the BIOS/firmware password prompt and the Windows password prompt.

There are three ways this could happen:
1- you always use your laptop with no passwords set, or
2- you have passwords set, but the thief resets the BIOS password and OS password (it can be done), and then logs in, or
3- you have passwords set, but the thief resets the BIOS password (it can be done), reformats the hard disk, installs a new OS, and then logs in.

In case (1) or (2), obviously a thief or casual snoop can log in right away, and read all of your files. Unacceptable.

Under Windows 7 Home Premium, there is no way to have a Guest account that can log in but then be unable to read files.

In case (3), a few of these theft-recovery products can survive the reformat/re-install and be capable of reporting their location when the thief eventually logs in and connects to the internet.

Case (2) or (3) represents a sophisticated thief; they could just pull out the hard disk and attach it to another PC, so they could read your files that way. Unless you're using some special full-disk-encryption product.

And case (2) or (3), the sophisticated thief, probably would be aware of the existence of theft-recovery products.

So it seems to me that this is a Catch-22 situation: these theft-recovery products work best in case (1), but that's the case where you've left your data most vulnerable to a naive thief or casual snoop. And in case (2) or (3), nothing protects you very much from a sophisticated thief.

I believe Linux and Mac systems are slightly better than Windows in that: once the OS password prompt is displayed, the machine can connect to the internet, even though the thief hasn't logged in to the OS. The thief would still have to get past the BIOS password to get to this point. So for Linux and Mac, if you set no BIOS password but do have an OS password, the laptop might report its location while the thief is sitting there trying to guess your OS password.

Let's look at fundamentals:

What is important to you ?

What are you trying to protect or prevent ?

  1. Prevent your device from being stolen.

    Solution: physical security (locks, cables, lock-box, etc).

  2. Prevent a thief from reading your data.

    Best solution: full-disk encryption (FDE), either via hardware (built into the hard drive) or software (such as TrueCrypt or VeraCrypt or FreeOTFE or PGPdisk or DiskCryptor; Wikipedia's "Comparison of disk encryption software", Martin Brinkmann's "List of TrueCrypt encryption alternatives", Lifehacker's "How to Encrypt and Hide Your Entire Operating System from Prying Eyes", Micah Lee's "Encrypting Your Laptop Like You Mean It", Chris Hoffman's "Why a Windows Password Doesn't Protect Your Data"). The software approach offers several alternatives and gets a bit confusing; hardware encryption is the wave of the future.

    But see Dan Goodin's "Western Digital self-encrypting hard drives riddled with security flaws" and Joseph Cox's "Some Popular 'Self Encrypting' Hard Drives Have Really Bad Encryption".

    Or keep your most critical data in an encrypted virtual disk (an encrypted file that looks like a disk drive to the OS), perhaps by using VeraCrypt or something similar.

    A more limited solution: keep your most critical data in an encrypted text file (perhaps by using NotepadCrypt or something similar). Bitlocker, 7-Zip, AxCrypt also can encrypt individual files or sets of files.

    How-To Geek's "How to Encrypt Your Android Phone and Why You Might Want To"
    Eric Ravenscraft's "The Essential Android Security Features You Should Enable Right Now"
    I encrypted my Android 5 phone via Settings->Security, everything works fine, but it made me change from a 4-numeric PIN to a 6-8-alphanumeric passcode.
    On iPhone, just set a passcode and everything gets encrypted automatically ?
    Apparently, some smartphones must be jail-broken if you want to encrypt just specific folders, not encrypt or password-protect the whole phone.

    Password-lock your device, unless you're using a theft-recovery product that prevents this.

    Most of the theft-recovery products listed on this web page give you a "delete" or "shred" capability: when the thief connects to the internet, a command comes from the central site and all data on the hard disk is deleted. This prevents the thief from reading your data. But it works only if the thief connects to internet before trying to read your data, and if they haven't disabled the theft-recovery software somehow.

    Whitson Gordon's "How to Break Into a Windows PC (and Prevent It from Happening to You)"

  3. Avoid losing your data.

    Best solution: back up your data frequently, and don't keep the backups next to the laptop.

    Also back up your paper data and copies of credit cards and paper photos, by taking digital photos of them or copying the data into files.

    Some data you might forget to back up: bookmarks in your browser (or your entire browser "profile").

    /r/techsupport's "backuptools wiki"

  4. Avoid future losses.

    If your device contains account and password info, identity info, info about your family and friends, then after a theft you'd have to take steps to avoid further damage. You'd have to change passwords, put out monitoring or alerts to prevent identity theft, contact other people at risk, etc. What else is on the stolen device ? Apps with registration codes or passwords stored in them, email in-box with account and password data, bookmarks ditto, cookies, any data files you use to record accounts and passwords, any BAT or CMD files with account/password in them.

    Perhaps now, before any theft, you should evaluate your device. Does it contain sensitive data that really doesn't need to be on there ? Or should that data be encrypted ? Does the browser contain cookies that will give instant access to your email and Facebook accounts ?

    After a phone or smart-phone is stolen, if you don't want to try theft-recovery, immediately report the theft to your carrier, to avoid huge call charges. Do it immediately; you are liable for calls made until the time you report the theft, and some gangs will make thousands of dollars of calls as quickly as they can after stealing the phone. Double-check with your carrier to make sure they received and recorded the report of the theft; probably a good idea to call them again and confirm it (article). Maybe report it online, and then call to confirm ? Ask them to send an email confirmation to you. A handset PIN doesn't protect you if the thief moves the SIM to another device.

  5. Get your device back.

    Solutions: etch your contact info onto the case of the device, inside and outside. Use the theft-recovery software listed on this web page. Keep a record of make, model, color, and serial numbers. Probably a good idea to have digital pictures of the device, front and back, to give to police.

    Display your contact info on the lock screen or login screen or physical label, so if a Good Samaritan finds your device, they can return it to you.

    After a theft, report the theft to police, and report the theft to the manufacturer or carrier (they'll probably require a copy of the police report). Maybe report it to online databases, such as Put up fliers in the area where it was stolen, offering a reward for return ? Look for it on Craigslist or EBay, maybe in the section for your local area.

Also: the "devices" you need to protect include your computers, tablets, phones and any backup media (external disks, tapes, flash drives, hard copies).

Mobile phone security:

[Do I have this right ?]

Three things to protect: your data, your device, and access to the service (ability of thief to make calls and run up bills on your account).
  1. Data:

  2. Device:

    Having a passcode/PIN set prevents thief from using your phone, even with another SIM inserted.
    [But is there a hardware reset that wipes everything and sets back to defaults ?]

  3. Service:

    • If phone has a SIM card, disabling service after the theft is your only protection on access to the service. Having a passcode/PIN set on the device doesn't stop thief from popping out the SIM card and using it in another phone.
      But: some SIM cards do have a separate PIN for the card itself.

    • If phone has no SIM card, having a passcode/PIN set will prevent thief from using the service.

Recovery issues:

What "location" information do you get once the thief has logged in and connected to the internet ?

You'd get the IP address. Maybe also the Wi-Fi or Ethernet network name ? If your stolen device had a GPS in it, you could get latitude/longitude. If your stolen device connects via cellular data-modem, you could get approximate latitude/longitude. Software could use the list of visible Wi-Fi networks to calculate approximate latitude/longitude.

From the IP address, you could find the ISP's info, and contact them.

If the IP address is specific to a person or house, the identity of the thief is fairly clear.

But if the IP address maps to a public Wi-Fi spot (such as provided by a school or library or McDonald's or Starbucks), or a private house that's running an open Wi-Fi signal, the identity of the thief is unclear.

Most products can use the laptop's webcam to take a picture of the thief, which helps.

The companies selling the commercial theft-recovery products may assist in the tracking and recovery process, helping you follow the IP address, contact law-enforcement, etc.

Some users who had devices stolen report great cooperation from law-enforcement in recovering their property; others report that police were uninterested in helping them. Probably varies from town to town and country to country, and also depends on how much info you can give to the police.

Whitson Gordon's "Can I Track My Laptop or Smartphone After It's Been Stolen?"
Lincoln Spector's "Protect your Android phone from loss or theft"

Hitesh Raj Bhagat & Karan Bajaj's "How to track & recover stolen or lost gadgets"
Patricia Laurie's "How to avoid buying a stolen laptop"
Stolen Phone Checker
Get Safe Online's "Report a lost or stolen computer"
Max Eddy's "What To Do When Your iPhone is Stolen"

Neil J. Rubenking's "What to Do When You've Been Hacked"
Lincoln Spector's "You've fallen for a scam! Now what?"
Patrick Allan's "What to Do When Someone Gets Unauthorized Access to Your Computer"

Nicholas Tufnell's "Naked selfies extracted from 'factory reset' phones"

Melanie Pinola's "What Should I Do If My Credit Card Gets Hacked?"
Alan Henry's "What To Do If Your Social Security Number Has Been Stolen in a Hack"
FTC's "" (what to do in case of identity theft)
/u/gitssa's What to do if unknown credit cards appear on your credit record


Anticipate problems:

Maintain a secondary email account, preferably on a different provider from your primary email. If something happens to your primary, you can use the secondary to send critical messages until you fix the primary.

Don't ignore the account-recovery settings on your accounts, or put bad data in there. Sure, you'd rather not let Google or Yahoo or Facebook know your phone number or your second email address. But that information can save you if their security triggers get pulled for some reason. You travel, you try to access your email from laptop or internet cafe (seems not to happen when accessed from phone), you get "hey, we see a login attempt from a new country, we're turning off account access until you give us the code we're SMSing to your phone or emailing to your other account". Better hope you've kept the account-recovery options up-to-date.

From DrStephenPoop on reddit:


And not just what's on your hard drive.

Do not trust the cloud!

Google recently ended my account for an unidentified TOS violation. I am not sure what I did. I just logged into gmail one day and instead of an inbox I saw a message saying my account had been disabled. I lost:

8 years of email contacts

6 years of favorited YouTube videos

About a dozen videos I made with my brother that were uploaded to YouTube.

All my Drive/Doc files including original writing.

My passwords to several sites, including banking and insurance sites.

Three albums I had purchased from Google Play.

Here's the kicker: I was a google believer. I am one of the 5 or so non-developers who actually owns a first generation Chromebook. I believed in the cloud!

Use and enjoy Google's services, but do NOT rely on them. Even though you buy their computers and purchase music from them, you are STILL not the consumer with google. You are the product (sold to advertisers). So when you are shut out from their garden, you have no customer service to appeal to, or to even find out why you got tossed. You might as well be staring at an angel with a flaming sword, wondering where your pants are.

> Didn't you contact Support ?

When you get the "your account has been disabled" screen, they give you a link to voice your grievance. After submitting, you get a message that says something to the effect of: "If we find we have reason to contact you, we will contact you."

You can also go the community forums and plead for help. Sometimes someone associated with google will actually say: "I'll have people take a look at this." In all my pleas, I never got a response. That is as far as support goes. You are not a customer. You are the product, and you are merely a commodity. Have you ever heard of "commodity support"?
Tienlon Ho's "Can You Live Without Google?"

From someone on reddit:

A few days ago my Facebook account was disabled suddenly and without warning. I've gone through what I thought was a fairly routine appeals process - filled in the form they link you to when you try to log in and included a scan of my photo ID as they requested to prove I'm a real person etc. However, I just received an email from Facebook saying the following:

> ... Upon investigation, we have determined that you
> are ineligible to use Facebook. ... Unfortunately, for
> safety and security reasons, we cannot provide
> additional information as to why your account
> was disabled. This decision is final. ...

This is really bizarre and quite upsetting - it's easy to forget just how much we rely on this service. If I can't get my account reactivated, that's six years of content (and memories) lost, and a huge blow to my ability to keep in contact with some friends and family.

The only possible reason I can think of for my account being disabled is what I was doing at the time - sending some photos to someone through the private messaging system. Some of the photos were (mildly) adult in nature (at her request!) which could be deemed a breach of the Community Standards if you look at it in strict black and white terms ("Facebook has a strict policy against the sharing of pornographic content"). However I can't bring myself to believe that there is someone monitoring private message attachments and instantly banning people if they see boobs. Beyond that, I genuinely can't conceive of a reason as to why my account was singled out for anything.

Any advice would be appreciated as to what I should do next - I am not yet willing to just give up and lose all of that content. I have replied to the email, though I doubt anyone will read it, but beyond that there's really no other contact options I can see, and Googling this problem does not produce much beyond more horror stories like this.

From sugarbreach on reddit:

I am writing this to warn Google users to back up their data, and to realize that everything you take for granted can be taken away in an instant.

About a week ago I attempted to log into my Gmail account and was greeted with a page saying my account was disabled. It says that it was disabled due to a perceived violation of the terms of service and product specific polices. I have read and reread the google terms of service, and I know I haven't done anything to violate them. The only possibility I can think of is that someone may have hacked into my account. I have been an enthusiastic gmail user since it first came out in beta, and you had to be invited to get an account. I have relied on google apps to make my life easier. I have filled in their account recovery form, and even tried calling members of the Gmail team, but have had no luck. I also have posted on the gmail help forum, but an expert there said he contacted google and there was nothing he could do and google wouldn't tell him anything "for privacy reasons".

This has created the ultimate real-life nightmare, and has turned my life upside down, a few examples of which are listed below.

All of my contacts were linked to this account. I now do not have access to emails, phone numbers, addresses, etc.

My google voice telephone number is no longer working. I had this phone number on my business cards and email signature, and now when someone dials the number, they are given an error recording. "We could not complete your call, please try again".

My youtube account with many videos I cherished of my children are now gone.

I have all of my photos backed up to the account for nearly my entire life, as I thought this was the safest place to keep them (the cloud!) I have photos of my beloved grandparents who have since passed away, and the thought that I can no longer access these photos makes me sick. I also have thousands of pictures from vacations and of my children that I fear are gone forever.

A nice chromebook that I purchased to access all of the google apps is now almost useless since my account has been disabled.

I have multiple documents in my google drive that I have spent hours of work on, and can no longer access them.

I placed an enormous amount of faith and trust into google's products and services, as millions of people have worldwide. It is a shame that something this important in someone's life cannot even warrant a response from a live person at Google.

I have been very depressed because my entire life was encased in google's products, and now everything is gone.

Again, I am writing this to warn others that this can happen to anyone at any time, so it would be wise to back up treasured items in your google account. Ironically, google provides the means to do this through their "takeout" app, which I did not learn about until after my account was disabled. If there is anyone out there reading this that can offer any guidance for getting my account reinstated, I would sure appreciate it!

If you lose a cloud account, you can lose stored data, remaining time on a subscription, any accumulated credit or gift cards, network link that makes some device (such as Amazon Echo) work.

Maybe some people don't consider their email to be "cloud data", but it is. If you're saving 10 years of past emails in GMail or Hotmail or something, it may be valuable to you, and it may be used by a hacker if your account gets hacked. It's also hard to back up. I'm a big believer in keeping your email account as close to empty as feasible. Clean it out !

Apparently, automatic cloud backups of your phone data can expire and be deleted if you don't use your phone for many months. Android backups in Google Drive Backup are deleted if you don't use the phone for 2 months ? iPhone backups in iCloud are deleted if the iCloud account is not used for 6 months ?

Jon Christian's "Deleting the Family Tree"
DanDeals' "PSA: Don't Mess With The Google!"
Alex Hern's "Pixel phone resellers banned from using Google accounts"

Eric Griffith's "Back Up Your Cloud: How to Download All Your Data"
Adam Dachis's "How to Protect Your Data in the Event of a Webapp Shutdown"

And of course back up your local data, not just your cloud data.
How-To Geek's "What's the Best Way to Back Up My Computer?"
Eric Griffith's "The Beginner's Guide to PC Backup"
/r/techsupport's "backuptools wiki"

From someone on reddit:

The basic methods of "hacking" accounts are:


[Generally from most likely to least likely:]
  1. Your own actions. (The biggest threat of all. You accidentally post something private in the wrong place, expose a password, mis-configure your device or account, drop your device, lose your device, accidentally delete your data, trust a scammer.)

  2. Your family, friends, associates. (They post about you, snoop on you, accidentally leave your house or car unlocked, mis-configure their device, drop your device, accidentally delete your data, trust a scammer. They expose their Contacts list, which contains your name and email and address and phone number and birthday. They tag you in Facebook photographs, or mention that you were with them at some wild party.)
    Your browser history

  3. Your ex-spouse, former friends who now are enemies, former coworkers who you fired or angered. (They may be highly motivated, but probably don't have access or skill to cause high-tech harm. Unless you forgot to change the passwords they know. But they may have private info they could post.
    Cyrus Farivar's "If you're a revenge porn victim, consider this free, helpful legal guide")

  4. Your software. Some application or web site you use may be sending your data to somewhere else that you don't know about (some apps harvest your email address book or phone contact list or Friends list). Or storing your data in an unsafe way in a server.

  5. Corporations selling your meta-data or data to advertisers.

  6. Corporations reading your data to enforce their contract rights (terms of service) and maybe look for criminal activity.

  7. Organizations accidentally exposing data you've entrusted to them, through careless practices or by getting hacked.

  8. Data criminals and hackers. (Identity thieves, credit-card thieves, blackmailers, ransomware, etc. Hackers who want to use your device as part of a botnet. And you may be a special target if you have something valuable on your computer:)
    Laura Shin's "Hackers Have Stolen Millions Of Dollars In Bitcoin -- Using Only Phone Numbers"
    Alex Hernandez's "Chase eATM user has mobile app hacked and loses $3,000"

  9. Casual snoops or thieves. (Although with snooping software, "casual" capabilities are increasing.)

  10. Law enforcement (recording everyone's activity, such as cell-phone locations and car license plates).

  11. Internet vigilantes or lynch mobs or public shaming. (E.g. someone decides a picture shows you abusing your dog, and whips up a mob to punish you.)

  12. Reporters.

  13. Private investigators and lawyers. (They have some access to government databases and powers.)

  14. Law enforcement (specifically targeting you).
    Jonathan Zdziarski's "Protecting Your Data at a Border Crossing"
    Andy Greenber's "A Guide to Getting Past Customs With Your Digital Privacy Intact"
    EFF's "Digital Privacy at the U.S. Border: Protecting the Data On Your Devices and In the Cloud"

  15. Foreign government intelligence agency. (Highest technical ability, but no legal authority.)

  16. Government intelligence agency. (NSA, DHS, etc. Highest technical ability, PLUS legal authority.)

Sean Gallagher's "How I learned to stop worrying (mostly) and love my threat model"
Wired's "Guide to Digital Security - Choose Your Security Profile"

No matter what protection you propose, some people will say "oh, the NSA has cracked that !". First, how do they know ? Second, a counter-measure still may be worth using even if the NSA could crack it; NSA is not the only threat or main threat. Third, just because NSA could crack something, doesn't mean they would spend the resources to crack your messages.

And some people say "trust no one !". Well, I think it is reasonable to trust the CPU chip vendors, and the compiler-writers. I don't see how useful "backdoors" could be built into those things (and I have BS and MS degrees in Computer Science). Trusting the OS vendors is a little more dubious; I guess I trust the basic OS, but maybe not all of the standard apps and services supplied with them. Same for trusting browser vendors.

Of course, if you trust no one, you'll never be able to get anything done. Can't drive my car, because I shouldn't trust the manufacturer. Better not eat anything, because I shouldn't trust the food companies or stores.

Some people say "it's all over, we've lost our privacy, it's done". No, it's an arms race, and right now consumers don't have very good weapons. We need to get convenient, good, routine encryption. We need more sites, applications, and protocols designed with security and privacy as priorities from the foundation up. Maybe "mesh" networking, peer-to-peer systems, distributed systems ("6 Anti-NSA Technological innovations that May Just Change the World"). We in USA need better regulation of spy agencies, via FISA and Congress. It's not over. You're generating new private data every day; you can protect that. And you can create fake data.

A worrisome trend: intelligence agencies being pressed to use their powers for non-intelligence purposes.
From Alex Hern's "David Cameron: GCHQ will be brought in to tackle child abuse images": "GCHQ [the British intelligence agency] will be brought in to tackle the problem of child abuse material being shared on peer-to-peer networks."
From NSA spokesman quoted in Barton Gellman and Ashkan Soltani's "NSA collects millions of e-mail address books globally": "[The NSA] is focused on discovering and developing intelligence about valid foreign intelligence targets like terrorists, human traffickers and drug smugglers."
Eric Boehm's "Reuters: Law enforcement use info from NSA phone database to go after common criminals"
Conor Friedersdorf's "The NSA's Porn-Surveillance Program: Not Safe for Democracy"

Costs of counter-measures:

Patrick Howell O'Neill's "Dealing with the digital afterlife of a hacker"

General counter-measures:

How to attack cryptography:

[From hardest to easiest:]
  1. Find a flaw in the mathematics (extremely unlikely).

  2. Find a flaw in the algorithm.

  3. Find a flaw in the crypto software.

  4. Brute-force password-guessing.

  5. Find or create a flaw in the surrounding software (operating system, networking, key-logger, etc).

  6. Find a flaw in the configuration (software not updated, password not set, place where data is not encrypted, etc).

  7. Human problems (password exposed or easily guessed, social engineering, etc).

  8. Legal tools (warrant or subpoena to get encryption keys or tap traffic).

Low-tech solutions:

Things that may not increase security and privacy:

Operating systems and environments:

Buying or setting up a brand-new device:

Testing your privacy and security:

New things we need to increase our privacy or security:

"Privacy" from incoming abuse:

If people are saying nasty things to and about you online:

Physical security and privacy:

Family issues:

If you own a web site:

Some pretty devoted privacy and security guys: The Complete Privacy & Security Podcast

Crypto|Seb's "The Crypto | Paper"

Bookmark and Share

Home     Site Map

Privacy policy