Online privacy and security

I am not a com­put­er-se­cu­ri­ty or pri­va­cy ex­pert. I’m mere­ly a com­put­er sci­en­tist turned law stu­dent who has thought about these top­ics for a long time.

Deciding on a se­cu­ri­ty or pri­va­cy strat­e­gy is de­cid­ing on a tradeoff: a tradeoff be­tween se­cu­ri­ty and pri­va­cy on the one hand and con­ve­nience and pub­lic par­tic­i­pa­tion on the oth­er. To even con­nect a de­vice to the in­ter­net is to ac­cept a cer­tain lev­el of risk. Know what you’re trad­ing. Know who you’re trust­ing and with what.

The EFF pub­lish­es a bunch of up-to-date se­cu­ri­ty and pri­va­cy ad­vice. I’ll be link­ing a lot to work they’ve al­ready done, but will try to high­light what I think will get most of you most of what you need.

90% of the way

Secure your device

If it is im­por­tant to you that a per­son with phys­i­cal ac­cess to your de­vice not be able to ac­cess any data on it, you’ve got to set up full-disk en­cryp­tion.EFF: Keeping Your Data Safe; EFF: Encrypting Data At Rest. When you set up full-disk en­cryp­tion, the data on your disk gets en­crypt­ed when­ev­er you shut off your com­put­er or phone. It can only be de­crypt­ed by us­ing the pass­word that you set up, gen­er­al­ly at start­up. If you were to lose your phone, or sell it, or have it seized at the bor­der, no­body would be able to ac­cess your data with­out the pass­word, even if they were to re­move the disk and try to read the data di­rect­ly: that data would be en­crypt­ed and un­read­able.

On Windows, use BitLocker. On Android, use Secure Startup. On iPad and iPhone, use Data Protection. On ma­cOS, use FileVault.

Secure your communications

Use HTTPS wher­ev­er pos­si­ble.EFF: Encrypting Data In Transit.,The EFF publishes a browser extension, HTTPS Everywhere, which ensures as much traffic as possible is routed over HTTPS. But, while HTTPS is increasing in prevalence, not all websites even support HTTPS. This will protect your most important communications with banks, email services, etc., but will occasionally be unavailable on some sites that don’t consider their information to be worthy of encryption. When you re­quest a URL be­gin­ning in https://, the traffic is en­crypt­ed be­tween you and the tar­get serv­er. For ex­am­ple, if you trav­el to https://san­chom.github.io, a per­son that views your re­quest while it is in tran­sit (e.g. some­body snoop­ing on your wifi ac­cess point, your in­ter­net ser­vice provider, github’s in­ter­net ser­vice provider, etc.) will not be able to de­code what you’ve asked san­chom.github.io to give to you. They wouldn’t be able to see whether you asked for https://san­chom.github.io/in­ter­ven­ers.html or for https://san­chom.github.io/colophon.html. All they’d be able to tell is that you’ve re­quest­ed some­thing from san­chom.github.io. Further, when the serv­er (san­chom.github.io) sends data back to you, it will also be en­crypt­ed, so no­body would be able to read the con­tent while it is in tran­sit. Of course, this doesn’t mat­ter so much when you’re just vis­it­ing my web­site, but this en­cryp­tion in tran­sit is cru­cial when you’re bank­ing, buy­ing things on­line, or ex­chang­ing what you ex­pect to be pri­vate mes­sages.

To em­pha­size: HTTPS doesn’t pre­vent the web­site/serv­er you’re talk­ing to from see­ing your re­quest. That site needs to know what you’ve asked for and might even log your IP ad­dress which can be used to de­ter­mine your lo­ca­tion and your iden­ti­ty with help from your in­ter­net ser­vice provider.

Secure your accounts

HTTPS (and as men­tioned in the next sec­tion, VPNs, and end-to-end en­cryp­tion) pro­tect the pri­va­cy of your com­mu­ni­ca­tions. Passwords in­stead pro­tect the se­cu­ri­ty of your ac­counts. Online ser­vices use pass­words to let you prove to them that you are who you say you are.

There are a few uni­ver­sal­ly ac­cept­ed rec­om­men­da­tions re­gard­ing pass­words:EFF: Creating Strong Passwords.

• nev­er use the same pass­word for more than one ac­count
• use strong (long) pass­words that do not in­clude dic­tio­nary words
• use a pass­word man­ag­er to al­low you to ac­tu­al­ly do the pre­vi­ous two things
• use two-fac­tor au­then­ti­ca­tion on your most im­por­tant ac­counts (e.g. email, the pass­word man­ag­er it­self)EFF: How to: Enable Two-Factor Authentication.

Limit how you can be tracked

Even when you are com­mu­ni­cat­ing over a se­cure chan­nel, not logged into any ac­counts, the sites that you vis­it can ask your brows­er to store to­kens that al­low those sites to track your ac­tiv­i­ty across ses­sions and even on oth­er sites. Sites can also rec­og­nize your brows­er based on its unique configuration.EFF: Panopticlick 3.0 (how unique does your browser appear to online trackers).

You can lim­it this by telling your brows­er to opt-out from track­ing, by us­ing a stan­dard brows­er, with few modifications, and by lim­it­ing how long cook­ies can be stored. On your phone, you can use Firefox Focus, which makes it very easy to main­tain next to no ses­sion his­to­ry. Even on your com­put­er, the Firefox brows­er has bet­ter se­cu­ri­ty op­tions than Google Chrome: Firefox makes it eas­i­er for you to delete all stored in­for­ma­tion when­ev­er you close the brows­er. Tools like AdBlock or Privacy BadgerEFF: Privacy Badger. can also help.

If you use a Google ac­count, know what you’re shar­ing with them and what you’re al­low­ing them to store. Opt out of per­son­al­ized rec­om­men­da­tions and an­a­lyt­ics.Google: Privacy Checkup.

98% of the way

VPNs

A VPN (a vir­tu­al pri­vate net­work) lets you hide more in­for­ma­tion from your in­ter­net ser­vice provider (e.g. Shaw, Telus) and from the web­sites you vis­it.Amul Kalia, “Here’s How to Protect Your Privacy From Your Internet Service Provider”, Electronic Frontier Foundation (3 April 2017). Your ser­vice provider would no longer see what web­sites you’re con­nect­ing to. The web­sites you’re con­nect­ing to would no longer see your IP ad­dress (they’d see an IP ad­dress of the VPN provider in­stead). VPN con­nec­tions also en­crypt traffic be­tween your de­vice and the VPN, even non-HTTPS traffic. Your ISP would no longer be able to see any of the traffic be­tween you and the in­ter­net.

When you use a VPN, you’re mov­ing some of the trust that you would nor­mal­ly place in your in­ter­net ser­vice provider (ISP) to your VPN provider. Your ISP would no longer see and po­ten­tial­ly log your traffic, but your VPN provider might. So, choose a VPN provider care­ful­ly, pay­ing at­ten­tion to their log­ging pol­i­cy and laws in the coun­try where they are based.“Choosing the VPN That’s Right For You”, Electronic Frontier Foundation (9 June 2016).

Some cau­tion though: it is ac­tu­al­ly tricky to set up a VPN to ab­solute­ly route all traffic through the VPN. There are ways that you could in­ad­ver­tent­ly side-step your own VPN con­nec­tion. For ex­am­ple, if your VPN isn’t al­ways-on, any back­up ser­vices that run in the back­ground will send traffic over your non-VPN con­nec­tion any time that your VPN is dis­con­nect­ed. If those ser­vices hap­pen to start up be­fore your VPN starts up, you’ll be re­veal­ing your true IP ad­dress to Google Drive, or OneDrive, or DropBox, etc.

Further, if you have oth­er de­vices in your home that con­nect to ac­counts that you nor­mal­ly use via the VPN, the com­pa­ny run­ning the ac­count could link that in­for­ma­tion to­geth­er. If you con­nect to your Google ac­count on your phone and com­put­er through a VPN, but your Chromecast or smart speak­ers con­nect to your Google ac­count not through the VPN, Google would eas­i­ly be able to de­ter­mine that your VPN traffic should be at­trib­uted to the IP ad­dress as­so­ci­at­ed with your Chromecast or smart speak­ers. The con­clu­sion: to tru­ly pro­tect your IP ad­dress from Google or Amazon, etc. you’d have to ei­ther com­mit to not us­ing smart de­vices out­side of the VPN, or set up the VPN con­nec­tion di­rect­ly on your router, so that all traffic in your home is forced through the VPN.

There are oth­er ways that a VPN might pro­vide a false sense of se­cu­ri­ty: it might leak DNS queries to your ISP,Dann Albright, “How DNS Leaks Can Destroy Anonymity When Using a VPN, And How to Stop Them”, MakeUseOf (14 May 2015). it might leak IPV6 con­nec­tions to your ISP.

Domain Name Servers

The weak­est link in all of the above may be the ser­vice that con­verts a web­site name that you’ve re­quest­ed into an IP ad­dress. This is called a do­main name serv­er (DNS). Often, your com­put­er and router will be set up to send those DNS queries to your ISP. This is one way that your ISP will be able to know what web­sites you’re vis­it­ing. But, there are ways to avoid leak­ing this in­for­ma­tion to your ISP. You can choose a VPN provider that han­dles DNS queries. Or, at least on the most re­cent ver­sions of Firefox, you can ask for your DNS queries to get sort­ed out over HTTPS (they’ll be en­crypt­ed, and sent to a more trust­ed DNS ser­vice).Nykolas Z, “DNS Security and Privacy — Choosing the right provider”, medi­um.com (18 April 2018).

End-to-end encryption

End-to-end en­cryp­tion means that mes­sages are en­crypt­ed the en­tire way be­tween you and the in­tend­ed re­cip­i­ent. Nobody oth­er than you two can read the mes­sages, not even the com­pa­ny run­ning the ser­vice.“Transport-Layer Encryption or End-to-End Encryption?”, Electronic Frontier Foundation (24 November 2018). WhatsApp and Signal are two mes­sag­ing ser­vices that work this way. They both use the same open-source en­cryp­tion pro­to­col. WhatsApp has an op­tion­al cloud-back­up sys­tem that cir­cum­vents this en­cryp­tion pro­tec­tion (your back­ups would be a way for some­body to get the un­en­crypt­ed con­ver­sa­tions), but you can keep that turned off. Signal has an op­tion­al, en­crypt­ed lo­cal-back­up sys­tem.

Some other things to read or listen to

• McSweeney’s 54, The End of Trust.
• A Podcast Called INTREPID, a na­tion­al se­cu­ri­ty pod­cast, oc­ca­sion­al­ly dis­cussing gov­ern­ment sur­veil­lance, CSIS, war­rants, and Bill C-59.
• LawFare Podcast, an­oth­er na­tion­al se­cu­ri­ty pod­cast, oc­ca­sion­al­ly dis­cussing en­cryp­tion, gov­ern­ment sur­veil­lance, offensive cy­ber war­fare.
• Vice Motherboard’s Cyber pod­cast, fo­cused on pri­vate in­ter­net se­cu­ri­ty and how to avoid be­ing hacked.
• An episode of CBC’s The Current about the vul­ner­a­bil­i­ties in smart de­vices.