PRISM - What have you changed?

Khannie · 26-06-2013 03:19PM #1

With hindsight I should have assumed it was happening. It seems obvious that it would have been now that I give it proper consideration. I value my privacy simply because I feel people have a right to privacy, so I have changed a few things:

1) I have encouraged friends to PGP encrypt email exchanges. I am using a plugin called "mailvelope" for chrome with my gmail. It's not ideal, but it is slick and easy enough for the average Joe to use (I have tested this with non-technical people and it has worked). A firefox version is hopefully forthcoming.

2) I am using OTR with pidgin. Super little plugin.

3) I have dumped google as my default search engine from all my browsers and am now using startpage.com.

That's all I've managed to change so far. I am seriously considering hosting my own mail server, but actually in a way it's less secure. If I mail someone from my gmail account who has a gmail account (lots of people) the exchange is entirely encrypted. Unless there is a court order to view my gmail (ridiculously unlikely) it is private. If I hosted my own mail server, it would be unencrypted unless both parties were using PGP.

Anyone else changed anything? Nothing at all? Were already doing such things?

Trojan · 26-06-2013 09:56PM

I'm not doing very well, not a lot of change at all.

I've been using duckduckgo.com as my search engine for a while now, 12-18 months, but find myself back in Google very, very often as the DDG results can be iffy at best. Startpage looks very interesting.

I'm still on Google Apps for email because the business convenience trumps privacy for the moment. I might consider moving at some point in the future but would need to make business sense. PGP is on my todo list to set up, primarily so customers can use it if they so choose.

I'm stuck using Skype because that's what all my suppliers and customers tend to use for IM, again inconvenience is too strong.

For OS, I like Windows (to the point where I installed it on my MacBook Air). Being a UNIX guy originally I would potentially switch to Linux if there was good driver and software support, but in reality it's fairly crap. I simply can't afford to waste minutes nevermind days trying to compile kernels or apt-getting stuff, so it's sticking to Windows until Linux makes massive strides in that direction.

All in all, pretty underwhelming changes.

AnCatDubh · 26-06-2013 10:26PM

I'll slowly and incrementally begin to detach myself from things that may not be good for me.

Funny that you should post that today. I began last night. Small measures and baby steps.

DuckDuckGo became my search engine on my 'go to' machine - wasn't aware of startpage.com, but i'll check that out.

With privacy in mind, I signed out of my google account and stayed signed out all day. I take it that this is what is enabling your search history to be recorded. I know, I know, there are privacy settings which can be exploited within your google account which I intend to investigate. Like I say small steps and gradually.

At the moment i'm still on Gmail. I think i need to get off that platform but i'm unsure as to where to go with this. As you've said, host your own is somewhat attractive in terms of control but does that make you ultimately more secure? Perhaps, but in % terms who are you going to be emailing that are wittingly or unwittingly using PRISM accessible email services - gmail, facebook, yahoo, outlook.com. Whether you are on such platforms or not your email is likely to land on them at least some of the time, and what else they may be sifting through over the wire would probably add up to a significant portion of what you'll email anyway.

To me, PGP doesn't appear ready for the masses. If you have technically adept friends and family then maybe but until it becomes integrated to an extent that you or your intended recipient don't even think about it, it will imho only be partially useful.

Again, like most, being honest about it, I won't have a whole lot to hide and it is a lot of consideration (and time) that you need to give this privacy thing [which generally is hard work] for respecting your perceived right to privacy but there is very little transparency as to what purpose might your data be put towards by foreign nations once it has been hoovered up, so i'm currently of a mind that it will be worth the effort to give it serious consideration.

Its a journey and I'm guessing most will through general complacency have arrived at a point of leaving themselves exposed by the lazyness of seeking 'an easier life' and technology which sucks you in to insecure habbits (leaving your various accounts signed in and so forth).

The journey continues.

Black Swan · 26-06-2013 11:18PM

I am following this thread. Taking notes. Very interesting topic and source of security info Khannie and other contributors.

If you haven't read WIRED's 15 March 2012 cover page story about No Such Agency building a massive Utah data center (or haven't read it in awhile), I would strongly suggest it. Any encrypted emails, IMs, VPNs, etc., that they do not decrypt today, will be stored there for decryption later, when it's convenient and after their latest super computer has been completed for that purpose.

Personally, I really have no need to encrypt the contents of my comms today, but may just do it to be a very slight pain in the backside for the various nations, corporations, and local javahouse hackers that love to snoop. And the more of us that encrypt, the more expensive it may become for the snoops to handle the load, especially as the encryption software demand and sophistication advances overtime.

Khannie · 27-06-2013 10:05AM

Black Swan wrote: »

Any encrypted emails, IMs, VPNs, etc., that they do not decrypt today, will be stored there for decryption later, when it's convenient and after their latest super computer has been completed for that purpose.

In fact a supercomputer that can decrypt well encrypted data will never be built. It is now trivial to encrypt to the point that decryption (even over vast amounts of time, with vast compute power) is not feasible. The best hope for decryption is that a flaw is found in the algorithm somewhere down the line. That in itself is pretty unlikely, at least for RSA. It was given a hunk of scrutiny by the best minds before being adopted and has surely been examined many times since.

edit: Oh yeah, startpage is very good. It is google without the tracking. You miss out on autocompletion, but other than that I am very happy with it. I'm using it on all my devices now.

hooplah · 27-06-2013 10:44AM

Like yourself Khannie I value my privacy, just because I think I'm entitled to. I haven't really changed much. I'm knee deep in college deadlines at the moment so I am going to return to look at this however.

I have looked at Firefox add ons, I previously had PrivacyFix and https everywhere. I have added Ghostery to block trackers.

Gmail is my main email account. I am reluctant to change that since I have had it so long and its the address people know they can get me at. I have set up pgp on various machines or with Thunderbird and Enigmail in the past but people I know just don't use it. Mailvelope (and openpgp.js means there should be more apps like this right?) doesn't look bad but it won't solve that problem.

hmmm.. startpage looks good. I switched off google web history a long time ago. Just wondering if there's a loss of function somehow with switching?

Grudaire · 27-06-2013 10:58AM

I find duckduckgo to be terrible at actually finding stuff. Particularly from an Irish perspective... I have tried a few times, but I always end up back with google :-\

@Trojan: I use Linux now all the time (at home). I have to say that I have very little trouble with drivers etc. I'd be semi-techie, but I have no time to be messing about with stuff either. I have only gone outside the Linux Mint Software centre a handful of times, and even then I haven't had to compile from source (Ubuntu/Debian precompiled packages).

Unless you have very specific needs (Software/Hardware) I think Linux is extremely user friendly now, and I always feel more secure using it

[-0-] · 27-06-2013 12:29PM

Khannie wrote: »

With hindsight I should have assumed it was happening. It seems obvious that it would have been now that I give it proper consideration. I value my privacy simply because I feel people have a right to privacy, so I have changed a few things:

1) I have encouraged friends to PGP encrypt email exchanges. I am using a plugin called "mailvelope" for chrome with my gmail. It's not ideal, but it is slick and easy enough for the average Joe to use (I have tested this with non-technical people and it has worked). A firefox version is hopefully forthcoming.

2) I am using OTR with pidgin. Super little plugin.

3) I have dumped google as my default search engine from all my browsers and am now using startpage.com.

That's all I've managed to change so far. I am seriously considering hosting my own mail server, but actually in a way it's less secure. If I mail someone from my gmail account who has a gmail account (lots of people) the exchange is entirely encrypted. Unless there is a court order to view my gmail (ridiculously unlikely) it is private. If I hosted my own mail server, it would be unencrypted unless both parties were using PGP.

Anyone else changed anything? Nothing at all? Were already doing such things?

I need to give you a shell on my server so you can chat on our secured IRC server too.

Rev Hellfire · 27-06-2013 02:48PM

I've changed absolutely nothing.

I did think about shifting off Google for mail, but tbh couldn't think of a compelling reason to do so.

Trojan · 27-06-2013 03:20PM

One thing I was thinking of years ago - but figured it would get me into trouble

- was this: a set of plugins for browsers/servers/websites that create noise. Lots of false traffic including every word on every possible black list, plus a bunch of innocuous stuff, all being sent hundreds, maybe thousands of times an hour by every user and device on the web. Theoretically it could render a massive amount of anti-privacy methods so costly as to be impossible.

Gotham · 27-06-2013 03:30PM

For the past few years I've been running a private IRC server with forced 4096 SSL and authentication.
I don't use any chat clients that aren't IRC or on LAN.
I used throwaway emails for social networking, which I also fill with flaky information.
Online items are bought with a prepaid card with flaky credentials attached to paypal.

Nothing has changed. But I might start using buttcoins.

Addendum:
I cant find the article now because it's drowned out in all this PRISM stuff, but it was pretty clear to me that Skype was being monitored.
The article was an experiment where links were sent out to people who were supervised not to click. (http://website/link?param1&param2)
The links were not only clicked by some unknown entity, the url parameters were also changed.

Years ago, a friend and I joked about this theory on MSN. We spent days sending stupid messages to each other including words like "bomb" "semtex" "agent orange". His chat client started to become very unreliable, some messages not being sent at all. We were finally convinced a year later that we were being spied on (at least automatically) when he could reproduce his connectivity issues by saying "agent orange" repeatedly.

AnCatDubh · 28-06-2013 11:09PM

Have now deleted 15,600 google search history entries and turned it OFF for the future. My rationale - if I do search using google now which hopefully will be on rare occasion, it won't know it's me anyway. Yeah, I know..... too late - the 15,600 have already been sucked down into a data centre in Utah, but I’m thinking that's only relevant if they, in the future can figure out its me.

My web access via smartphone has gone into private mode by default, no history, no cookies, no persistent logins to anything, very few apps thus far. I intend to go that route with the browsers on machines which I use - private, zero cookies, blah, blah....

I'm reading the privacy statements of services which I may want to use. Yes, i'm READING the privacy statements. Sweet jeebs...... What is becoming of me

As I said earlier - small steps, and yeah I'll probably mess up along the way, but i'll be getting there - wherever there is.

hooplah · 30-06-2013 10:37PM

This might be useful for people looking for alternatives:

http://prism-break.org/

that said the functionality of many of the solutions they reccomend don't go anywhere near matching what they should replace. I have f-droid installed on my phone and it just doesn't have anywhere near enough software to contend with Google Play

Walker34 · 01-07-2013 01:35AM

1)Windows is history....changed to linux.
2)Ccleaner changed for BleachBit
3)Tor installed.
4)Any private documents are kept on a pc with NO Ethernet card.....ie not on internet.
5)Dropped Firefox for Chrome, but looking for a better alternative security wise.
A host of other changes .......but they are PRIVATE Barak!........sorry.

Black Swan · 01-07-2013 01:43AM

Walker34 wrote: »

3)Tor installed.

I haven't used Tor in awhile. I stopped using it because during peak user times it became sluggish and sometimes I got timed-out of sites. Has it improved in the past couple years?

Walker34 · 01-07-2013 01:51AM

Black Swan wrote: »

I haven't used Tor in awhile. I stopped using it because during peak user times it became sluggish and sometimes I got timed-out of sites. Has it improved in the past couple years?

I don't see any effect with Tor speed wise.....its the same on as off.I doubt that the NSA would allow Tor exist without means to circumvent it anyway:mad:.

Gotham · 01-07-2013 10:05AM

Walker34 wrote: »

I don't see any effect with Tor speed wise.....its the same on as off.I doubt that the NSA would allow Tor exist without means to circumvent it anyway:mad:.

The NSA don't really have a say in peer to peer networks. They can make it illegal to use certain strengths of encryption, but they cant use those laws on non-us citizens. In short, the NSA cant do shit about Tor with good encryption, that being said - when I checked years ago, the encryption wasn't particularly strong.

Tor used to be slow, but now that loads of universities are setting up exit nodes, they've effectively donated to the cause. Maybe for now, just check that the exit node is non-us

Grudaire · 01-07-2013 10:42AM

Considering that tor is funded by the Americans I'm not sure that it is safe from their prying eyes in the slightest..

Walker34 · 01-07-2013 10:47AM

Gotham wrote: »

The NSA don't really have a say in peer to peer networks. They can make it illegal to use certain strengths of encryption, but they cant use those laws on non-us citizens. In short, the NSA cant do shit about Tor with good encryption, that being said - when I checked years ago, the encryption wasn't particularly strong.

Tor used to be slow, but now that loads of universities are setting up exit nodes, they've effectively donated to the cause. Maybe for now, just check that the exit node is non-us

With a multi billion dollar annual budget the NSA has a say in anything it wants to have a say in......all whistle-blowers do is create some mild irritation or embarrassment for presidents........nothing a blinding white-toothed smile and a calmly delivered threat of economic sanction cant diffuse........right Angela?

yoyo · 01-07-2013 10:53AM

Is there any decent encrypted Skype type voip app with video? Not too worried myself but have a mate paranoid about all these things (some understandable but taken too far imo). Tried that Jitsi thing and it's rubbish, welcome back to the year 95 and dial up voip... It would be great if you guys could suggest a "secure" Skype alternative. Open source would be a bonus. Ironically mobile conversations aren't an issue (although they cost money

:P )

Nick

Walker34 · 01-07-2013 04:30PM

yoyo wrote: »

Is there any decent encrypted Skype type voip app with video? Not too worried myself but have a mate paranoid about all these things (some understandable but taken too far imo). Tried that Jitsi thing and it's rubbish, welcome back to the year 95 and dial up voip... It would be great if you guys could suggest a "secure" Skype alternative. Open source would be a bonus. Ironically mobile conversations aren't an issue (although they cost money :P )

Nick

The only safe option is to be very selective about what you type,and before posting, imagine yourself in John Brennan's office with a couple of XeServices(formally known as Backwater) people idly toying with a megger and and 2 large crocodile clips and think to yerself "would I want these guys to log into Boards.ie and read my recent posts.......there is one last chance to delete before posting.....and don't forget this stuff is there forever.

howamidifferent · 01-07-2013 04:49PM

I've been intermittantly using various VPN services over the years, not for any real reason other than I likewise didn't like the idea of my traffic being monitored (mainly by my employer ).

But I had let that lapse since March and have now signed up for a year to Witopia VPN who have exit points in 35 countries , or 160 cities globally. It's cheap at $69 and the reviews are all good.

Likewise I'm looking for alternatives for email...

I used to have Truecrypt installed from version 1.0 upto version 7 but uninstalled it becuase it was on a work laptop and it looked likely my employer was going to encrypt all laptops with McCafee encryption. Didnt happen except for executive laptops so I may re-install Truecrypt and encrypt the whole disk OS and Data.

Nothing to hide but I dont want anyone compromising my privacy. :mad:

yoyo · 01-07-2013 06:13PM

Walker34 wrote: »

The only safe option is to be very selective about what you type,and before posting, imagine yourself in John Brennan's office with a couple of XeServices(formally known as Backwater) people idly toying with a megger and and 2 large crocodile clips and think to yerself "would I want these guys to log into Boards.ie and read my recent posts.......there is one last chance to delete before posting.....and don't forget this stuff is there forever.

Ahh I know, it's more I'm trying to find a voip service my m8 will trust as he won't trust Skype. :pac: . Pity all the Open Source ones we tried are sh!te. Actually he is on linux (of course

) and I'm Windows so it would have to be cross platform, does such a secured client exist? Jitsi has been tried and is thrash.

Nick

Black Swan · 02-07-2013 01:07AM

Walker34 wrote: »

2)Ccleaner changed for BleachBit

Why leave Ccleaner?

Walker34 · 02-07-2013 11:06AM

Black Swan wrote: »

Why leave Ccleaner?

Could not find Ccleaner for Linux hence Bleachbit.

Permabear · 02-07-2013 06:56PM

This post has been deleted.

Gavin · 02-07-2013 08:14PM

This all seems rather crackers. You should simply assume that you have no privacy on the Internet and act accordingly.

There is no freedom of speech on the Internet, no automatic right to privacy. Think about all the services you use that make up the internet, from the low level network connection to web searching, forums (!), email etc. All that data is being routed all over the place through large numbers of different organizations, all with their own view on privacy and you think that they all respect, or even are required, to respect your privacy?

Using a VPN, or Tor, is an even worse idea. You are almost guaranteed that someone is monitoring the endpoint for unencrypted traffic.

KELTICKNIGHTT · 17-07-2013 06:11PM

i use StartPage.com,, like it works good
instead of google and tor , but as said, tor doesn't access some site but they know this and probably fix soon , tor downloads are up a lot since the prism leak

use gmail , so with till i can get a better way,, as many have said, small steps,,
think in long run, nsa will try too keep doing what they do regardless what people do as governments across world seem to let them or not even to stop them which is sad

Nika Bolokov · 20-07-2013 10:03PM

Looking forward to this coming on stream

www.heml.is

Macumazan · 28-07-2013 01:25PM

Nika Bolokov wrote: »

Looking forward to this coming on stream

www.heml.is

Sounds promising! Have you heard of Gibberbot by the Guardian Project? It works on every platform and provides for secure messaging, I would recommend this in the meantime.

Macumazan · 28-07-2013 01:28PM

KELTICKNIGHTT wrote: »

i use StartPage.com,, like it works good
instead of google and tor , but as said, tor doesn't access some site but they know this and probably fix soon , tor downloads are up a lot since the prism leak

use gmail , so with till i can get a better way,, as many have said, small steps,,
think in long run, nsa will try too keep doing what they do regardless what people do as governments across world seem to let them or not even to stop them which is sad

I moved from gmail to an icelandic e-mail server but you can set up your gmail account so that anything sent there will be sent to your new address.

You're right that the NSA will keep doing all they can to erode your privacy which is why it's important we do all we can to stop them through promoting open source software, encryption, use of VPN's and so on.

Speaking of which if you don't like Tor, try using a VPN. My favourite is BTGuard. They have servers in Singapore, Netherlands and Canada, where they're not required to keep logs. Whichever you choose make sure you find one which accepts payment in Bitcoins, as then you'll be able to sign up anonymously.

PRISM - What have you changed?

Comments