My thoughts on privacy and security

— Albert De La Fuente Vigliotti

A good friend of mine motivated me to write down this post. I am not sure how I am going to address this in a “short” way since security and privacy is such a vast topic. It can be taken to several levels also, so it is a matter of how you actually compromise in favor of being usable and practical, since the power in place make it difficult on purpose to have open alternatives that work.

I am going to do my best to divide this in different topics, keep it short and non-technical. It is going to be challenging.

Desktop #

GNU/Linux is definitively the way to go. Personally I don’t trust Microsoft nor Apple. In general I am an advocate of open source.

Personally I have been using GNU/Linux since around 2000, and I am extremely comfortable with it. I understand that it could be a challenge where we still don’t have alternatives (or high quality tools) to some specific software like CAD. But at the same time Linux have better tools in many other aspects.

There are different “distros” of GNU/Linux. A distro (or distribution) is the mixture of the tools from GNU, the Linux kernel and a way to manage packages. This is a very simplistic definition, but I don’t want to get too technical here.

Distributions for the beginners:

Distributions for more mature users:

Mobile #

Between IPhone and Android, I will always chose Android. The reason being that Android has a hybrid open/close source development model. It is possible to get the Vanilla version of Android without google play (actually nothing from google) and then you can install an alternative to google play like F-Droid or Aurora Store.

I don’t completely trust Aurora Store because it is a front end of Google Play itself, and software could have backdoors but I still think it could be a better alternative than have a phone that you paid for but Google owns.

Just like GNU/Linux, there are several distros. These can com “with gapps” or “without gapps”. Gapps being “Google Apps”, in other words, Google Play, Gmail, Google maps, etc. Without gapps is the way I prefer to go personally.

There are several custom roms like:

The most secure focus are Graphene and Calyx. Again, privacy and security is a deep rabbit hole. As deep as you can afford to go.

Personally I have been using Lineage for years and some custom mods. Every single Android device that I owned, I flashed and removed the original Android and replace it with a custom rom without Google Apps (nothing from Google). I have been doing this since around 2006. I am very curious to try Calyx though. If I would be starting from scratch, I would go for Calyx.

I have a Mediatek chipset on my phone and I hated it! That was definetively a bad purchase for this purposes. Don’t get me wrong, the phone is great, but it is not easier to flash a custom ROM. I would go for Qualcomm chipset instead and make sure that the bootloader can be changed. This Ulefone Armor 23 looks promising. Apparently the 24 will also come with a Qualcom chipset.

Network #

When in doubt, use a VPN or TOR circuits. In this way your traffic remains more secure. You can get a router that has that capability already built in, so you can route everything through that device.

Always use a firewall and disable the services you don’t use. Use strong passwords.

If you are looking for an appliance that can do all of that you will need DD-WRT, pfSense or similar if you want a DIY approach and you are techie enough or go for a similar commercial solution like the BraxRouter (I am not affiliated in any way, and I haven’t tested it personally so be cautious and do your own research - DYOR).

Authentication #

I prefer avoiding using SMS authentication, I don’t trust the telephony system. They have too much power and knowledge about their users.

I also avoid the Google prompts. Those who appears when you are trying to login on your phone while you are trying to login on your computer. The reason is simple, they tie your identity on the computer with your phone, because you will have to “click” on your phone. All traffic will be related.

I don’t use Google Authenticator nor Authy, or any Android app for that matter unless it is opensource. Personally I use one on my computer, this brings extra security and inconveniences. If I am not with my computer, I cannot login anywhere, even with my phone. I decided to live with that inconvenience.

Use 2FA (Second Factor Authentication) whenever possible, but with OTP (One TIme Password) for that. I prefer free TOTP software, the caveat to this approach is that you will have to handle your secrets yourself in a secure way, so you don’t lose them and nobody else has access to them. Please don’t even think about putting that into Dropbox!

I am a fairly technical guy so I prefer to keep the secrets under my control having encrypted backups than “trusting” any other party.

I am not going to disclose publicly here what I use for security reasons. But if you know me personally and have questions ask me one on one and I will share more about this.

If you want more information, do your own research. I can point you to this video, as a quick overview. I think the title is a bit missleading though, I trust 2FA with TOTP where the secrets are encrypted and properly backed up.

IM communications #

Signal or no signal… that is the question…

I have been a huge fan of Telegram. At the beginning, you did not needed to use a phone number, it was just an account you created (and you could create as many as you wanted) and that was it. No verification and no ties to your identity. Sadly, now they “require” a phone number, which is by design IMO. So I no longer trust Telegram. The same argument goes for Signal.

I am aware of Signal’s history, even before it was signal and the original developers, but again… I don’t trust supplying my phone number to any app for any reason. There is no need for that, none.

I have always hated Whatsapp, security is crappy, it belongs to Meta. Huge user base… So many reasons that I wont even go there…

My preferred method for IM is XMPP which is federated in nature, so “no central points” (again, loosely said). I would prefer to pick up a server that is not crowded, it is in a country outside of the 5 eyes 1.

In terms of privacy, OMEMO would be preferred, or asymmetric cryptography with GPG/PGP, or OTR (Off The Record) to say the least.

Email communications #

This is a topic that I struggled with for some time.

Bottom line is I don’t trust large providers, because they are an easy target. Out

I wrote a note, which is not publicly available analyzing the email providers by April of 2022. Before that I was using a really old google apps account that I created around 2005. It was very convenient, I am not going to lie, but I never felt good about it so it was good that Google decided to kick me out by charging me. If I have to pay, I prefer to pay for something more friendly towards privacy than to them.

Here is a table with a summary of some of the criteria that I used to analyze those providers.

Provider Domains IMAP Location EAR Crypto pay App Alias Storage Price/m 2FA Cons
CounterMail 15$ yes Sweden yes BTC no inf 4G ~5 yes sweden
Mailbox.org 50? yes Germany yes no? no 25⁄50 10G 3 yes meta exposed, tracking
Runbox - Mini 5 yes Norway no BTC no 100 10G 2.91 no EAR
Protonmail - Plus/Pro 10/*1* bridge Switzerland yes yes 5 5G/5G 8⁄5 visibility, suspicious
Mailfence - Pro/Entry 5⁄1 yes Belgium no BTC/ LTC yes? 50⁄10 20G/5G 7.5⁄2.5 not EAR
Posteo+ 0 yes Germany yes no ? ? no domains
Ctemplar - Knight 5 no Iceland yes XMR /BTC yes? 30 10G 12 yes no IMAP
Tutanota no Germany yes no yes own encryption, no IMAP
Fastmail Standard 100 Australia no? 30G 5

Personally I liked Ctemplar, but I wanted IMAP since I use Emacs/mu4e for email management and the possibility of keeping a local copy of my emails if needed. I also use my phone to read emails when needed. So I had to discard them. Depending on your use you may not need IMAP.

Honestly I am still not comfortable with my email provider, but I am better than at Google’s.

In regards to usage, GPG is always preferred but of course it depends on both parties using it. Be mindful that RSA 2048 is no longer secure, governments can break into it. Probably not regular people. So I would go for 4096 bit keys.

I am not going to disclose publicly here what I use for security reasons. But if you know me personally and have questions ask me one on one and I will share more about this. I know that if you are a technical person you can find this yourself.

Conferences #

I don’t trust Zoom. Do your own research here. One of the founders was an ex-Cisco systems. Again… do your own research.

I would go for Jitsi or something is open source. Of course a case could be done that there is always a server as middle man, to which yes, I agree. At this point I don’t know of any better alternatives, Jitsi is the way I would go or Signal’s video chat feature. Even though I don’t trust much Signal either.

Browsing #

I don’t use Google Chrome, even less Microsoft Edge. I prefer the old Firefox.

As part of my setup I don’t save cookies when I close the browser nor history. I always prefer private mode when possible and I use a bunch of extensions to make my unique fingerprint not so obvious.

I avoid using google whenever possible. I don’t trust much Duckduck go either. Search engines are the gate keepers of the internet, sadly there is no integrity in this business. I have read good things about Qwant.

I would advice to also disable Javascript by default by using No Script or similar. As using other extensions to make your tracking less obvious, even though I don’t think there is much to do here. Try to always use VPNs or TOR circuits. Be aware that having a high level of privacy/security could make your browsing experience miserable!

Money #

Well, this is going to be controversial. We don’t use money, we use fiat currency which is controlled by the governments and manipulated via inflation and taxes as they want. It is hard to get out of that. Cash is always preferred but it is not convenient, so balancing things out is up to the reader.

Precious metals could be an alternative but probably everything is going to get digitized in the future, even precious metals probably with certificates on the blockchain as Colombia is already issuing for real estate. So I don’t have good news here.

Probably having some money in a private crypto currency like ZCash, Monero, Verge or others could be a good idea. Be mindful of the fluctuations and the risks about it as the tax compliance.

Also be mindful that you should aim for a peer to peer market and that could be dangerous also, so you will have to “trust” the network somehow. If you use an exchange it defeats the purpose of privacy.

If you go for a private crypto, it is highly likely that you can run a local node. You can use a small device for such like a Raspberry Pi or a refurbished mini-desktop or notebook. You will have to setup the service and get a full copy of the block chain.

Honestly I would hedge for land, food security and water rather than save money. But that is just my opinion.

Emergency communications #

This is going to be controversial also. I am still learning about radio but I would definitively have a Ham radio and a rapport team, otherwise the radio alone is useless. Community is extremely important.

I prefer not to touch much on this subject. Do your own research. Maybe the Ghost network could help you. Check out this video on the Lilygo T-Deck device with the Meshtastic software for Encrypted Comms. And this video on Meshtastic and LoRa devices for general knowledge. I am fairly new to this, so do your own research. Not having to use a phone would be preferred IMO, so it is not tied to the IMEI number, MAC address, IP address and so forth.

Conclusion and closing remarks #

Remember, favor VPNs or TOR circuits, handle your secrets yourself in a secure and reliable way.

Don’t trust services where you need to supply personal data. Prefer services that offer alternative payment methods in crypto also.

As I said in the beginning, privacy and security is a rabbit hole that can go very deep, even for the technical guy. So I am trying to just give an overview.

If there is a category that I forgot about that you would like to see here, send me a message.

  1. For more on these “eyes” I suggest you to read: “Permanent record” by Edward Snowden and/or “No place to hide” by Gleen Greenwald.

    [return]