Articles on ElPengu https://elpengu.com/posts/ Recent content in Articles on ElPengu Hugo -- gohugo.io en-us Tue, 07 Feb 2023 09:53:27 +0200 Online Privacy Guide https://elpengu.com/posts/privacy-guide/ Tue, 07 Feb 2023 09:53:27 +0200 https://elpengu.com/posts/privacy-guide/ One benefit of using libre software is the privacy you’re getting. Libre software usually contains no spyware, no trackers and no ads, because if it did, it could be easily pointed out in the source code and removed by forking the project. The same can’t be said about closed-source software, because, not being able to audit the source code, its privacy is as good as the developer promises. There have been many cases of software lying about it’s data collection, or hiding it deep inside their terms of service. One benefit of using libre software is the privacy you’re getting. Libre software usually contains no spyware, no trackers and no ads, because if it did, it could be easily pointed out in the source code and removed by forking the project.

The same can’t be said about closed-source software, because, not being able to audit the source code, its privacy is as good as the developer promises. There have been many cases of software lying about it’s data collection, or hiding it deep inside their terms of service.

Thus, the first step to have a more private internet experience is using libre software only. However, even with libre software, there are some additional steps required to ensure better privacy.

Identifying a threat model

You cannot have both privacy and convenience. There is always a tradeoff between the two. For this reason it is important to establish a personal threat model you want to protect against, to know how far to go. The goal should be obtaining a balance between the two, not going all out on one.

Possible threat models

  1. Strangers
  2. Family, friends
  3. Stalkers
  4. Companies
  5. Governments
  6. Everyone

The higher on the list, the higher privacy you should seek. This guide will help you improve only your online privacy. If you set a thread model between the last two, you should also look into hardware privacy, such as libre boot and degoogled Android phone.

Step 1 ➤ Browser

The browser is the program you use the most, so it makes sense to secure it. There are a few things to look out for in a good browser:

  • Provides a way to disable javascript
  • Is open-source
  • Does not phone home (or provides a way to disable phoning home)
  • Does not connect to any unsolicited IPs

Knowing this, we can definetely say that the following browsers are a threat for your privacy: Google Chrome, Opera, Safari, Microsoft Edge.

Good practices

  1. Clear your cache everytime you close your browser
  2. Use only non-javascript website when possible
  3. Spoof your user agent to fit in with the others. Make sure you are not unique
  4. Use privacy-friendly alternatives for popular websites (see the guide below)
  5. Only use HTTPS
  6. Check what connections your browser is making, with a tool such as iftop

There are a few browsers out there that provide good privacy, while also having modern features. I will rank them based on the privacy they provide outside the box. You should choose a browser based on your threat model, needs and experience with tinkering with configurations.

Browser list

Firefox

Privacy Level: Low

Firefox is the default browser on most Linux distributions. This makes it a solid option for new users and people just beginning their privacy journey. Although not a good solution in the long run, Firefox provides an indispensable basis for other browsers, being a direct competitor to Chromium.

Firefox phones home by default and has javascript enabled. Firefox can have a decent privacy level if applying arkenfox’s user.js and installing privacy extensions. A simple and efficient guide for hardening Firefox can be found here.

If you are not willing to configure Firefox, you should look into its forks that provide better privacy defaults.

[Download] [Website]

Librewolf

Privacy Level: Medium

Librewolf is a fork of Firefox aiming to fix all of its parent’s problems. It hardens Firefox and ships uBlock Origin by default, a powerful ad blocking and javascript blocking tool.

Librewolf phones home at startup, although it can be disabled from about:config. If all you want is a browser that works, Librewolf is the middle ground for privacy and convenience. Definitely use over vanilla Firefox.

[Download] [Website]

Tor Browser

Privacy Level: High

TOR Browser is a fork of Firefox built to be used on the onion network. Depending on your threat model, you might need to use the onion router to access certain websites. Tor is the recommended browser for doing so in order to blend in with other tor users.

TOR Browser does NOT have the best privacy settings outside the box. Javascript is enabled by default, and you absolutely don’t want to use that on onion websites. You also don’t want to use DuckDuckGo, the default search engine. Not only it does not index onion sites, but it is also not good for your privacy. Use a privacy respecting search engine instead (see below).

To disable JS, go into settings and select the Safest option from Privacy & Security.

Note that TOR might be blocked on your network / in your country. In that case, you need to use a TOR bridge to connect to the onion network.

[Download] [Website]

GNU IceCat

Privacy Level: Very High

IceCat is GNU’s fork of Firefox. It is the best Firefox alternative because it provides the most privacy features, however they come at the cost of usability. IceCat is known for easily breaking website due to its LibreJS feature.

It is a good option if you need to browse the internet safely and don’t care about some sites that require javascript not working. If your thread model is high enough you shouldn’t use websites that require javascript anyway.

IceCat can be used to connect to the onion network, however that is not recommended due to your unique fingerprint related to using another browser than TOR.

[Download & Website]

Brave

Privacy Level: Medium

Brave is the browser based on Chromium that advertised itself as the browser for privacy. It comes with good privacy features outside the box, however it is known for adding spyware features in the past, such as telemetry, auto-updates and Brave Rewards.

Should only be used if Chromium engine is required and Ungoogled Chromium cannot be compiled in a reasonable amount of time, or the binary cannot be installed, for some reason.

Brave can be used to connect to the onion network, however that is not recommended due to your unique fingerprint related to using another browser than TOR. Moreover, its suspicious privacy features make it a bad tool to browse onion websites.

[Download] [Website]

Ungoogled Chromium

Privacy Level: High

Ungoogled Chromium is Google Chrome without trackers, ads, phoning home, Google search engine, Google Extension Store, Google accounts. Therefore, it is very minimal and does not provide any privacy features out of the box.

Its downside is that you have to compile it and it is not user-friendly, installing extensions being a tedious task. However, if you need a chromium based browser, it is the best solution out there.

[Download & Website]

Step 2 ➤ Privacy-friendly online services

Even if you have a secure browser, your data is still accessible if you simply hand it over to Google, Facebook or other companies. You should aim to replace all of your services from these companies with privacy-friendly alternatives.

You can see the privacy-friendly services hosted by ElPengu here.

Search Engines

LibreX

Privacy Level: Very High

LibreX is a meta search engine that pulls Google results. It uses no javascript, therefore your search queries can’t be tracked.

LibreX is written in php, therefore it is lightweight and can be easily hosted by anyone.

Useful features LibreX includes:

  • Torrent search
  • Onion links indexes
  • Custom searches such as crypto converting
  • Configurable privacy-friendly instance URL replacer
[Recommended Instance] [Instance List] [Source]

SearXNG

Privacy Level: High

SearXNG is a fork of SearX, a meta search engine that pulls results from a lot of search engines, including Google, DuckDuckGo, StartPage. It requires javascript for proper use, which can be maliciously modified by the host, but has the advantage of being very customizable.

Features:

  • Torrent search
  • Vim keys
  • Tracker URL remover
  • Special queries
[Recommended Instance] [Instance List] [Source]

Whoogle

Privacy Level: High

Whoogle is a customizable search engine pulling results from Google. It doesn’t require javascript and is lightweight on the system. It is written in python, therefore it can be slow at times depending on server load. Can be easily deployed locally.

Features:

  • Tracker URL remover
  • Randomly generated user agent
  • Proxy support
[Recommended Instance] [Instance List] [Source]

YouTube alternatives

Short note on YouTube and other media platforms

YouTube is probably the last platform you have control over. Due to its nature, YouTube is often used to manipulate through the user data it collects, because after using it for a while, the platform knows more about you than you yourself proably do. This applies to other media platforms as well, such as Instagram and TikTok, but you can still use a privacy-friendly alternative to watch your favourite content creators on YouTube.

Privacy-friendly instances do provide a good workaround to the data collection problem, recommending videos not based on your viewing habits, but based on the instance’s userbase subscriptions. You still have complete control over your subscriptions and can easily disable the recommandation page.

Particularly, on ElPengu’s Invidious instance, recommandations are disabled by default and cannot be enabled by the user. The idea is that you should only watch content you wanted to watch in the first place and you should search for new types of content. There are better things to do than to spend all day mindlessly watching videos spoonfed to you by any type of algorithm, ethical or not.

Invidious

Privacy Level: Very High

Invidious is a javascript-free alternative to YouTube. It is by far the most popular and feature-rich privacy-friendly frontend for YouTube. Keep in mind that you cannot interact with the video through comments or likes, but you can still see what others commented, similarly to the original platform.

Features:

  • Recommended page based on what the instance’s users are watching
  • Highly customizable settings for the administrator
  • Accounts (for subscriptions) that can easily be exported to a json file to move to another instance
  • Tracker-free
  • Downloading videos
  • …Many More…
[Recommended Instance] [Instance List] [Source]

PeerTube

Privacy Level: Very High

Invidious is a javascript-free alternative to YouTube. It is by far the most popular and feature-rich privacy-friendly frontend for YouTube. Keep in mind that you cannot interact with the video through comments or likes, but you can still see what others commented, similarly to the original platform.

Features:

  • Recommended page based on what the instance’s users are watching
  • Highly customizable settings for the administrator
  • Accounts (for subscriptions) that can easily be exported to a json file to move to another instance
  • Tracker-free
  • Downloading videos
  • …Many More…
[Recommended Instance] [Instance List] [Source]
]]> Why you should use libre software https://elpengu.com/posts/why-libre-software/ Sat, 26 Nov 2022 18:42:53 +0200 https://elpengu.com/posts/why-libre-software/ Let me ask you a question: do you control your software or does it control you? This should be an obvious one, you would think. Of course, I own my software… After all, I decide when I open what app, how long I use it and how I use. Is that right? Do you really decide how much time you spend on each app and how you use it? The problem with modern day software Modern day software is closed-source. Let me ask you a question: do you control your software or does it control you? This should be an obvious one, you would think. Of course, I own my software… After all, I decide when I open what app, how long I use it and how I use.

Is that right? Do you really decide how much time you spend on each app and how you use it?

The problem with modern day software

Modern day software is closed-source. This not only means that the source code is not available to the public to audit, but no one can contribute to the project either. This affects you even if you don’t know how to code, because closed-source projects have total control over their users through their terms of service.

Let us analyze an example of said control:

(extracted from Discord TOS)

As we can see, you offer Discord the permission to almost do anything with your content, which includes:

  • Messages
  • Images (may include your memes, personal photos, profile picture etc.)
  • Voice calls

This is especially dangerous in a hivemind like environment such as Discord, where you don’t give too much thought to what you post and say. What’s more is that your discord messages are not encrypted in any way, which is a VERY BIG red flag, considering that one of Discord’s biggest investors is Tencent, a Chinese company. Thus, all of your data on Discord now belongs to the CCP as well, because all Chinese companies are required to report back the data they collect to the government.

(your data is not yours and we 'may' keep it for as long as we want)

Examples of abuses of privacy and control over users can be seen in all closed-source projects, without exception.

Why care about data collection?

I have nothing to hide! So why would I care about my online privacy?

This statement is so common, that I figured people don’t even think about what it means before mentioning it. Obviously, saying that you don’t care about privacy is a lie and I will prove it to you:

  • You wouldn’t show your teacher your phone’s content.
  • You have some kind of password protection on your phone.
  • You wouldn’t show your own parents your phone’s content.
  • You wouldn’t let a random person on the street look into your laptop.
  • You wouldn’t show your gallery to your employer.
  • You wouldn’t want an anonymous person to know where you live.

However, when it comes to online privacy, we let every big tech company know us better than we know ourselves. YouTube knows exactly the topics you are interested in and what kind of entertainment content you enjoy. Instagram knows what type of people you would be friends with. Tinder knows what type of people you would date. TikTok has hundreds of data-points about you, knowing anything from your favourite color to your deepest concerns about real life.

Why is it dangerous? These companies’ profit model is to keep you on their platform for as much as possible: that’s how they maximize their profits. So, they will do anything in their power to have a monopoly on your attention span. It’s not unusual to see people glued to their phone’s screen for 8 hours a day.

Everything you do online is influenced by these companies, in one way or another. They control what’s cool, trends, ideas, mentalities, and the worst part is: you don’t even know you are being manipulated. The best way to control a population is to hijack their decisions, making them think they are choosing for themselves, when in fact, you are the one choosing for them.

Subscription models

Another nice feature of proprietary software is that you don’t actually own it, but instead are allowed to use it. Companies realised that charging for software once is a bad business model, so they had the brilliant idea to charge you monthly. In theory, it sounds like a win-win situation: you pay less and companies get more money, but over time you end up paying more than a 1 time purchase, and when you finally decide to end your subscription, you lose everything you paid for up to that point.

Everything is subscription based nowadays, but one notorious actor is Adobe. It used to be that you could pay once for Photoshop, but now you can only use it if you pay a monthly fee. This creates an endless loop where the user always comes back for another month, in order to continue working on their projects. Thus, Adobe has a monopoly over digital media creation software, and most users are stuck with it.

Closed-source creating walled gardens

The reasons we, as humanity managed to advance so much is because we worked together to achieve certain goals. We live in a day where technology is our most powerful tool. However, having closed-source software rule our ecosystems means we are limited to what the developer wants us to do with their software.

We’ve come to a point where we are forced to use some software because everyone else uses it. Whether we talk about Microsoft Windows, Microsoft Office, Whatsapp, Instagram or iMessage, we can observe how society adopted these programs as an open standard, when in fact they are far from it.

It used to be that software was built on standards, not the other way around. For example, chat protocols like XMPP, IRC, Matrix do not have their own messaging applications, but other developers created software integrating these programs. Web protocols, programming languages, server protocols are all open-source, because you cannot have a standard be governed by one single entity. Decentralisation is key to a better internet and better technology.

Big tech companies want us to relocate ourselves inside their own walled garden, so they can get as much profit off of us as they can. This is why there exists such a thing as the trend of iPhones being cool and Androids being for poor people, even though Samsungs can be more expensive than iPhones.

The solution: free and open-source software

What is free software?

Free software is not only free of cost, but also open to the public. This means that anyone can audit, modify or redistribute the source code. FOSS solves the problems mentioned above because no tracking and manipulation technology can be implemented in this software, because anyone would be able to see what the developers were up to. Free software evolved a lot, to the point where today you can replace 100% of your computational activities with programs that respect your freedoms.

Examples of free and open source software:

These programs are immediate replacements to the proprietary software you are currently using. Integrating as many of the programs listed below as possible will give you a better computer experience, better privacy and as a result, a better lifestyle.

Linux

Linux is the most popular open-source project. It is a kernel written entirely in C, and it is widely used on servers, but also on desktops and phones (under Android). You should definitely replace your current operating system on your desktop / laptop with Linux. A post about Linux will come by soon.

Firefox

Firefox is the only viable alternative to Chromium based browsers. Although it does not provide the best privacy outside the box, it being open source allowed a new family of privacy-friendly browsers to exist. For the average user, the experience is exactly the same as Chrome, without all the spyware and ads. It even allows you to import all of your bookmakers when installed. Note that for maximum privacy you need to configure Firefox.

Element

Element is a messenger application using the decentralised, federated chat protocol Matrix. You get to choose the server your data is stored on (encrypted) and you can interact with any other user, regardless of their server or client. In simpler words, multiple chat applications can communicate with each other through multiple servers. With the power of decentralisation, your data is safe and, in case of a server being compromised, you can always switch to another.

Signal

Signal is a centralised messenger application. It requires a phone number, but is easy to use and similar to other proprietary messenger apps. Messages are encrypted by default (verifiable through open-source). If you are not willing to set up a Matrix account, you should use Signal instead of WhatsApp.

Not convinced yet?

Here is a YouTube video that should cover anything that I missed out on. You should definitely only use libre software.

]]>