Digital Fingerprinting

[Here&Now]

These guys would be exempt from any surveillance, as always. It is the same with European Chat Control, where politicians are not under any control at all.

Right, I'm sure there's the strong possibility that they could exclude their own dirty dealings from the Eye of Sauron that they're building. So annoying.

There seems to be quite a global trend to build a massive surveillance network. If you haven't had an inherent interest in privacy methods before, it could be worth taking up the hobby now.

 

[Icon]

It could also benefit people that rely on anonymity, if more people adopt a uniform fingerprint, whether they personally need to. Hypothetically if everyone was using TOR we'd all look the same on more traits.

I've only been relying on VPN but more and more sites just block me while using it, to the point I just disabled it last year. It might be more effective if I upgraded off the generic proxies to a dedicated one?

 

[blig-blug]

I've only been relying on VPN but more and more sites just block me while using it,

What VPN? I use VPN all the time and while I do get many captchas, I don't get blocked. (or, alternatively, what websites?)

 

[Here&Now]

It could also benefit people that rely on anonymity, if more people adopt a uniform fingerprint, whether they personally need to. Hypothetically if everyone was using TOR we'd all look the same on more traits.

I've only been relying on VPN but more and more sites just block me while using it, to the point I just disabled it last year. It might be more effective if I upgraded off the generic proxies to a dedicated one?

Certain Western countries are making strides towards outlawing IP anonymity in general, which I assume would also include Tor by definition.

If you have a good sense for how proper privacy is implemented, Western governments' seemingly disparate efforts across various areas of law are clearly in fact a concerted effort towards creating an inescapable surveillance network. And its parts are usually being implemented under the guise of some altruistic goal, like protecting the children from adult material.

 

[Icon]

What VPN? I use VPN all the time and while I do get many captchas, I don't get blocked. (or, alternatively, what websites?)

Private Internet Access. It's been a while, I can't recall which websites exactly, I surf around a lot reading or window-shopping across many sites. Sometimes there would be a message about the IP being blocked due to phishing/DNS attacks, which I suppose really happens or could just be mistaken when a bunch of people are using the same VPN node. Other times it just seemed like web applications wouldn't load unless I disconnect from the VPN, presumably for technical reasons or maybe a policy of banning known VPN addresses. I might be crossing my frustrations with ad-block too, which more sites seem to detect and bar you from using their site unless you disable it.

 

[Icon]

Certain Western countries are making strides towards outlawing IP anonymity in general, which I assume would also include Tor by definition.

If you have a good sense for how proper privacy is implemented, Western governments' seemingly disparate efforts across various areas of law are clearly in fact a concerted effort towards creating an inescapable surveillance network. And its parts are usually being implemented under the guise of some altruistic goal, like protecting the children from adult material.

Yea it's definitely going that direction. Even vehicles collect a lot of information now that can be used to effectively track you. Mine knows my schedule and will offer up GPS guidance to certain destinations that it thinks I'm going to at that time of day, based on my history.

Actually it's not exactly my car, it uses data from my phone. Since I drive a different vehicle for work my phone thinks I go to certain places every day, and will try to guide me there in my car on my day off. I don't use my phone's GPS to get around my work route though, so apparently it's collecting my location regardless.

I feel like a lot of surveillance slips in under the guise of convenience. Like tapping with a card vs paying cash. I think they're aiming to phase out cash too.

Paywalls are another pain. You can't read anything on certain news sites or media sites like X without an account, which even if it's free is obviously collecting data.
I've seen some activity here that makes me think some people register a new burner account for every post they make.

You can imagine why the government wants to buy tiktok, which requires the user to share their history for the algorithm to make addictive suggestions. And the social trends are basically designed to entice someone to participate in creating content of themselves, further revealing their identity and intimate details of their lives.

 

[Here&Now]

I feel like a lot of surveillance slips in under the guise of convenience. Like tapping with a card vs paying cash. I think they're aiming to phase out cash too.

Yeah, this is so true. And I admit, I often fall into the trap as well. When the boost in convenience is significant enough, it can be so tempting.

 

[blig-blug]

Private Internet Access

I recommend you find a different one. Trust is personal, but I wouldn't trust something owned by this company: Kape Technologies (Formerly Crossrider) Now Owns ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and a Collection of VPN “Review” Websites I personally think that running those VPNs does more harm than good, as even an ISP may be more trustworthy.

I feel like a lot of surveillance slips in under the guise of convenience

Yes, I agree. Convenience and the pretense of it being a "choice" and "optional"... until it has enough adoption and the "option" disappears.

I often fall into the trap as well

It's normal, everyone does. That's why I prefer to think about it in an incremental way, of improving step by step and aiming to reduce my digital and data footprint as much as possible, instead of in terms of success or failure.

 

[dreamer042]

For me, the big dividing line is that between security and privacy.

As stated above, if they really want to track you down they can and will, but also as stated above, most of us are 'utterly unimportant' and not really in need of heavy security protocols and trying to be a ghost in the wires (or wireless as it were these days). That said, I'm strong believer that everyone deserves basic privacy and that is a right worth fighting for. So let's talk about it.

First, the type of people that need real security are the journalists, activists, whistleblowers, and yeah criminals of various higher degrees than people who grow mushrooms in their closet for personal use. If that's you, seek an expert, I'm afraid you are above my pay grade.

If you are a regular old Nexizen who just wants to browse the web without becoming a databroker's product, click a link and not be assaulted by advertising, keep your traffic from being sniffed by third parties, and access information without being tracked, targeted, fingerprinted, cookied, paywalled, redirected, popped up, enshitified, datasnatched, and sold the highest bidder, then let's look at some resources. I most assuredly don't have all the answers, so if you have tools and resources to help us enjoy a little more digital privacy please share and let's collect them here.

There are so many "privacy focused" extensions/addons/softwares/applications/tools to sift through, Some that are even straight up malware themselves posing as privacy tools (ghostery anyone?). It's truly an art form to balance legitimacy, hassle, and effectiveness. I'll share my baseline setup and a few other options and hopefully others will chime in and we can build a nice community toolkit.

I always try to keep up with EFF recommendations. EFF is the OG digital liberties watchdog, if anyone can be trusted to defend online privacy, it's them. Keep them on your radar for the latest updates.

1. Get a VPN! This encrypts all your traffic and hides it from anyone and everyone between you and the server you are securely connected to. Keeps the ISP from seeing that you visit DMT-Nexus forum 742 times a day. Use a reliable provider that doesn't keep logs, but always assume they are keeping logs and can be subpoenaed to hand those logs over at any time. Again, this is for privacy to keep our ISP or any other middlemen from sniffing our traffic and sending us cease and decist torrent lettters, this is not security. Security will require multiple layers of proxy + TOR at minimum and is outside the scope of this post. TOR is slow anyway and we want to maintain our speeds, which a good VPN does.

2. Use Firefox! In addition to being much more security conscious/friendly, Firefox is the only thing stopping a google monopoly on web browsers. Any Firefox based browser is great as well: Librewolf, Mullvad, Waterfox, etc. Some, like Librewolf, come more hardened and privacy friendly out of the box, but lag behind actual Firefox in updates and features. There are also various techniques for hardening Firefox if you want to move toward more secure protocols. At a minimum, go into the settings under Privacy and Security > Browser Privacy > Custom and select either "isolate cross-site cookies", or "block all cross site cookies" (recommend this option) and "in all windows" and check "tracking content", "cryptominers", "known fingerprinters", and "suspected finger printers", and again "in all windows". Also scroll down towad the bottom and select "Enable HTTPS-Only Mode in all windows" if it's not already selected. You can also disable the data sharing with Mozilla and turn off things like like notifications/location/camera/microphone/etc, history, autofill, and so on as preferred.
*A note on DNS over HTTPS: If you are using a VPN, you'll generally be using your VPN's DNS servers, so I generally recommend to leave this on default.

3. DuckDuckGo! or Startpage, or Searx, or Metager. While you are in those Firefox settings, go over the the search tab and change your default search engine to one that respects your privacy.

4. Addons! This is where things get really customizable and much more convoluted. I'm gonna give you my bare minimum that I install in every browser, every time:
Shoutout to HTTPS Everywhere, it still exists and you can install it if you like, but enabling HTTPS mode is now built into the browser directly so it's basically defunct. Thank you for your service old friend.
- uBlock Origin: This is the most important thing you do. It's the one stop shop to remove all the bullshit from your browsing experience. It blocks ads, trackers, coin miners, popups, etc. No more Youtube ads, no more banners, no more popups. It's infinitely customizable if you want to tinker, but it works for 99% of use cases right out of the box. install it from Mozilla addons and enjoy an actually useable browsing experience.
- Privacy Badger: From our good friends at EFF, This is the legit tracking blocker. It works quietly in the background and protects your privacy without requiring anything from you. Set it, forget it, and support the EFF in the fight for a better web.
- SponsorBlock: Make Youtube not suck again. Those sneaky ads that are embedded in the video and get through uBlock, gone. Those segments where the youtuber hypes their product sponsors, gone. You can even set it to skip non-music parts of videos, remove intros and credits, and skip the like and subscribe spheals. Technically, an optional quality of life upgade, but we all encounter youtube videos so much in our work and life, I really treat this one as a non negotiable standard.

That's it, one VPN software, one browser, a few settings changes, and 3 extensions for a baseline semblance of privacy and a useable web. This is the bare minimum to remove the most egregious tracking and advertising and still have most websites function correctly with minimal hassle. You may need to go into uBlock or Privacy Badger and turn it off on certain sites to get them to function correctly, some sites don't play well with firefox at all and you'll have to use a chrome based browser, a lot of sites these days don't like VPN's and will either block you outright, or put you through endless CAPTCHA robot check hell. It's the price you pay for privacy.

For those that want a little more than the bare minimum, I'll add a few more of my vetted choices:

- Decentraleyes: Interrupts library requests from big content delivery networks, helps further limit tracking, a good addition alongside uBlock and Privacy badger.
- CookieAutoDelete: Automatically deletes cookies when tabs close or browser closes. A bit fiddly and prone to break websites.
- ClearURLs: Strips tracking data out of urls, so links you click and share pass less metadata.
- CanvasBlocker: Fingerprint blocker. Fairly prone to break websites.
- Multi‑Account Containers: Firefox only. Compartmentalizes browsing sessions.

One last one that deserves special explanation:
- Noscript: Pro: doesn't let anything run without you giving permission. Con: doesn't let anything run without you giving permission! This is the absolute best tracking prevention tool available, but it's very management intensive. Recommended only for advanced users and the extremely privacy conscious who want to go to the granular detail of explicitly allowing everything at the individual script level.

This is only scratching the surface and I have a lot more to say on this subject. We still need to talk about basic digital hygiene, operating systems, mobile devices, and more.

 

[CosmicRiver]

I use a VPN with no-log policy and warrant canary and DuckDuckGo browser. Still i think that our writing style is very recognizable and an AI model could easily link multiple identities through that. That's what i'm mostly worried about.

@blig-blug can you explain the WhatsApp issue? I know they collect all chat metadata, timestamps, message type, contacts and so on, and that chat backups are not e2ee by default, but isn't the communication e2ee through the Signal protocol and that's verifiable?
Signal would be better but almost no one uses it here.

 

[blig-blug]

but isn't the communication e2ee through the Signal protocol and that's verifiable

Yes, the encryption is through the same protocol. The problem here is not encryption, it's the encryption keys. The Whatsapp client is a proprietary application, so nothing is stopping them from having access to your encryption keys and thus being able to decrypt anything they want. You have to take them ("them" being Meta) at their word that they don't do so. The way Whatsapp conversations sync across devices strongly suggests that they actively using the user's encryption keys for at least that purpose. Anyone who has used Signal or other E2E messaging systems where you can verify that the service provider has no access to your key knows that syncing is far from seamless. Plus, there is the fact that as soon as a message of yours is reported, a copy of it is forwarded that they actively access, they admit to this.

 

[Voidmatrix]

@Icon Thank you for sharing.

Because of how my mind works, not sticking to much for long, well, except for DMT, internet and digital security are things that i repeatedly come back to. It tickles my amygdala if you lnow what I'm saying.

That said, part of my issue is time. It takes time to understand the ins and outs of the mechanisms and functionality of this technology. That said, I'd like to be more consistent in taking this seriously, and as such, while I plan to read this whole thread, I'd be indebted to any and everyone that shares shortcuts for learning about a lot of this.

One love

 

[CosmicRiver]

Yes, the encryption is through the same protocol. The problem here is not encryption, it's the encryption keys. The Whatsapp client is a proprietary application, so nothing is stopping them from having access to your encryption keys and thus being able to decrypt anything they want. You have to take them ("them" being Meta) at their word that they don't do so. The way Whatsapp conversations sync across devices strongly suggests that they actively using the user's encryption keys for at least that purpose. Anyone who has used Signal or other E2E messaging systems where you can verify that the service provider has no access to your key knows that syncing is far from seamless. Plus, there is the fact that as soon as a message of yours is reported, a copy of it is forwarded that they actively access, they admit to this.

I see. I assumed that private keys being stored on-device was verifiable. I nsver used syncing across device but i think each device has its set of keys for the chat. Anyway the problem about closed source is that the operation of almost anything from private companies is closed source. I guess it can't even be proven that mobile keyboards don't store everything we type, microphones don't record us without permission and without notifying and so on.

 

[blig-blug]

I assumed that private keys being stored on-device was verifiable

No, and it could have been, if it had been FOSS. But they deliberately chose to have a proprietary client.

I nsver used syncing across device but i think each device has its set of keys for the chat

That's how it should be in theory. How it behaves in practice (the complete lack of the issues that often happen in these cases) point to the keys being stored in the servers.

Anyway the problem about closed source is that the operation of almost anything from private companies is closed source. I guess it can't even be proven that mobile keyboards don't store everything we type, microphones don't record us without permission and without notifying and so on.

They almost for sure do, again Google made the choice to force the user to be logged into a Google account.
However at least that can be avoided: there are FOSS Android distributions where the code is FOSS:

LineageOS – LineageOS Android Distribution

LineageOS Android Distribution

lineageos.org

CalyxOS

calyxos.org

GrapheneOS: the private and secure mobile OS

GrapheneOS is a security and privacy focused mobile OS with Android app compatibility.

grapheneos.org

GrapheneOS is security-focused and known to not be possible so far to crack by Cellebrite, the malware company used by police forces worldwide. I personally use Lineage just because my very old phone is not supported by Graphene.

 

[Voidmatrix]

I finally read the whole thread. Thanks to the big dawgs for the education: @Nydex @dreamer042 @blig-blug

I am not as far gone as I felt after reading this thread fully. I've been running Nord on my phone and laptop (not sure why I had stopped) regularly again. I rarely use social media (because I don't like it, but I have multiple accounts). I am a sucker for Google, partly because of work, but also, like @Here&Now get sucked into the convenience. I'm going to give myself grace considering my situation.

I will play around with some of the add-ons and plug-ins, some of which I think I'm already running on my computer. I'll probably play around with some of these other browsers too.

Samsung internet has this cool feature where I can make an icon for certain sites to have on my screen (I have one for the Nexus). That's a cool little feature idk if i wanna give up with this site it's like have the Nexus app.

One aspect that makes this important to me is the nature of influence. I'm picky/weird about that on all fronts, and I don't like things on the internet being "tailored" to me. I like the internet to be like the world, which is not tailored to me. I also don't want to be influenced by information that is couched inside data that is tailored to me. It's insidious.

The nature of violation of privacy and control is both personal and collective, obvious and subtle.

One love

 

[Nydex]

@dreamer042 thanks for the detailed explanation, that's really helpful! Your setup more or less matches mine - I use LibreWolf set to the strictest possible privacy settings and have only 4 addons - ClearURLs, DarkReader (no idea how unsafe it is but I can't suffer the flashbang of opening google docs late at night in my dark room...), Decentraleyes and Temporary Containers.

It's important to reiterate that every additional extension one adds to their browser is a potential attack vector, so basically always use only what you really, really can't go without. Interestingly, I haven't felt the need to install uBlock as LibreWolf seems to be successfully blocking everything it needs to. I'm actually quite happy with that browser.

Lovely thread.

 

[CosmicRiver]

No, and it could have been, if it had been FOSS. But they deliberately chose to have a proprietary client.


That's how it should be in theory. How it behaves in practice (the complete lack of the issues that often happen in these cases) point to the keys being stored in the servers.


They almost for sure do, again Google made the choice to force the user to be logged into a Google account.
However at least that can be avoided: there are FOSS Android distributions where the code is FOSS:

LineageOS – LineageOS Android Distribution

LineageOS Android Distribution

lineageos.org

CalyxOS

calyxos.org

GrapheneOS: the private and secure mobile OS

GrapheneOS is a security and privacy focused mobile OS with Android app compatibility.

grapheneos.org

GrapheneOS is security-focused and known to not be possible so far to crack by Cellebrite, the malware company used by police forces worldwide. I personally use Lineage just because my very old phone is not supported by Graphene.

Yes i know about Graphene and Lineage. I chat with friends on whatsapp and that probably reveals more about me than everything else i type...

Maybe mine is just wishful thinking, but it seems to me that, at least in the EU, these companies operate mostly in the legal framework or through grey areas and loopholes. I don't think they go straight illegal. I get no targeted advertising nor personalized content and i know from secondhand experience that local police systems and even cybercrime police have a really hard time accessing supposedly e2ee messages, and couldn't use them in court anyway if illegally obtained by companies. I guess even when they are backed up unencrypted on Google Drive, unless very few people do that. It isn't just hard, i think they really can't. Because i know web searches, emails and so on are routinely used. At least in my country.

I know there could be a level at which this happens, which is above police systems, more like a governmental or intergovernmental surveillance system. Again maybe it's just wishful thinking, but in this case, why such effort to end e2ee, to introduce on-device photo check and so on?

 

[blig-blug]

Samsung internet has this cool feature where I can make an icon for certain sites to have on my screen (I have one for the Nexus). That's a cool little feature idk if i wanna give up with this site it's like have the Nexus app.

Firefox can do that too, AFAIK

it seems to me that, at least in the EU, these companies operate mostly in the legal framework or through grey areas and loopholes

Maybe, or maybe not. The thing is, there are easy alternatives, so why trust companies that deserve zero trust? And, as you mention, the legal framework of the EU is close to changing anyways.

I think the big push for backdooring is to make it easily available and convenient for police forces and surveillance programs of all tiers. I imagine the higher tiers and intelligence services already are given access to it, your town police probably doesn't. But I don't know, this is my guess.

There's something revealing: despite its lack of E2E encryption by default and thus for most users, Telegram was recently pressured much more than Whatsapp has ever been, when its owner was detained in France. My guess is that France and other EU countries weren't being given access to user data, so they did what they needed to do to make sure that changed. A similar case happened in Russia, when it became legal again after its owner was in conversation with the Russian authorities. But the French case is particularly relevant because Meta has never been pressured that way by the French state, while having a much bigger share of users.

I personally use XMPP with OMEMO encryption. It's a federated protocol, so I can choose my own provider or host my own, can have as many accounts as I want (active at the same time!) without giving any personal data, and can choose from a wide array of clients. I think centralization is a serious mistake. But for the average user, Signal is likely fine. I personally wouldn't recommend Whatsapp (for the reasons above plus it being owned by an ad and surveillance company) or Telegram.

 

[blig-blug]

I want to point out something: it's easy to get lost in the details here and that contributes to reinforce the feeling of impotence that many people have. But in this topic perfect is the enemy of good, and going from following no hygiene to doing a couple of simple steps of those listed before by @dreamer042 or me makes a huge difference. So don't let the discussion on the finer, less relevant details stop you from taking some basic steps.

For example, even though IMO Whatsapp is not really advisable, if you're communicating mostly through (let's say) Instagram DMs, switching those conversations to Whatsapp would already be an improvement and make a significant difference. A step up in the ladder.

 

[CosmicRiver]

Maybe, or maybe not. The thing is, there are easy alternatives, so why trust companies that deserve zero trust? And, as you mention, the legal framework of the EU is close to changing anyways.

Yes i agree, you're right. It's not much for my convenience but for other people. I would prefer using Signal but no one uses it...

I think the big push for backdooring is to make it easily available and convenient for police forces and surveillance programs of all tiers. I imagine the higher tiers and intelligence services already are given access to it, your town police probably doesn't. But I don't know, this is my guess.

There's something revealing: despite its lack of E2E encryption by default and thus for most users, Telegram was recently pressured much more than Whatsapp has ever been, when its owner was detained in France. My guess is that France and other EU countries weren't being given access to user data, so they did what they needed to do to make sure that changed. A similar case happened in Russia, when it became legal again after its owner was in conversation with the Russian authorities. But the French case is particularly relevant because Meta has never been pressured that way by the French state, while having a much bigger share of users.

It makes sense... anyway speaking of Telegram i think that Telegram is much more used than Whatsapp by criminal groups and for illegal activities in general, often just because of its reputation, despite most chats being nonencrypted and the protocol being closed-source. They probably are less likely to collaborate with the police not because they can't but because they don't want to.