PrivacyGroup

This page is an effort to maintain an updated collection of important work on privacy. Recommend stuff from this page? Link to us!

Calendar

Events in this calendar are to privacy-related events. Click an event for more details, and links. <EventCalendar> namespace = PrivacyGroup_Event aspectratio = 1.35 </EventCalendar>

News

The new TIA Office

• Equifax loses trove of highly sensitive data NEW
• CIA head Mike Pompeo wants bulk metadata collection back
• Germany considering fingerprinting children and spying on personal messages.
• GnuPG is running a fundraising drive. Give them a little money; their product helps people all over the world!
• US ISPs can now sell data that their subscribers send across their lines. Oh well; we should buy the records of our members of congress to thank them
• Lavabit returns. How does it compare to protonmail, or mailpile? Let me know; I haven't looked into it.
• All US visitors from Muslim majority countries soon may have to give up social media passwords to enter Given rapidly eroding rights at the border, everyone should see what you can do at the link in this section below
• WhatsApp has an in-effect-backdoor by default. The justification for failing to provide security by default is that "otherwise people might not use it," ignoring that run-of-the-mill users of WhatsApp might falsely believe that promises of end-to-end encryption for their messages means that those messages cannot be intercepted.
• Google and government, via the Google Transparency Project. Google lobbies to influence policy to reduce consumer privacy. This article also discusses the NSA-Google relationship.
• Riseup warrant canary expires, Riseup is alerted, but the canary is not updated.
• FBI now can compromise computers outside the jurisdiction of the court issuing the warrant, including overseas.
• Trump pick for CIA head, Mike Pompeo, says in the Wall Street Journal that "the use of strong encryption in personal communications may itself be a red flag" that a person is a terrorist.
• Extreme surevillance via "Snooper's Charter" is now law in the UK. Among other things, requires internet providers to log websites that their customers connect to.
• FCC requires customer opt-in for ISPs to share "sensitive data", opt-out for "other" data. Previously there was no regulation)
• be wary of dictionary sites (dictionary.com, merriam-webster.com). They have high concentrations of trackers -- Part of the "What they Know" coverage in the Wall Street Journal.
• Tucson Police Department has a "Freedom on the Move" Camera, uses it to monitor anti-islamophobia protest on U. Arizona campus (By Tucson-based Strongwatch)
• James Comey tapes his laptop camera, thus creating a "warrant-proof camera."
• Head of FTC won't use fitbit b/c of privacy worries
• Cybersecurity Sharing Act added at the last minute to a 2K page omnibus spending bill
• police and drone use in Baltimore
• U.N. Report on Encryption as a right. "... [T]he present report examines two linked questions. First, do the rights to privacy and freedom of opinion and expression protect secure online communication, specifically by encryption or anonymity? And, second, assuming an affirmative answer, to what extent may Governments, in accordance with human rights law, impose restrictions on encryption and anonymity?"
• CMU study supports that Google cannot police abuse of its ad system, resulting in violation of privacy
• CEO of Hacking Team interviewed on BusinessInsider

Tools help

People often tell me they are unsure about which privacy-enhancing technologies to use, and how to set them up. Here are some suggestions.

operating systems

• Qubes ...OK, not an OS... (also here is a brief description of getting wireless networking working)
• Tails

censorship resistance

• Psiphon - I don't know how good this is yet
• Lantern - I don't know how good this is yet
• Mullvad VPN -- A good vpn (vpn review sites coming soon)
• OpenVPN's latest version was recently audited -- If you run your own VPN (which is easy), this is a good reason to make sure you're using 2.4.2 (I had to compile from source, as the packages aren't up to date). Update: That didn't take long! More vulnerabilities in OpenVPN, so update again to 2.4.3.NEW

anonymous browsing

• Tor (go to the "Tor Browser Sandbox" section) -- I suggest subscribing to the RSS feed of the blog of the Tor project to be sure you stay up to date. The hardened version includes AddressSanitizer (ASan) to detect memory corruption, and use of domain sockets to further protect your IP. The hardened version of Tor has been discontinued; the Tor project recommends moving to the sandboxed version for increased security. Details on this version are in the documentation in the Tor Wiki. A highlight from the Q&A:

  Q: How do I install Flash/Siverlight/etc?

  A: Your tears are delicious, and your plugins will burn.

  :-)

• Also who uses Tor?

browsers

• Icecat -- It's like Firefox, but better. Does not support DRM with encrypted media extension technology, unlike Firefox.
• Why not Chrome/Chromium? -- It does have a sandbox, but it is also the most privacy invasive browser (of the major ones). Also Google controls the extensions for it, and they are sometimes unjust.

browser tools

these all work with Icecat, or Firefox. They may also work with other FF variants; I haven't checked.

• Random Agent Spoofer (blocks a variety of fingerprinting attacks)
• RequestPolicy (By Justin Samuel and Beichuan Zhang, of University of Arizona!)
• NoScript
• PrivacyBadger (EFF)
• Self-Destructing Cookies
• HTTPS Everywhere (EFF)
• BetterPrivacy (removes LSO's -- supercookies -- which survive normal cleaning of cookie cache)
• decentraleyes - runs CDN scripts locally, rather than using remote CDNs (which is trackable)
• Privacy Settings (the plugin) -- Gives quick access to useful privacy settings in the browser, with toggle switches.
• Update Scanner -- Useful for watching privacy policies for changes (since that is your obligation, as a continuing user of the site. Often such changes are not highlighted; only a new version is posted).

testing for problems

• new fingerprint checker, targeting Tor users in particular
• new fingerprinting technique Uses AudioContext and getClientRects. Recommended defense is NoScript.
• panopticlick
• browserleaks
• dns leak test -- Test whether you're leaking DNS information while on your VPN, and fix it

facial recognition

• Hyperface Much like Glamouflage, designed to drive up false alarms in facial recognition. Update: available in August.
• Reflectacles try to ignore the goofy promo. video :-)
• Privacy Visor - Can be purchased by emailing this address at Nissey Co., Ltd.
• CV Dazzle
• Glamouflage
• Flashback

other tools

• Protecting against baseband firmware backdoors, and provider backdoors-- A little outdated, but still full of good stuff. This is a comprehensive approach' for specific tools see below.NEW
• Silence SMS/MMS. Recommended
• Noise is just like Signal, but without the hard dependency on Google Play Store. It is therefore better! But Silence is better still...
• Get an RSS feed reader to keep up to date on privacy-related sites. For example *cough* subscribe to the PrivacyGroup's feed (It's good to use a secure RSS reader. For mobile there is Courier from The Guardian Project).
• Youtube-dl -- Downloads a variety of streaming formats -- not just for youtube! Can be used with torify (see below) to anonymously view streaming video/audio that otherwise compromises privacy (e.g., flash). Note the version in packages is often not up to date--install the latest with pip to get a version that actually works.
• Torify -- A SOCKS proxy to the Tor network, and a wrapper to use it, so you can e.g. look up GPG keys, or perform WHOIS queries, anonymously.
• Get a GPG key
• installing the latest GPG
• Get a Gnuk token! -- Good way to do encryption in a protected dedicated device. You can buy them, or build them yourself
• secure SSH
  • Using gpg-agent instead of ssh-agent

Other Sites with Tools for Protecting Your Digital Rights

• Blog post on maintaining your privacy at the border.
• you broke the internet, we'll build a gnu one
• EPIC privacy-related tools
• Surveillance Self Defense (EFF)
• Opt out of datasharing by Whatsapp before the deadline! NOTE: Whatsapp allows your messages to be intercepted without your knowledge. See #News above.
• Center for Digital Society and Data Studies -- UA's center emphasizing digital rights.
• Tactical Technology Collective -- Toolkits and guides for digital security and privacy. Includes guides for Human Rights defenders. Security-in-a-box toolkit has a few inclusions that could be improved, including unhardened Tor, and Firefox rather than Icecat.
• Access Now Defending and extending digital rights of at risk users around the world.

Tools for Making Consent to Privacy Policies More Informed

• PrivacyPal, Automated Privacy Policy Parsing
• RAPPOR for privacy-preserving stats

Why care about privacy?

• Little talk on privacy that David gave to a class here at the University of Arizona
• 5 min recorded presentation David gave to local businesses on why they should care about privacy
• DoNotTrack documentary
• Why privacy matters
• Maciej Ceglowski's excellent talk
• it could happen to you, congress
• MLK Jr. and the history of bulk surveillance against people of color
• a few other reasons to care about privacy

Giving up privacy

• Americans say they want privacy, but act as if they don't
• The End of Privacy on NPR
• Atlantic article on an Arizona man whose anti-privacy views lead him to share everything, including passwords to email, banks, etc.
• Londoners give up their first born in agreeing to privacy policy
• Ai Weiwei, Privacy, and the future of surveillance
• Article in Science, 'Privacy and Human Behavior in the Information Age' -- By Laura Brandimarte, of U. Arizona (et al)! Reviews of multiple topics in privacy including (esp. relevant to this section) why people who profess to care about privacy nevertheless act as though they don't (the "privacy paradox").

How universities can help

• Don't break Tor and tell the FBI before telling the Tor project
• boingboing on online privacy and libraries
• NSF "Dear Collegue" letter on privacy-related research
• Tor exit nodes list. Note the universities hosting! (MIT, UMich, BU, ...)

Videos

• Soghoian (erstwhile technologist at the ACLU) on the privacy implications of endpoint hacking
• Social media information given at the border accessible via very insecure PSN -- Video from latest CCC shows the terrible security of airline travel information. In the QA (but the whole video is very interesting) it is said that social media information gathered at the border for travellers to the US on visitor visas is linked to PSNs, which are horribly insecure.
• A series of privacy talks recently ended at The University of Arizona. UPDATE: you may need to download the files and play them locally, if your browser complains about playing them. Cached copies of
  • Privacy and Health (comments here),
  • Privacy and the Media ( comments here), and
  • Privacy and Commercial Data Collection (comments here).
• Snowden talked in a startpage.com-hosted interview in the Netherlands about privacy after the election of Trump in the U.S.; his pardon Mirrored here locally, so you can jump around the video (originally live-broadcast)
• Edward Snowden came to the UA to talk privacy with Glen Greenwald and Noam Chomsky. I mirrored the video, originally available only via flash. This is audio only.
• Edward Snowden discusses removing mounted microphones and cameras from cellphones, excesses of U.S. intelligence

Miscellaneous

• A thorough, well-executed study of web tracking (updated monthly?). Worth a look.
• Electronic Frontier Foundation's list of printers that produce tracking dots
• ProtectionOfHumanSubjects
• Privacy Bibliography
• A review of the off-Broadway play 'Privacy', with Daniel Radcliffe

Privacy theme music!

• This week's under surveillance! Great radio show
• Octopus's Garden (Raffi version)
• Somebody's Watching me (Rockwell)
• 3:7:8 (Emergency Broadcast Network, or EBN)