Context: my gf mentioned getting a vpn for privacy, and I tried to explain that it “does” help, but it’s more like type of windows on a house. It certainly can be part of the package, but it’s no where near the foundation.
So i tried to explain the best that i could That if she was worried about online privacy the first step wasn’t to mask traffic, but to not submit personal data to anything online like FB, not use Google services that package everything on you together to sell to advertisers, and to limit phone apps to essentials.
But I’m curious on what other steps you guys would consider the “foundation” of online privacy that should be prioritized before a vpn. Any thoughts? Or am I way off base?
Note: this is in context of vpn for privacy. Using vpn to avoid Geo blocking and censorship I see as incredibly valid for those that need it.
I think you and your girlfriend should read about “threat modeling”. You need to figure out what you and her are trying to keep private and from whom. Without knowing that, its impossible to say if a VPN is a good solution.
For example if she is trying to hide her web traffic from her ISP then a VPN is a great solution, if she is trying to be annoymous on the web then a VPN won’t do much as you are still easily fingerprintable amongst other things.
People all to often act like privacy is some sort of list of sub items that you can check off like completing a quest in a MMO.
Each individual’s privacy goals are different, privacy is not a one size fits all problem or solution. Your girlfriends needs may be drastically different then your own.
Yep. For example, if your ISP is in the advertising business, I would definitely use a VPN, even after opting out w/ the ISP/cellular provider. IMO a lot of times when you opt out, it doesn’t mean they stop collecting information, it means they paused using that information for ad targeting.
ex: https://www.verizon.com/about/privacy/customer-proprietary-network-information
Here are some things you can do, roughly ranked:
- Use a password manager
- Assume anything you post/do online/financially can and will be used to build an advertising profile on you/train AI/be shared with government authorities
- Disable ad personalization/history/sharing of information via privacy settings of mobile phone, mobile apps, Google, Facebook, banks, credit cards, ISP, cellular service, everything
- Turn off third-party cookies.
- Use an ad-blocker on desktop and mobile. They also help prevent a lot of tracking.
- Don’t use Chrome. Consider Firefox/Brave/whatever else
- Avoid using ad-supported services/companies. Consider using paid alternatives. This means using alternatives to Google Search, GMail, Facebook for photos, etc etc.
- Use a profile deleting service like https://monitor.mozilla.org/
- Different browser profiles: general use, Facebook, personal (GMail / Google Docs), and maybe more
- Use a VPN w/ secured DNS
- Many Google accounts: one for general, YouTube, Google Docs/personal, and maybe more
- Use a different email address to sign up for every account. I use StartMail’s aliases
- Don’t use your personal phone number for most things (finance/healthcare excepted). Get another number via a call and SMS forwarding service
Use Firefox, don’t use Chrome or any of its forks.
I concur with this. Any Chromium based browser is still under the chokehold of Google. A great example is Manifest V3 being forced on all Chromium browsers. Honestly, Google controlling such a significant browser marketshare should be a worry to more peoople. To a lot of people they are people’s access to the internet, via Google Search, and they also control people’s window to the internet, via Chromium.
In short; Google by and large is the internet, meaning they can do whatever hell they please and there’s not much in the way to stop them.
deleted by creator
For a lot of people, encrypted and signed DNS, has around 75% of the benefits of a VPN without actually using a VPN.
This is often overlooked but the thing is that most ISPs / countries block websites, log user activity and run traffic interception by changing DNS queries to redirect people to a server they control. Just by using a DNS provider that is capable of DoH / DoT you’ll be safer (and yes, enable domain and certificate validations).
Using vpn to avoid Geo blocking and censorship I see as incredibly valid for those that need it.
So, no this might not even be a valid use-case for a lot of people.
Oh man see I knew i was missing stuff! My gf wanted more if an explanation of why I didn’t love a vpn but I couldn’t really explain more than “if you leave sign pots everywhere that you live here, probably don’t need to worry about bread crumbs”
Oh well, who doesn’t. This thing with DNS is like the dark secret of the VPN industry because if you think about it all those VPN providers run their own DNS servers and tunnel the DNS traffic via their tunnel and when they don’t you know what happens - if the ISP can still redirect your DNS queries it will still get your traffic.
Either way, this is more of a people problem than a tech problem. You did right by telling her not to use so much social media and share less data, but it’s all about a mindset. It’s about the person that sees a cookie popup and goes in all options and disables everything. That never clicks on an offer for a “free service” and looks for the almost indivisible “skip setup” option.
Besides the convenience aspects I believe there’s something fundamentally wrong with people’s education when it comes to cybersecurity and privacy. People should think of applications, services and websites like strangers on a street: if a random person ask you where you are going will you tell him? No you won’t, then why would you share your location with any app by default? If someone on the street asks your for your address will you give it up? No! Then why would you provide your e-mail address to any website?
You’re so right and never thought of it like that! If you Google and find a new service you’ve never heard of, we’re expected to give up our soul in a heartbeat! Even for a new email so many are like: First name Last name Phone number for dual authentication Install this app for dual auth Birthdate!
Like dude, there are a lot of services that just that information alone is enough to call in and take my account. It’s so scary how common that is.
A game I play uses PayPal as the payment processor, and pay pal decided to pay this specific company I had to upload the front and back of my ID.
Just… ugh.
Running as much open-sourced privacy oriented software as possible. This includes on computers, routers, and phones. While this is 100% a marathon, not just a quick change, it’s well worth the time. Utilizing an encrypted DNS would be another solid move. NextDNS is a fantastic choice as it has a free option which still provides granular control of what is filtered online. A trusted VPN mixing your internet traffic with others is great, but like you said, it’s not a magic bullet whatsoever.
Imo, router is a very very big step for a normal person.
If you’re talking OpenWRT, then I totally agree. But something like Asus Merlin is a relatively easy change and still provides additional protection. While part of the Asus code is closed-source, most is open-sourced and Asus has implemented improvements developed by the Merlin team. This shows Merlin knows what they’re doing and are trustworthy too.
deleted by creator
Yes, but learning about tech is a necessary step to understanding how it is used to undermine our freedom and privacy.
It really depends on what you want to be private and who you don’t want seeing it. If you are torrenting pirated movies a VPN is great for privacy. What are her main worries about privacy?
Both of you make valid points. The trouble is that the Internet is getting more complicated and also getting more exploited by corporations, e.g. with the recent addition of the A.I. hype. And all kind of people think that they know the answer but later it turns out that they were wrong (Take for example all the Apple fans years ago thinking that Apple + privacy was a really good way of life). The other trouble is that maybe only a few VPN providers are really trustworthy. And then your browser fingerprint can be unique if you add too many extensions or fiddle with certain settings, which means you are track-able and user profiles can be created. And so on and so forth.
It makes sense to think about what you want to protect and avoid. Here some generic suggestion :
- Get yourself a pi-hole at home for your devices to connect to.
- Limit the amount of Java-Script in your web browsers. Lots of websites will do fine.
- Limit the amount of phone apps usage (like you wrote)
- Use Tor browser (slow) or Mullvad VPN in some cases you want to hide your IP address
- Be weary about default settings of Firefox, take a look at LibreWolf
- Use different browsers for different tasks
Don’t use any social media, anything google, apple or Microsoft related.
Good luck.
I wouldn’t say you can’t use any social media. You just can’t use big tech social media such as X, Facebook, Instagram, TikTok, etc. Open source social media like this or Mastodon is at least a step in the right direction.
Yeah I guess I hadn’t really considered this social media…
You have first to be the most degoogled you can, you have to abandoned the most of the big companies services as google, Facebook… Delete Instagram, do not use WhatsApp and Messenger, watch YouTube through Piped or Individious, uninstall bloatware on your phone (maybe install a custom rom, like /e/ os, a go-to for privacy). Be aware of what you post and your personal identity. The only case when VPNs are the first thing to do is when you have to spoof your IP because of restrictions or any others…
First big step I took was going through all my emails and deleting inactive accounts/making deletion requests. It was a major hassle but made me feel a lot more secure about my email and digital footprint. Plus built a real basic understanding about taking a more minimalist approach to the internet, suddenly I wasn’t getting emails every hour and random notifications, it was nice.
Other then that ublock origin and your password manager of choice that hopefully isn’t attached to the browser, oh and 2fa
Just my two cents here to mention that it’s necessary to see this as a journey and a mindset, not a single-step or one-size-fits-all panacea.
If she’s annoyed of advertisements creeping up, introduce her to adblockers and slowly make her get used to it. If she has shared concerns after seeing her friends or colleagues receive abusive comments on their social media accounts, comment on the dangers of oversharing one’s private life and its potential consequences and tangible threats, like medical insurance companies abusing the info, and so on.
Nobody mentioned JShelter yet. It may not make browser fingerprinting impossible, but it’s the easiest way to make it harder. It’s easy to use, just turn it down for any sites that it breaks which you’d prefer to be not broken.
Also, use firefox and clear out all your cookies and site data regularly. Make exceptions for sites you actually want to identify yourself to. Noscript is another thing to consider, though I haven’t used it recently myself. Use Tor Browser if there’s something you want a little more privacy than usual for.
Switch your browser (Firefox or Librewolf) and use uBlock Origin. Tweak settings for privacy and security (check the guide on /c/piracy). Use DuckDuckGo as your default search engine. Remove personal details from social media, especially anything public-facing.
- Use different passwords for things
- Use a password manager
- Don’t upload all your stuff to Google
- Switch to DuckDuckGo
- Install Firefox (or LibreWolf/Fennec) or at least Brave
- Use Signal
On top of this, use products that are more privacy conscience, as in they take it more serious, such as an email provider.
These are all fantastic options and that thing about the password manager is peer gold. I’ve been using key pass for years now and absolutely love it and know that my accounts are a lot safer than they would otherwise be.
Have a web browser that isn’t logged into any services for general web browsing. Mullvad browser is a good choice. Make it your default browser for any links that get randomly clicked.
The benefit here is your not carrying around a bunch of active cookies for the sites you log into. It makes logging into a site a deliberate choice. No history builds up of random links, browsing, searching.
A browsing only web browser plus a VPN is a really good start at cleaning up your digital footprint by making it more intentional.
I recommend mullvad VPN, and mullvad browser… but any combination is fine.
https://www.privacyguides.org/en/basics/why-privacy-matters/ Privacy guides is a excellent resource with writeups, FAQs, and … Guides to help you in your journey
I’m also going to add that any online service you sign up for, always check through their privacy settings and make sure the options to not gather data are enabled. Another one is to check through settings for your ISP and cellular plans. Some collect various data to “enhance” services. Lastly I’ll mention that on mobile devices switch to a privacy oriented browser like the recommendations below, and use Progressive Web Apps instead of native apps. These will include the browser’s privacy protections by default.
