IKQ – 4 November 2015
These suggestions are primarily aimed at a British audience. However they can also apply to people across the globe that find themselves in need of greater security, privacy and anonymity for their electronic communications. They assume that your computer is running a version of MS Windows, but again the suggestions can apply to other operating systems that have similar software.
There is no such thing as a 100% secure communication over an electronic medium such as the global internet or telephony network. Many of the suggestions here do provide varying levels of security, privacy and anonymity (SPA). When these tools are implemented properly and used in conjunction with each other, you will greatly improve your personal SPA. By covering your tracks, you can reduce your chances of being on the receiving end of any unpleasantness. Needless to say, great care must be taken in your communications. Even with all the security in place, your SPA can still be compromised by the use of weak passphrases, the opening of attachments from unknown senders and careless revelations of identifiable details. The user (ie. you) is often the weakest link. Do stay safe by practising safe computing.
Disclaimer: This is not a complete guide and not all software is covered. Under no circumstances shall the author or CEMB be liable for direct, indirect, special, incidental, or consequential damages resulting from the use, misuse, or inability to use the software, even if the author or CEMB has been advised of the possibility of such damages. Use at your own risk.
On a related note, there is a line of clothing from THE AFFAIR designed with your privacy in mind.
Before we can consider security on mobile devices it is worth making some changes which can make things easier during subsequent steps. Although this step is optional, it is highly recommended. The majority of mobile devices run either the Apple iOS or Google Android operating systems. You need to start by updating your phone contacts. If they are linked / synchronised with an email address (eg. Gmail), then it is best to log in to your email account (on a PC) and update your contacts from there. All changes will then propagate to your linked devices.
To update your contacts, ensure that you change all mobile (and landline) numbers to the proper international format. For example, if you take the full British mobile number ‘07123 456789’, then you need to do the following to it:
- Drop all leading zeroes.
- Prepend the relevant country code.
- Remove all white spaces from the number.
So in our example, the British number ‘07123 456789’ will be updated and stored as ‘+447123456789’. This is the preferred format because there is no longer any ambiguity to it. Even if the handset sends or receives any communication from anywhere in the world, it can still function properly. Update the telephone numbers for as many of your contacts as you can. Get into the habit of storing numbers in this format. This is the only tedious step, it will take some time, but well worth it. Also make a note of your own number in this international format, you’ll need it later.
It is very important to ensure that any software or operating system updates have been applied. These include much needed security fixes. If you’re feeling adventurous, you may replace the device’s operating system with a custom one (eg. CYANOGENMOD).
For secure encrypted messaging and calling for Android and iOS devices, go to OPEN WHISPER SYSTEMS and follow the link to install the SIGNAL PRIVATE MESSENGER app. This is a free, open-source application that makes use of your smartphone’s mobile data connection and wifi features. Note that this app is meant to replace your existing default messaging app. Ideally connect via wifi, then you would need to go through a simple registration process using your own mobile number (in the above international format). Be patient with the setup and registration process, then you’ll be good to go.
Another app to note for your mobile device is ORBOT. This lets you route your internet browsing over the TOR network. There are mobile versions of some of the encrypted instant messaging applications below.
Modify each of your wifi network connection settings to ensure that you use the two IP addresses at the bottom of the OPENDNS page as your DNS.
There are many mobile security apps that provide anti-malware functionality, secure your mobile devices, locate them and even wipe them remotely should the need arise.
It is good practice to temporarily disable the wifi and location features if you’re in a public place and they are not needed.
It is highly recommended that you encrypt your mobile device if possible. Again, this may take some time, you may want to ensure your device is charging during this crucial step and it shouldn’t be interrupted.
Before you sell or dispose of your mobile device:
- Backup all your personal or important information (files, images, contacts, etc) to your encrypted cloud or any other external storage.
- Delink your device from your Apple or Gmail account.
- Delete all images or other personal files from your device.
- Clear all messaging and call history, including any notifications and search or browsing history.
- Clear all contacts and password keys from your mobile device, inc. sim card.
- Uninstall as many apps as you can, inc. clearing SD storage.
- Forget all networks or wireless access points.
- Ensure that you then encrypt your mobile device again.
- Perform a hard reset of your mobile device.
- You may then remove the sim card and battery, then physically destroy the mobile device.
You can also monitor devices using FLEXISPY.
If you are truly concerned that your privacy may have been compromised, do not use your own computer. Go to an internet cafe or other public service such as a library and use the computer there if you can. Otherwise you should be reasonably safe by using your own computer with the following suggestions.
Ensure that you are not using versions of MS Windows, this is a relatively unsecure set of Operating Systems. Try to use secure distributions of Linux such as QUBES OS, LPS or TAILS, the latter can be copied to a USB drive (or optical media such as CD, DVDs, etc) and run on any computer. KALI LINUX is a very useful operating system, geared more towards penetration testing and security auditing, but extremely useful for the privacy-concious among us, do check it out. Many of these Linux (and BSD) distributions can be booted off optical media so you can use them before installing anything on your computer. Take the time to learn about open-source operating systems, start by bookmarking the DISTROWATCH site.
Otherwise if you’re running a version of MS Windows, ensure that you have encrypted your hard drive (or at the very least the partition / drive that holds your personal files). You can use DISKCRYPTOR or BITLOCKER.
If you have access to the router and can update its settings, log in to it using your computer’s web browser and note the existing DNS IP addresses and write these down in case you need to undo this step. These would be the addresses for your ISPs DNS. Change the existing DNS IP addresses to ones provided by OPENDNS:
Be sure to save your updated router configuration. You may have to restart your router. If you do not have access to your router or can not update its DNS IP addresses, then you should use DNSCRYPT. Essentially this involves installing and running a background service process on your MS Windows computer that bypasses your ISPs DNS whenever you use your browser. The instructions are straightforward and when the service is set up and running, will not need any further input from you even after the computer is restarted.
A good free anti-malware and firewall will help keep out any intruders.
If you want to make use of the Cloud to store your personal files, then opt for zero-knowledge services like TRESORIT.
To make use of the various anonymisation networks, you can install either the TOR BROWSER BUNDLE or make use of I2P. They may need some configuration but they are recommended if you wish to conduct your online communications anonymously, away from the prying eyes of your ISP or other surveillance efforts. Take great care to configure them as a ‘Relay’, not as an ‘Exit Node’. There are also newer tor-related concepts named HORNET and ASTORIA, there is yet an implementation of them. Be sure to use HORNET or ASTORIA as soon as they becomes available.
A very useful application is BATCHPURIFIER. This tool can help remove your hidden information or metadata from multiple files (eg. photos or images). The metadata can be used to trace when, where and how the file was created (among other things). Removing all this information from files before you store or share them will greatly aid your security, privacy and anonymity (SPA).
Another great application is KEEPASS PASSWORD SAFE. This is a free, open-source password manager that lets you store your many passwords securely. There are versions for Android and iOS for use on mobile devices.
Email is a very important service for many reasons. Presently there are many email service providers that offer varying levels of security. However, most suffer from one significant flaw: their metadata is sent with the message in clear text. This does not bode well for your SPA. This is a consequence of the current set of email protocols being many years old with security more of an afterthought. As a result of the recent events surrounding the Snowden revelations, efforts are underway to completely redesign email for the modern era with intrinsic security, the fabled ‘Email 3.0’.
The DARK MAIL TECHNICAL ALLIANCE is leading the effort, however the protocols have a name: ‘Dark Internet Mail Environment’ (DIME). When email services adopt this secure protocol, it is highly recommended that you sign up.
But what if you can not wait for the new DIME email services? There is a simple trick that you can use to communicate using any email service. Here’s how it works:
- Person A registers with a new email account and notes the login credentials (ie. username and password).
- Person A logs in and drafts a message, but does not send it. The message is saved in the drafts folder.
- Person A logs out.
- Person A gives the login credentials to their trusted contact Person B, in person.
- Person B then logs in to the same email account.
- Person B can then read the saved message in the drafts folder, then deletes it.
- Person B replies by creating a new message and saving that into the drafts folder.
- Person B logs out.
- Person A can then log back in and read the saved message before composing a reply to Person B, and so on.
This communication can take place without a single message being emailed across any server or domain, which makes surveillance very difficult. It just needs the contacts to access the same email account and some degree of coordination between them. Also, remember to change your email settings to disallow tracking. There are many helpful tips available online, specifically how to improve your email’s SPA.
Your browsers are important too. The three most common or major browsers are Internet Explorer, Google Chrome and Mozilla Firefox. It is recommended that you use Firefox for security. Be sure to keep them updated and configured properly for security:
- CHROME – chrome://settings/
- Privacy section
- Content Settings (set all to the recommended options, except check block third party cookies, do not allow any site to track your physical location, do not allow any site to disable the mouse cursor and do not allow sites to access your camera and microphone).
- Clear Browsing Data (obliterate from the beginning of time all options).
- Password (do not enable password auto fill).
- System (do not continue running background apps when browser is closed).
- Privacy section
- FIREFOX – Tools > Options
- Privacy (Tick both Tracking options, Firefox will never remember history, clear all current history (everything)).
- Security (Use a master password – saved passwords – remove all).
- Advanced > Network (clear web content and offline web content).
Be sure to set your home pages in all browsers to DUCKDUCKGO and also bookmark the following site:
This site lets you send self-destructing messages and files to your contacts, anonymously. A facility for encrypted chat is also available. This is purely browser-based, no installation of any software is necessary. In each browser you should search for and install the following extensions / add-ons / plugins:
There are also free applications that can be downloaded and installed for secure instant messaging:
You should also install free programs or extensions that function as secure VPNs such as:
These let you route your browsing activities through virtual private networks or remote proxies located in foreign countries. It is not recommended that you access your email, financial or other personal sites through them, unless they have sufficient security in place. Do not use any untrusted proxy with handling your personal business (ie. those that require login credentials). The OTR.TO site for secure and anonymous real-time communication is recommended, bookmark this now. Ensure that whichever browser you use, you are familiar with its Incognito Mode and that it is set up to clear its cache automatically when it is closed.
After emptying your computer’s ‘Recycle Bin’, you may use some useful MS Windows commands, eg. CIPHER ensures that no deleted file in a directory can be recovered.
JITSI video calls and chat is a free, open-source, secure service and is highly recommended. Skype is not recommended due to privacy concerns.
On mobile devices, secure communication is of the utmost importance. Install the free open-source app created by OPEN WHISPER SYSTEMS. Phone encryption and periodic clearance of search and location histories are advised. Set a strong passphrase and the remote lock, locate and wipe feature.
On computers, many tools can be installed but some websites like OTR.TO can be accessed by any browser. Check your browser’s security settings and schedule it to clear your cache / history periodically. Ensure you sign up to a DIME-compliant email service when that becomes available. Use of OPENDNS (either on your router or by using DNSCRYPT) and HORNET or ASTORIA (when available) is highly recommended. Harden your FACEBOOK (social media) privacy settings by placing your associates in distinct groups and setting their permissions accordingly, or better yet try to keep your presence on social media to a minimum. Be aware that an increasing amount of your personal information, contacts, views, habits and locations can be scraped from your online presence and sold to third parties.
Hopefully the information detailed here will help you cover your internet tracks much more effectively and avoid any unpleasantness.