Your Privacy Online: Roe vs. Wade Edition
Presented for Black Rose Tuesday Education (5/July/2022)
By Alex McGeorge
Setting expectations
Who am I, what problems are we tackling, who is this class for, how will we proceed and some content warnings
Who the hell is this guy?
Alex McGeorge
- Charming, handsome
- Previously worked at Immunity Inc as a Senior Security Researcher
- Exclusively did offense oriented work
- Occasionally a talking head for TV
- Currently a Senior Security Engineer for a cloud computing provider
Specific disclaimers
I am here in my capacity as a private citizen, the views expressed within to not represent those of my current employer, their shareholders or partners.
Who is this class for?
Non-IT professionals
Though they may get something out of it
How will we proceed
We have an enormous amount of content to cover I would prefer not to get into a technical dick measuring competition
What problems will we be tackling?
- Enough technology background to understand the advice
- Attending political actions
- Attending medical appointments
- Abortions
- Gender affirming healthcare
- Crossing borders
- Using your computer in 2022
Wait, content warnings?
There will be some pornography to help keep people's attention
Introduction to Relevant Technology
Virtual Private Networks
- A technology that establishes an encrypted connection between your computer and another
- Traffic that would normally go out to the internet will now go through this connection or 'tunnel' BEFORE going to its final destination
- Additional reading
A simplistic overview of how the internet works
Now with a VPN
How does law enforcement see this problem?
Thoughts on VPNs
- Can be very useful for local threats
- Understand that VPN providers may or may not keep logs (assume they do)
- Understand that 'offshore VPNs' may not be 'out of reach'
- I like CryptoStorm
TOR
- What is Tor and why you should use it
- Should I use the Tor browser bundle?
- You still need to be cautious about how you use it
A combination that works
Use Tor (anonymity) to connect to your anonymous VPN (privacy)
It will be extremely slow though
Encryption for data at rest
- Full Disk Encryption for Windows
- FDE for MacOS
- Encrypting external drives
Cellphone messaging apps
Are Twitter DMs safe?
No, read the Twitter Legal FAQ
Is Facebook Messenger Safe?
Lol No
Is Telegram Safe?
Nope, read some of the privacy concerns here
Is WhatsApp Safe?
What about Signal?
This is the only and best answer to secure messaging and calling on mobile devices
But WHY signal?
- List of third party audits of Signal
- Active measures against tools like Cellebrite
Ok how do I use Signal the right way?
- Configure disappearing messages
- Set up sensitive notification options
- Require an PIN to use the app
But Alex my friend told me about this new messsaging app...
USE SIGNAL
USE SIGNAL
Alex how to Cops get on my phone?
- What's a vulnerability? What's an exploit?
- Physical access vs Over the Air
- Commercial products/companies like
- https://www.grayshift.com/
- https://cellebrite.com/en/home/
- https://en.wikipedia.org/wiki/NSO_Group
- https://en.wikipedia.org/wiki/Stingray_phone_tracker
Introduction to Good Privacy Habits
You are the weakest link
This doesn't work retroactively
No one will go to jail for you
...
The best thing you can do
Compartmentalization
- Where possible separate devices for compartments
- Always separate accounts for different compartments
Common Scenarios
Don't talk to the fucking cops
Helpful videos on why not to talk to the cops
But what if I have to?
- Look for ACLU chapters in your state, see what advice they have
- Washington DC: What to do if the cops hassle you for photography
- Virginia: Know your rights
Attending a Political Action
Phones
- Do you have a protest phone that only has Signal? Why not bring that
- Disable biometric unlocking (fingerprint, face)
- Keep the phone off or in a faraday bag when not in use
- Use Signal to make/receive calls
Person
- Assume you will be separated from your phone, write important phone numbers on your person
- Clear out your wallet, bring your ID, cash, dedicated transit passes
- Have multiple plans and routes to get home
Organizing a Political Action
Too complicated for this talk but start here (audio)
This talk is also good and relevant
Obtaining medical care
As of writing it is unclear how individual jurisdictions will enforce healthcare restrictions
Obtaining medical care (Plan Ahead)
- Create a dedicated email to communicate about your medical needs
- Access this email through a VPN but not from any device you will bring with you
Coordination
- Coordinate with the doctor's office for what you need to have on you the day of
- Plan your route to a location close to your doctor's office, print out directions
- Tell the minimum number of people possible, remember no one will go to jail for you
Obtaining medical care (Day Of)
Phones
- If possible bring a pay as you go phone which can run signal
- Don't connect the phone to anything you use regularly
- Disable biometric unlocking (fingerprint, face)
- Keep the phone off or in a faraday bag when not in use
- Use Signal to make/receive calls
Person
- Assume you will be separated from your phone, write important phone numbers on your person
- Clear out your wallet, bring your ID, proof of insurance
- Memorize the route from the first location to your doctor's office
Crossing a Border in 2022
Phones
- Best plan: Bring a dedicated phone with you, have nothing on it but essential phone numbers
- Disable biometric unlocking (fingerprint, face)
- Set your phone to airplane mode, disable
- Turn your phone off when going through customs
Computers
- Best plan: Bring a dedicated laptop with nothing else on it, download sensitive info once across the border
- Make sure you have full disk encryption for any computer
- Encrypt any external devices
- Turn your computer off when going through customs
Using a computer in 2022
I ran out of time for this section :( you may find useful info in previous presentations