Your Privacy Online: v5.4
Presented for: House of Teeth Feb/2025
By Alex McGeorge
Specific disclaimers
I am here in my capacity as a private citizen, the views expressed within to not represent those of my current employer, their shareholders or partners.
Setting expectations
Things are bleak
I will do my best to be entertaining
My understanding of the problem
- We are living in an occupied country where:
- The occupying force is hostile towards us
- The occupying force has access to the best intelligence gathering aparatus in the world
- This includes previously unavailable sources of information
- The occupying force is re-defining the rules
Reasons for hope
- An absurd amount of prior art for resistance
- We have a strong history of civil disobedience
- The history of folly within the intelligence community is long and hilarious
- They are reliant on us in ways they don't understand
- The maker's movement
Who the hell is this guy?
Alex McGeorge
- Charming, handsome
- Previously worked at Immunity Inc as a Senior Security Researcher
- Exclusively did offense oriented work
- Occasionally a talking head for TV
- Currently a Senior Security Engineer for a cloud computing provider
Who is this class for?
Non-IT professionals
Though they may get something out of it
How will we proceed
We have an enormous amount of content to cover I would prefer not to get into a technical dick measuring competition
What problems will we be tackling?
- Enough technology background to understand the advice
- Attending political actions
- Attending medical appointments
- Abortions
- Gender affirming healthcare
- Crossing borders
- Using your computer in 2025
A brief introduction to threat modeling
Wait, content warnings?
There will be some pornography to help keep people's attention
Introduction to Relevant Technology
Multi Factor Authentication
- Combines something you have
- With something you know
- Simply knowing your password is no longer enough to sink you
- Enable it on: your email, your financial institutions, health care
Password Managers
- No specific product recommendations
- Different password for each site you use (no derivatives)
Anti-virus
- A mixed bag, choose one that annoys you the least and is within your budget
Virtual Private Networks
- A technology that establishes an encrypted connection between your computer and another
- Traffic that would normally go out to the internet will now go through this connection or 'tunnel' BEFORE going to its final destination
- Additional reading
A simplistic overview of how the internet works
Now with a VPN
How does law enforcement see this problem?
Thoughts on VPNs
- Can be very useful for local threats
- Understand that VPN providers may or may not keep logs (assume they do)
- Understand that 'offshore VPNs' may not be 'out of reach'
- I like CryptoStorm
TOR
- What is Tor and why you should use it
- Should I use the Tor browser bundle?
- You still need to be cautious about how you use it
A combination that works
Use Tor (anonymity) to connect to your anonymous VPN (privacy)
It will be extremely slow though
Encryption for data at rest
- Full Disk Encryption for Windows
- FDE for MacOS
- Encrypting external drives
Cellphones and messaging apps
Understanding the environment
- Turn off your phone's backups
- Set a task to reboot your phone every day
- If your friend's phone is snatched assume all conversations it saw are now compromised
Are Twitter DMs safe?
No, read the Twitter Legal FAQ
Is Facebook Messenger Safe?
Lol No
Is Telegram Safe?
Nope, read some of the privacy concerns here
Is WhatsApp Safe?
What about Signal?
This is the only and best answer to secure messaging and calling on mobile devices
But WHY signal?
- List of third party audits of Signal
- Active measures against tools like Cellebrite
Ok how do I use Signal the right way?
- Configure disappearing messages
- Set up sensitive notification options
- Require an PIN to use the app
But Alex my friend told me about this new messaging app...
USE SIGNAL
USE SIGNAL
Alex how do Cops get on my phone?
- What's a vulnerability? What's an exploit?
- Physical access vs Over the Air
- Commercial products/companies like
- https://www.grayshift.com/
- https://cellebrite.com/en/home/
- https://en.wikipedia.org/wiki/NSO_Group
- https://en.wikipedia.org/wiki/Stingray_phone_tracker
Introduction to Good Privacy Habits
You are the weakest link
This doesn't work retroactively
No one will go to jail for you
...
The best thing you can do
Compartmentalization
- Where possible separate devices for compartments
- Always separate accounts for different compartments
Common Scenarios
Don't talk to the fucking cops
Helpful videos on why not to talk to the cops
But what if I have to?
- Look for ACLU chapters in your state, see what advice they have
- ACLU Washington State
- ACLU Oregon
Attending a Political Action
Phones
- Do you have a protest phone that only has Signal? Why not bring that
- Disable biometric unlocking (fingerprint, face)
- Keep the phone off or in a faraday bag when not in use
- Use Signal to make/receive calls
Person
- Assume you will be separated from your phone, write important phone numbers on your person
- Clear out your wallet, bring your ID, cash, dedicated transit passes
- Have multiple plans and routes to get home
Organizing a Political Action
Too complicated for this talk but start here (audio)
This talk is also good and relevant
Obtaining medical care
As of writing it is unclear how individual jurisdictions will enforce healthcare restrictions
Obtaining medical care (Plan Ahead)
- Create a dedicated email to communicate about your medical needs
- Access this email through a VPN but not from any device you will bring with you
Coordination
- Coordinate with the doctor's office for what you need to have on you the day of
- Plan your route to a location close to your doctor's office, print out directions
- Tell the minimum number of people possible, remember no one will go to jail for you
Obtaining medical care (Day Of)
Phones
- If possible bring a pay as you go phone which can run signal
- Don't connect the phone to anything you use regularly
- Disable biometric unlocking (fingerprint, face)
- Keep the phone off or in a faraday bag when not in use
- Use Signal to make/receive calls
Person
- Assume you will be separated from your phone, write important phone numbers on your person
- Clear out your wallet, bring your ID, proof of insurance
- Memorize the route from the first location to your doctor's office
Crossing a Border in 2025
Phones
- Best plan: Bring a dedicated phone with you, have nothing on it but essential phone numbers
- Disable biometric unlocking (fingerprint, face)
- Set your phone to airplane mode, disable
- Turn your phone off when going through customs
Computers
- Best plan: Bring a dedicated laptop with nothing else on it, download sensitive info once across the border
- Make sure you have full disk encryption for any computer
- Encrypt any external devices
- Turn your computer off when going through customs
Things you can do
Become a student of the game
While we still have due process and a court system:- Read relevant indictments
- Learn how to locate and request access to court documents
- What can your local library do for you?
- What technology companies supply local, state and federal law enforcement
- Interesting exercise: what is the corpus of all LEO specific software used by a given jurisdiction?
Become well read on various topics
- Intelligence gathering (especially while under occupation)
- How do intelligence operations work in other countries?
- Ex: Germany, Israel, UK, Russia, etc
- Counter-Intel
- Surveillance
- The prepper community
- The grugq's list is a good starting point
Shopping Lists
- Faraday bags (acquire or learn to make)
- Cheap and disposable computing
- What's in your go bag?
Computery skills to acquire
- Learn how to wipe a computer: DBAN is great
- Learn how identify the internal components of a computer and how to physically destroy them
- Get comfortable with Linux and virtualization:
- OSINT
- Customizing and compiling software