Skip to content

Latest commit

 

History

History
executable file
·
901 lines (584 loc) · 51.7 KB

presentation.md

File metadata and controls

executable file
·
901 lines (584 loc) · 51.7 KB

Citizen ==FOSS==

Snowden's toolkit — for the Rest of Us.

70% center

A Yale Privacy Lab Tech Primer

@YalePrivacyLab | [email protected]

Citizen Four (2014):

Film following Edward Snowden as he shares NSA spy documents and attempts to flee Hong Kong. "Citizenfour" was one of Snowden's pseudonyms.

FOSS (English, acronym):

Free and Open Source Software. "Open Source" is often a business term for Free Software. The "free" means "freedom" but, usually, it also costs nothing. Synonyms: Software libre, FLOSS.

...many people forget – maybe people haven’t seen Citizen Four, for example... but if you watch closely in credits, they thank a number of FOSS projects, including Debian, Tails, Tor, GnuPG, and so on and so forth.

And that’s because what happened in 2013 would not have been possible without Free Software. I did not use Windows machines when I was in my operational phase because I couldn’t trust them.

— Edward Snowden, LibrePlanet 2016

These Slides are ==Detailed==48%

Grab a copy of the presentation: github.com/YalePrivacyLab/citizen-foss

Refer back to it later, read it slowly, & click the links.

  • If you don't do everything in the demonstrations or fall behind, that's okay. Learn 5 new things.

  • If you don't have a computer/phone, or it's acting up, make a friend in the room and follow along.

==Sharing is Caring:== Please copy, share, and remix!

==TL;DR== - Shorter, DIY Version70%

==Etherpad== for Live Q & A

Let's name a new pad at pad.riseup.net

...this pad will self-destruct in 30 days.

  • This is =="Security by Obscurity"==. Do not type info in the pad you wish to remain private. If the pad name is guessed or shared, anyone can view it.

  • Riseup.net hosts awesome services. Donate if you can, they almost had to shut down in 2016.

Other options: Riseup .onion Etherpad (Tor only), Cryptpad

Why ==Privacy Matters==

It's not about "having something to hide"

80%

Watch on YouTube:arrow_right:

Snowden Documents50%

Major takeaways:

==1.== The Bad News: All popular communication services have been compromised by ==government and corporate surveillance==. Mass data collection, software backdoors & exploits, government information requests, data breaches.

==2.== The Good News: Snowden was able to communicate extremely sensitive information despite this, using a combination of FOSS and Operations Security (OPSEC) training.

==Bad== News

Many services still compromised

80%

In 2016, we learned Yahoo! had new spy software for the NSA. At least 1.5 billion accounts were also breached in separate incidents.

==Good== News

More privacy software, easier to use than in 2013

85%

A list of alternative social networks from PRISM Break.

Guiding Principles:

1. Trust is earned. Not bought, decreed, or promised.

2. Free and Open Source Software (FOSS) is an essential security requirement (not a guarantee).

3. Solutions must be both libre & gratis to reduce friction, encourage sharing, avoid discrimination.

4. Advertisements & surveillance go hand-in-glove.

5. Data is a toxic asset.

6. Centralization is dangerous.

What about iPhones, WhatsApp, Facebook?

48%

Some U.S. corporations now encrypt some communication, making ==mass surveillance== like PRISM difficult.

  • Why trust these companies? Fool me twice, shame on me.

  • On Facebook & WhatsApp, your metadata and social graph are stored & studied. WhatsApp has a spy backdoor.

  • Apple knows who you talk to, even when they don't know what you say to them.

This data can be used for ==targeted surveillance== by police and intelligence agencies.

Demonstration:

Hands‐on with

Jitsi Meet

Secure ==Audio/Video Chat==

Let's name a new room at https://meet.jit.si

...this chat room will self‐destruct when everyone leaves.

50%

Other ==WebRTC== options: appear.in | Talky

Making ==First Contact==50%

Establishing a trusted connection

Privacy tools require ==trust== and a ==shared secret==. That secret could be a username, a URL, a passphrase, or an encryption key.

  • Share a secret using tools you learn about today.

  • Meeting in person may be the best method.

  • Etherpads, pastebins/imagebins like Up1, and "burner" temporary e-mail accounts are good options.

Try to use ==Tor Browser== or ==Orfox== for first contact (we'll cover this later).

32%

Off The Record (==OTR==)

Text chat/IM is very safe, if configured correctly.

Jabber (XMPP) is the basis for most IM (Google Chat etc.) but you need a trusted service provider. Try DuckDuckGo XMPP, or join Riseup, MayFirst, or the Free Software Foundation.

Use Pidgin (Windows & Linux) and Adium (Mac) with XMPP. Check the settings and make sure you're not logging chats.

Set up OTR for truly private XMPP. Follow this OTR guide

==Too complicated?== Try Ricochet.

Free Software ==in context==

Digital security requires software freedom.

80%

Watch on YouTube:arrow_right:

Picking ==Ain't Easy==48%

Start by eliminating ==proprietary software== and services with ==advertisements==.

Demonstration:

Focus on

Better Browsing

==Browser War==ning!47%

We'll focus on Firefox (and PureBrowser variant). Mozilla values privacy & has a solid record.

Why not Google Chrome? Most of the following tips will also work on Chrome & Chromium (100% FOSS version). Chrome contains proprietary code, has serious privacy issues, and reports back to Google several ways even if you try to opt out.

Can I trust Chromium? Maybe. Webcam/microphone spyware has been included with Chromium (not just Chrome) in the past, but it has since been removed. You will have to turn off the Google defaults and avoid Google services, however.

Breaking ==Ads==25%

Try these addons & tweak the settings. How to install | How to remove addons

23%

Better Search w/ ==DuckDuckGo==

DontTrack.us: problems with Google, contrasted with DDG. DontBubble.us: filter bubbles, which DDG doesn't create.

!bangs: Allow you to search other sites. These searches originate from DDG's servers, masking your identity.

edward snowden !g Google chelsea manning !w Wikipedia richard stallman !yt YouTube debian gnu linux !gi Google Images

Other options: Qwant | Startpage | Disconnect

Mo ==Passwords==, Mo Problems96%

Here are some password strength, storage, and retention strategies.

Passphrases: Can be a favorite song lyric, movie quote, or joke. I would also add numbers and special characters: Cecil+Harambe4ever

Strength: General guidelines | Diceware method

KeePass (Windows/Linux) or KeePassX (Mac): Organize your passwords in an encrypted database.

Browser Password Manager: In Firefox | In Chromium

Onion Routing via ==Tor==

Be truly anonymous on the Internet.

100%

Watch on YouTube:arrow_right:

Demonstration:

Try out

Tor Browser Bundle

==Anonymous== Web Browsing

Download Tor Browser Bundle It's Firefox, but anonymous! Security plugins pre-installed.40%

Tor is the standard for anonymity. The Tor network thwarts the NSA's best efforts to break it (we know this thanks to Snowden.

  • ==However:== Using Tor is not a magic bullet. Vulnerabilities may occur over time, so update often (TBB will nag you!)

  • TBB Settings: Go with the defaults. Customization makes you more susceptible to browser fingerprinting.

  • Bridges: Use if Tor is blocked or you need extra protection.

48%

Rolling in the ==Deep==

==Wikileaks== submissions and other anonymous ==.onion== services run on the Tor network.

Use TBB for the "normal" Web and the Deep Web.

Onion Sites That Don't Suck

Onionshare: Easy way to share files via .onion URLs.

Other Deep Web networks: I2P & Freenet

Remember: True security and anonymity requires hard work and careful actions to get right (==OPSEC==).

"Forget Tor. Just use a ==VPN=="

VPNs route traffic through a (==trusted?==) computer but do not provide the anonymity & security of Tor. Free (gratis) VPNs may be malicious. Most reputable VPN accounts cost money. 160%

Do your homework before trusting any service. Choices: Riseup Red (legacy) | Riseup Black

Purism VPN | Private Internet Access | CyberGhost

How a ==VPN== Works

Watch this before you try any VPN.

100%

Watch on YouTube:arrow_right:

==Sharing== Is Caring40%

...but love is a battlefield. Practice safe sharing.

Use OnionShare for single files. ==P2P== / ==Bittorrent== requires trade-offs: speed, anonymity, ease-of-use, size of network.

Tox | RetroShare | GNUnet | Tribler Remember: Sharing may run contrary to copyright law in your country. • Share ==copyleft==, Creative Commons ShareAlike & ==Free Culture== works. • Bittorrent over Tor is a bad idea & may de-anonymize you. • Set up blocklists to block potentially-malicious peers.

Dropbox-like solutions: SparkleShare | SpiderOak (some parts proprietary)

Demonstration:

"The Amnesiac Incognito Live System"

Tails

==Tails== is the Tor operating system

Follow the Tails Installation Assistant

  • Tails does not use your hard drive, or require any hard drive at all.
  • Tails boots from USB stick, CD/DVD, or virtual machine.60%
  • You may optionally set up ==persistent storage== for Tails. Otherwise, all files go *poof* when you shut down.

Not working? Try Whonix.

In contrast to Tails...32%

==Windows== can't be trusted.

Macs also contain proprietary software and have spying, control mechanisms, & DRM malware.

70%

Security Is ==Not Proprietary==

Recall Richard Stallman's TED Talk.

Fortunately, there is a lot of high-quality FOSS available, and many users, developers, & security experts worldwide.

What Can the =="Average User"== Do?

Try GNU/Linux, a popular & friendly family of FOSS operating systems. ==Tails== is only one member of this family, and may not fit your threat model. 55%

What is =="Linux"==?

"Linux" explained, in four minutes.

100%

Watch on YouTube:arrow_right:

75%

The GNU/Linux ==Distro== For You

Most ==libre== (no proprietary drivers, codecs, etc.) PureOS | Trisquel | gNewSense | Guix | FSF list

Very ==popular== (big community == good support) Debian | Ubuntu | Linux Mint | Fedora

Some "==favorites==" (list changes frequently) Ubuntu MATE | Xubuntu | Korora | Elementary

==Lightweight== (for aging computers) wattOS | Bunsenlabs Very ==secure== (not for n00bs) Qubes | Subgraph

DistroWatch | FSF common systems list (mainly Unix-like)

What about my phone/tablet?55%

Let's concentrate on ==Android== variants, which are based upon GNU/Linux.

Stock Android is insecure. It has dodgy proprietary apps from ==Google==, the ==vendor== (e.g. Samsung), & ==ISP== (e.g. AT&T). It may have backdoors for spies.

Some Android devices are restrictive. Your current device may not allow you to "free" it. If so, ==keep freedom in mind== for your next device.

iPhone/iPads are restrictive, with many pitfalls for security & freedom. If you must use one, jailbreak.

There is a world beyond Google.

32%

51%

Finding a ==ROM==

ROMs in the ==modding== community are loosely equivalent to distros / ==firmware==.

Non-Android GNU/Linux Devices

17%

Got ==r00t==?

==rooting== a device means getting ==superuser== / ==sysadmin== access. It's a Unix-y term for full control of a system.

With Great Power Comes Great Responsibility. Root ==may== be needed ==temporarily== to free your device. ROMs usually allow you to turn it on and off.

Unlocked Bootloader: If this is a step in the ROM installation process, you should lock it afterward.

It's all part of the fun! Back up your files, follow instructions, and use a "test device" if possible.

Demonstration:

Getting started with

Apps

300% 1. Install F-Droid, the FOSS app store for Android. You may have to "allow unknown sources".

2. Add the Guardian Project repository in F-Droid. GP offers privacy apps like ObscuraCam.

3. Install Orbot & Orfox, Tor and Tor Browser for Android.

4. Try Silence & Wire. Silence enables encrypted SMS/text. Wire is a full-featured text and voice chat app like Signal.

5. Search for other FOSS apps, like ad blockers.

5. Look for other E2EE apps around the Web like Signal.

90%

What about my ==Router==?

Your gateway to the Internet may be insecure. Default router / modem firmware has many vulnerabilities and is often under attack.

  • DD-WRT - FOSS firmware for many routers.

  • Tomato - A family of FOSS firmware mods.

  • OpenWRT - More like a distro for your router.

DNS vulnerabilities - OpenNic is an alternative DNS provider that routes around censorship and protects your network from DNS hijacking.

Intro to ==Encryption==

How math can keep us secure.

100%

Watch on YouTube:arrow_right:

60%

Encrypt Your ==Storage==

Encryption works, but is only as good as the implementation. FBI had a hard time getting into that iPhone. If they tried, Apple could get in more easily.

Above all, don't trust cloud storage like Dropbox.

51%

Plugging the ==E-mail== hole

Expect large, consistent ==data breaches==.

Major e-mail providers can't be trusted. Even years after the Snowden disclosures, Yahoo! created new NSA wiretaps and leaked 500 million accounts. Google actively studies e-mails, even spying as you type.

E-mail is a two-way street. Messages have to be private ==on both ends==. Your buddy @gmail.com is giving the conversation to Google.

140%

==E-mail== is an easy target

  • E-mail is often sent and received insecurely, yet users treat it as a secure channel.

  • Inboxes are utilized for personal data storage.

  • Weak passwords & password sharing is common, especially under work pressure.

  • Junk/spam filters play a cat-and-mouse game.

  • Phishing scams are increasingly-sophisticated.

Don't assume spies are too cool for phishing. Malware sent via e-mail is a common tactic.

Demonstration:

Up and running with

Encrypted E-mail

18%

The Road to Private ==Webmail==

Create a Tutanota account. Use ==Tor Browser== if you can.
  • Pros: Very easy to use, encrypts ==metadata== (subject, sender, recipient) as well as ==message content==. Android & iOS apps.
  • Cons: Encryption only to other Tutanota addresses. Can't download your mail locally via ==POP== or ==IMAP==.
  • Protonmail is a similar service, with encrypted, password-protected e-mail to non-Protonmail users.

Tutanota & Protonmail are not as flexible or popular as GPG. They work best if everyone uses the same webmail provider.

GPG guide by ==anon108==

Uploaded Jan. 6, 2013. Can you name the voice?

100%

Watch on Vimeo:arrow_right:

28%

You Down with ==PGP==? Yeah, GnuPG!

We say "GPG" because we're using the ==G==NU ==P==rivacy ==G==uard implementation of ==P==retty ==G==ood ==P==rivacy.

Download Thunderbird:arrow_right:

Follow the EFF's guide for your operating system:

GNU/Linux | MacOS | Windows

E-mail Hosts: Try Riseup or Mailfence. Mailfence has easy Gmail, Yahoo!, & Office365 import, quick GPG setup, and has calendar / document sharing. Some features require paid account.

Avoid ==Web== Publishing Traps52%

Sharing isn't just about conversations. The Web is for publishing World Wide.

Avoid walled gardens with total surveillance like Facebook. Replace them with federated social networks.

Replace Facebook: diaspora*, Friendica | Twitter: Mastodon, GNU Social

Find trustworthy hosting for Websites, Blogs, Wikis & Classes.

Secure Comms Strategy75%

Make a plan and stick to it.

  • The What: Choose a few crypto, sharing, & publishing tools.
  • The How: Try these tools, figure out how they work.
  • The Where: Find safe places to share secrets, on & offline.
  • The When: Describe scenarios when you will use each tool.
  • The Why: State clear reasons to use each tool.
  • The Who: Identify "experts" who can help & teach others.

The Only Constant Is Change! Try new software, keep up on tech news & potential threats, and re-evaluate over time.

Resources58%

Cryptoparty | Riseup | Tactical Tech | PRISM Break

MayFirst | Encryption Works | Reset The Net

Digital First Aid | H-Node | DRM-Free

Digital Security Helpline: 24/7 multilingual support

Xnet: grandes recursos en español

15%

Sources

Sources (continued)

Sources (continued)

Sources (continued)

Sources (continued)

Sources (continued)