My Privacy Experiment
This is going to be a long read. You've been warned...
I've been on a journey for several years now of investigating Linux and Open Source software. It's taken me much longer than I'd hoped to come to grips with it all, and I possibly never will fully unless I take some serious time off to study it properly, which plonks it firmly in the hobby area for the time being.
Having said that, I only run Linux at home now. There are no Windows boxes in my household, and I got rid of the Mac years ago after I decided it wasn't meeting anybody's needs in my house.
My latest project was to see if I could emancipate myself from the various services and social media offerings I'd come to rely on. Gmail and Chrome on my PC, and I also took a good look at the messaging apps on my phone - Whatsapp, SMS - and what potential there was for more private options. And last but not least, I wanted a search engine that wasn't logging all my searches. We've already seen how much trouble people got into for trying to watch videos of a certain incident in Christchurch in March 2019, for what reasons it is not my business to speculate!
It's been interesting to say the least, so I thought I would lay out the process here. Bear in mind this list is not extensive, it's just the stuff I looked at personally.
Why would I undertake such an exercise? Well you may ask. Many people I've chatted to about this suggest if you're not doing anything bad then you should have nothing to hide. This is a somewhat narrow view and is best summarised by the good folk over at privacytools.io:
- ...every single time somebody has said to me, "I don't really worry about invasions of privacy because I don't have anything to hide." I always say the same thing to them. I get out a pen, I write down my email address. I say, "Here's my email address. What I want you to do when you get home is email me the passwords to all of your email accounts, not just the nice, respectable work one in your name, but all of them, because I want to be able to just troll through what it is you're doing online, read what I want to read and publish whatever I find interesting. After all, if you're not a bad person, if you're doing nothing wrong, you should have nothing to hide." Not a single person has taken me up on that offer.
Personally, I do care about privacy, but when I first undertook this exercise, it was really just to investigate how hard it would be to cut the apron strings from the aforementioned services. It was harder than I thought, and I had to change my mindset regarding free Internet offerings. Don't get me wrong, you can still achieve a lot for free, but I found that for what I was wanting to do, I needed to consider paying for things I had always taken for granted as being free on the Net.
These are the services and products I have looked at in my journey:
I have written elsewhere on my battles with Chrome as an application packager, and that should tell you in short order why I despise it with a passion. Really, if you want some measure of privacy without going full tin-foil-hat, there's only one game in town for standard daily use.
I've packaged this one as well, although packaging it is best avoided. In regards to privacy, the one complaint people have is that it does want to send usage statistics back to it's masters at the Mozilla Corporation (the corporate arm and subsidiary of the Mozilla Foundation), but they at least give you the option to disable that. Otherwise, I've been happily using FF since about 2004. I'm using it right now to write this blog. Granted, there are some web sites/apps it has difficulty with, but these are negligible for me personally.
Tor browser is based upon Firefox, with a much more security-focused outlook. It bounces your web traffic around various servers to mask your origins (this can make it considerably slow if your ISP is not up to snuff). It clears all data on exit, so there's no record of anything you did when you had it open. Some privacy-conscious websites won't work unless you're using Tor.
My first stop was That One Privacy Site and their handy email comparison chart. It measures several things, the most interesting to me being whether the servers were hosted in a five, nine, or fourteen eyes country. I ended up with three workable options:
Protonmail is essentially a paid email service (something I had never considered before). You can register a free account with them, but your storage is capped at 500MB. If you limited yourself to plain text and no attachments, it may be an interesting exercise to see how long you could make that last (I haven't tried it). I chose Protonmail because I wanted a professional email account for my contracting work that I could also use a custom domain with. Depending on which tier you choose, you can have more than one custom email alias.
Protonmail is hosted in Switzerland, whose claim to fame is of course their neutrality during World War II and the oft-mentioned Swiss Bank accounts. I have no idea whether this makes them more secure, but they are certainly marketing off the Swiss reputation.
I have been using Protonmail as my main email address for three years now, and I like it. As a web-based email it is great, and they have an app for your phone as well. All your emails are encrypted on the device you compose on.
If anything, my and others' only complaint is that it is difficult to use with a desktop email client on Windows, and impossible currently on Linux (they are working on a Linux solution). I don't need to run my daily email through a desktop client, but it becomes necessary if you actually want to download your emails - something you will be forced to do if you are on the one-custom-domain tier and you wish to swap it out for another domain - as Protonmail have the rather strange requirement that you remove all the emails for the old domain from their servers.
In terms of privacy, That One Privacy Guy highlights that Protonmail have a policy of co-operation with government agencies and law enforcement, an ambiguous statement which possibly means they could hand over all your emails if requested - bound to be a deal-breaker for some.
I have not gone too far down the rabbit-hole with Amsterdam-based Disroot, although I did register an email account with them. At some point they stopped accepting new registrations, although they seem to have overcome whatever caused that. Upon checking their site again I see they are now offering a full suite of web apps, including it's own cloud storage offering in a Nextcloud instance. It all looks very exciting and I may have to revisit using their services.
Elude is the Nth degree in a private (and free) email offering. The link I have provided is something of a place-holder only, and you cannot use it to log into the site proper unless you are on the Tor browser. Elude was setup primarily to protect journalists - you fill in the blanks there.
As well as that one privacy site, you can also find advice on private email providers at privacytools.io.
One factor that is often over-looked by many. I had ditched my Gmail account in favour of Protonmail, but all my phone contacts were still tied to my gmail account. I still wanted the functionality of syncing with a cloud solution, but again with something preferably open source.
Enter Fruux. I was able to export all of my Google contacts and import them into fruux for syncing with my phone. I use fruux solely for this purpose, although when I was looking around, one of the reasons I chose them is because fruux also has a syncable calendar. I don't really use the calendar feature, but it was a case of wanting to have it and not need it, as opposed to needing it and not have it. I've been using fruux for at least two years and no issues thus far. For that reason I don't have any other offerings to mention for storing Contacts.
Nextcloud is the big name in open source cloud storage currently. The major caveat here is that it is self-hosted, so you need to either find a hosting provider or have your own server. I did play around with Nextcloud at home but managed to lose a whole lot of data which put me off using it. However, my data loss was purely my own fault and the choice to avoid Nextcloud was largely subjective. In my revisiting of Disroot, I see they are now offering a Nextcloud service, and I will be looking to get over myself and look into Nextcloud via Disroot, once they get back from their Easter break!
Like Protonmail, Pcloud is hosted in Switzerland, and it is completely up to you how much credence you give to the Swiss' reputation. Pcloud is a paid service with multi-tiered offerings, and thanks to a 60% off special, I got the one-time payment/life subscription. I may come to regret that once I get to grips with Nextcloud - hindsight is 20/20 - but for now it is meeting my needs very nicely. They boast a military-grade level of encryption - take that however you wish.
Thanks to family and friends, I've tried just about everything on the market, from Whatsapp to Viber. Trying to edu-ma-cate my family on secure messaging has proven futile (sigh). These are the two I've at least spent some time on:
Telegram looks just like Whatsapp, but is touted as being more secure. This isn't necessarily true. Whatsapp, while owned by Facebook (which should be enough to deter you), has builtin encryption of messages. Telegram has encryption, but you need to intentionally enable it, which seems utterly devoid of logic to me for a privacy-based product.
One feature I do like is that Telegram has a desktop client. For all us Gen-Xers who are now wearing bifocals or reading glasses, and cannot type fast enough into our phones to keep up with our younger counterparts, the desktop app is great for messaging directly from your PC or laptop.
Unlike Telegram, privacy is not optional for Signal. Endorsed by Edward Snowden, Signal encrypts all messages. Bear in mind I have not been using it for very long, but one thing that I loved about it was the option to replace my phone's builtin SMS messaging app. Now my SMS messages go through signal also, and it has a feature I seem to recall from the dark days when I owned an iPhone, where text messages are sent via your internet connection if the recipient also uses Signal. Very handy if you are on a restrictive call/text plan with your cell provider.
This one has become very important recently in the wake of the Covid-19 situation and forcing everyone to work from home. For most people, Zoom is the only game in town. Having packaged Zoom for a couple of places, I was never impressed with it or the support for it, so I was less than surprised when articles started surfacing about it's plethora of security vulnerabilities. At this point, we're still at the stage where mentioning these flaws will get you funny looks from people, whose first thought is you are a nuisance and a stirrer for wanting them to ditch their beloved Zoom. Such is our burden in the I.T. world. However, as with everything else, there are alternatives.
I know very little about Jitsi, other than it is open source and encrypted, but I mention it because I used it for the first time yesterday in a group chat situation with people overseas from me. The only issues I had were self-inflicted because I didn't use a builtin web cam or microphone which caused some difficulties. I eventually dived out of the meeting and logged back in from my phone with no further issues.
For people who care about display options, fear not! Jitsi has the tile display option just like Zoom.
Another Zoom alternative. I have not used this personally but I am looking for the opportunity.
That is all. Don't look for anything else - stop... just stop. You only need DuckDuckGo. The best part is - they're not tracking you.
For some years I've been looking for the opportunity to run a fully Linux phone and get off Android. Granted, I did manage to install LineageOS on a Samsung Galaxy SIII some time back, but that was an old phone which has since died and I was not using it as my main device - which in my case means I was not all in and so the experiment was largely fruitless. Just as Cortes allegedly told his men to burn the ships, I will need to put my SIM in a linux phone and commit before I have anything intelligent to say about the experience.
The ZeroPhone is a self-assembled phone that is built from a Raspberry Pi Zero. Kits can be purchased, and if you just want a phone that does calls and texts, this is a cheap and do-able option. There's a nice write-up on them here. I am keen to build one of these.
This one seems promising if they can ever get themselves moving. This phone has been available for pre-order for some time which is essentially no good to me (I want it now!). The compelling factor for the PinePhone is that it is a dirt cheap smartphone at $150 US. You will need to install your choice of OS yourself though.
The next step up from the PinePhone is quite a jump in price at $700 US (which I don't really have in my back pocket). Made by Purism, they run their own flavour of Linux called PureOS on the phone, and utilise the Matrix open standard for secure and platform-independent communication.
My journey into the realms of privacy is far from over. I didn't have time to cover social media apps, for example the decentralised options like Mastodon to replace Twitter/Facebook, and PeerTube to replace YouTube. Given the West is teetering on the brink of totalitarianism via the Coronavirus catalyst, we need to keep thinking about this, and consider our options now more than ever.