SurvivalBlog.com

Secure Email (continued)

Public key encryption works like this: you have two keys– a public key and a private key. Your public key is just that; it’s something you share with the public. Think of it as more of a padlock though. When someone wants to send you an email, they lock it with this padlock. No one along the way can see what’s inside the email (not even your email provider). When you want to read the email you use your private key just like you would use a literal key to unlock, or rather decrypt, the message. Your private key is a carefully guarded string of numbers on your computer protected by a password. Enigmail makes this system easier by doing the work for you. It generates a set of keys for you, and it stores the private one. To decrypt messages, simply enter your password. Adding other people’s public keys is a bit more complicated. You can either have them emailed to you as an ASC file or given to you in person via USB thumb drive, or you can copy them off of the Internet if they’re posted publicly. A tutorial is available online at.

That’s all a bit complicated, isn’t it? Wouldn’t it be nice if there were a way to automate all of this completely? Thankfully, there is. I’m sure you’ve at least heard of Bitcoin before, but did you know there is a similar system for messaging? My favorite electronic communication medium is Bitmessage. It’s incredibly simple to use. There’s also an excellent tutorial. Consider this the preferred way for your group to communicate electronically.

Another option that somewhat automates encryption is MailPile. MailPile was coded by a group of Icelandic cryptographers and is a mid-step between hosting your own email and just using an email client. If you have a Raspberry Pi (or are willing to buy one for $35) that you can always leave on, this is a worthy consideration. Again, because of hardware constraints, I haven’t been able to test it out, but I corresponded extensively with the team. MailPile is like Thunderbird, only it can be accessed from other computers by providing a personal webmail. This webmail comes from a device you host, so it requires a computer (Raspberry Pi is a great option) that always has power and is always on in order to be used remotely. This option is extraordinarily convenient for when you’re away from your home computer but still want or need to encrypt your email.

Internet Add-on Software

Firefox is great on its own, but there are ways to make it more secure. This is accomplished via add-on software, which is written by people other than Firefox, that adds functionality to the browser. First on the list is Abine’s Blur (formerly DoNotTrackMe). This add-on has many features if you pay for them, but the free ones are awesome, too. The one I use the most is the email masking, where Blur adds an email on forms. This email will forward to your email, and you can turn it off if the company spams you. Abine also has an app for this. Blur will also generate passwords for you, but I haven’t ever used this. I prefer to come up with my own passwords. They’re easier to remember that way, plus a third party doesn’t know them. (Here is a hint on passwords. An easy way to come up with strong passwords is with gun terms; for example, Win.300m@g.) If you’re willing to pay for it, Blur will also mask credit card and phone numbers. Since I haven’t had need of this yet, I haven’t tried either of these services.

Another add-on is Hide My Ass Proxy. This add-on will proxy your Internet traffic through an off shore server, thereby hiding your location and identity. It’s like a lighter, weaker version of TOR. Ad Blocker Plus is another one I use, simply because it blocks most annoying pop-up ads, almost all of which are malware.

Lightbeam is another extremely helpful add-on. It monitors what external sites the websites you visit, connect to, and share your information with. It’s quite eye opening and can be used to convince others about the need to improve privacy online.

HTTPS Everywhere is an add-on that forces websites to use encrypted connections when available. For Thunderbird, there is TorBirdy, which routes your email traffic through TOR. This would be great, but every time I’ve tried it, it has made Thunderbird stop working. I currently have the add-on but keep it disabled.

General Computer Security Tips

Now I’d like to offer some general tips to help maintain your online privacy and security. All the software in the world won’t make up for any security mistakes you make. As former FBI most wanted hacker Kevin Mitnik says, “Humans are the weakest link in any security system.” First, use common sense when you fill out forms. Ask yourself, “Does this person/organization really need this information?” If the answer is no, don’t give it to them. Don’t reveal your address, real name, or certainly your birthday (I can’t think of very many legitimate reasons anyone needs this). If you need to supply an email address, hop over to www.getairmail.com or a similar service and use a temporary email (or Blur). I’ve used this method to download nearly fifty different survival books in PDF format without giving away my email address. If you create a social media profile (though I recommend you don’t), use a pseudonym. This will prevent future employers from simply Googling you and perhaps discriminating against you for your political or religious beliefs. It can also afford you a bit of plausible deniability, if your employer or anyone criticizes you for something you posted. Additionally, now you can’t be friended or followed by people you may not want to be associate with online. Don’t click on suspicious ads. Before you go to a URL, make sure you typed it in correctly. For YouTube especially, there are several malware sites that use URLs like yuotube.com and youtbue.com. Log out of your accounts every time you close your browser, and don’t leave your browser up all night. Put your computer in airplane mode when you don’t need the Internet. Use long passwords (sixteen characters minimum) that include letters, numbers, capitals, and symbols. If you can, also include punctuation. For passwords that protect banking information or anything else particularly valuable, don’t use combinations based on anything in the dictionary. In this case, even something like tH^s-iSS&meye, stRONG@paSS%ord aren’t good enough. A really strong password resembles a Bitcoin address with symbols: lfmT6!77djLw84$(dkYY6v#14StiLmOp. Clear your cookies and cache frequently. Always update everything on your computer. Even though it may not say so, most updates include security fixes. A common tactic among hackers is to find computers that are running un-updated software and use well-known attacks without having to do any work. When you see that bubble announcing an update, click it and update immediately!

For mobile security, realize that you give up a lot of privacy when you buy a mobile phone. The best thing to do is to buy a pay-as-you-go phone and never store any contacts on it. Don’t attach it to your email, and preferably get one that you can easily remove the battery from. Try to get one that flips and only has a number pad. Not only will this remove the temptation to check your email or surf the web, you’re less likely to get robbed for your phone. Note that any anonymity that you have is ruined the moment someone else stores your name and number as a contact in their phone. Good luck trying to convince people not to put you in their contacts.

After a cheap pay-as-you-go phone, my next recommendation is at the opposite end of the spectrum. Blackphone is designed specifically to foil the NSA and is produced by Silent Circle– a service that voluntarily shut down their email service rather than reveal their customers’ information to the NSA. They are also now part of the Darkmail team. Communication between Blackphone users is encrypted, including calls and texts. They also have features that let the users know if their communication is being monitored.

As far as run of the mill smartphones go, Android (being open source) is better than iOS. Yes, Android is owned by Google, but it was open source before that and can still be turned into a rather secure mobile OS. I have never owned an Android phone though, so I can’t offer specific tips. There are many tip available at the following this website.

iOS is strictly the property of Apple and thus extraordinarily vulnerable to government surveillance. There is a little bit you can do. Get the DoNotTrack app and the ChatSecure App. While you’re at it, get 2nd Vote– an app that grades companies by their political stances. While not security related, they allow you to make informed purchases. Use OperaMini instead of Safari. It is owned by a Norwegian software company and will also save you money by using less bandwidth. Be sure to turn off ad tracking: Settings > General > About > Advertising. Reset your advertising identifier while you’re at it. If you must stick with Windows, I have some advice. First, Windows 7 is preferable to Windows 8 for a variety of reasons. Security is better on Windows 7, and the user interface of Windows 8 just stinks. Also, the Electronic Frontier Foundation (a group that works to improve digital security and privacy) and Amnesty International teamed up to design software to scan Windows computers for malware known to be used by government surveillance organizations (and hackers, as well). I highly recommend Detekt.

As for wifi modems, I prefer to buy from Cisco, since they openly and proactively work to prevent the NSA from compromising their users’ privacy.

A few of my readers may have noticed that I didn’t mention encrypting the entire hard drive. Previously, I would have mentioned this and recommended TrueCrypt, a now defunct open source encryption software. Unfortunately, last year the developers of TrueCrypt released a mysterious letter saying that TrueCrypt could no longer be trusted, and that they would no longer be releasing periodic updates. It is widely believed that the NSA pressured them into quitting. Since it was open source, hopefully someone will take up the baton, but this has not yet happened to my knowledge. I have not been able to find and review an appropriate open source alternative.

I would like to again repeat that even after implementing all or some of these steps, you are not immune to the NSA. If they choose to single you out, they will succeed. Never store on a computer any extremely sensitive information that you wouldn’t want the government (or anyone else) to know. Once it’s on a computer, there is a chance, however small, that it can be retrieved, even if you attempt to delete it or destroy your hard drive. Physically write down (or better yet, just memorize) your prepping checklists and plans. Also, remember that everything described in this article is only secure until someone finds a way around it. In Christ and Liberty.

Before we begin, note that the title is a bit of a misnomer. Digital security is mostly nonexistent. When computers took off, security was never a concern, so they are inherently insecure. I will do my best to help you secure your computer as much as possible. The point isn’t to make your computer invulnerable to attack. That’s impossible. However, just like your survival retreat security, the goal is to make yourself such a hard target that hackers or the government move on to lower hanging fruit. Again, nothing in here will make you immune to the NSA. They have an essentially unlimited budget and thousands of personnel dedicated to cracking all the methods included herein. I will simply guide you through the process of making yourself a hard target. You will be immune to dragnet surveillance and most hacking attacks. Also note that merely Googling most of this software will get your IP address logged on an NSA database. Therefore, use https://www.duckduckgo.com/ for better security. Without further ado, let’s begin.

Your Computer

Let’s start with your actual computer. I don’t recommend an Apple computer, as a friend who works for the government told me that Apple retains near-complete remote control of any computer they produce. I would highly recommend buying a computer from a mom and pop computer company. However, this is very cost prohibitive. Next in line is a Panasonic CF-29. These “Toughbooks” were used by the police and military extensively and are designed to handle wet climates, heat, cold, and rough handling. This is a good all around transportable computer. Another option is to buy a brand new computer with a large hard drive (think one terabyte). Consider the utility of buying a cold computer– one that never accesses the Internet– to store confidential files. When buying new computers, Bitcoin users may want to purchase one with a large graphics card in order to do GPU mining. Preferably, your new computer will have Windows 7 and not 8. (Don’t worry, we’re going to replace the OS. This is just so that the BIOS and other features are easier to access.)

Operating System

Now that we have the computer out of the way, we can move on to the operating system (OS). Obviously, Windows isn’t an option, since Microsoft actively collaborates with the Feds and we already rejected OS X. That leaves Linux, the open source OS. More accurately, it’s a kernel used to make a variety of OSes. The special thing about open source software (F/OSS) is that it doesn’t have a typical copyright. F/OSS has a license, such as the Gnu Public License (GPL), Lesser Gnu Public License (LGPL), and MIT license. These licenses, in varying degrees, open the source code of the software to public review. Think of it as public domain for software. Why is this advantageous? Well, you’ve probably heard a lot about back doors, since the NSA scandal. Since F/OSS source code is released to the public, back doors can’t be hidden in it. Another advantage of F/OSS is that since the source code is available to everyone, it’s absolutely free of cost.

Let’s talk more about Linux. Linux is an open source operating system with dozens of different “flavors” or “distros”. You can pick any one to suit your tastes. However, for newbies, I recommend either Ubuntu (or its children– Kubuntu, Xubuntu, and Lubuntu for small systems) or Fedora (or its children– Fedora LXDE and Fedora KDE, again for small systems). These are widely used distros with helpful forums. I have the most experience with Ubuntu. If you are an open source purist, you’ll want to go with Fedora, as it doesn’t use copyrighted, closed source programs like Adobe Flashplayer. Note that Adobe Flash can be used to track people, so I would say Fedora is the best bet. Canonical– the company that maintains Ubuntu– has also incorporated adware for Amazon. Ubuntu’s advantage is that it works on most hardware out of the box. I’ve found Fedora to be a little less accommodating but not too much. YMMV.

• www.ubuntu.com
• www.fedoraproject.org

If you are a bit tech savvy, check out Arch Linux. Arch is special because it is not actually an operating environment. When you install Arch, all you have is a command line interface (CLI) and a program downloading program. You then build your own environment from the roots up. This is my most recommended Linux distro, second only to Parabola. Parabola is exactly like Arch, except it includes absolutely no proprietary software. While this would be the most secure, it will include limited functionality compared to Arch.

Another excellent option I’d like to mention is Tails. Maintained by the TOR Project (see below), this operating system is engineered specifically to protect privacy. I haven’t yet had a chance to try it out (I only have so many computers), but it sounds like a very promising OS. The TOR Project as an organization is committed to preserving digital privacy.

I’d also like to mention FreeBSD. I have no experience with this operating system, so I can’t say whether or not it is more or less secure than Linux or easier or harder to use. I will say that it is less common than Linux, and thus will have less compatible software.

Word Processing

Now that we have a laptop and an operating system, let’s move on to the basic functions of a computer. Word processing is at the top of most people’s list. Thankfully, there’s an open source option: OpenOffice. Also known as LibreOffice, this office suite includes a word processor (Writer), a spreadsheet (Calc), and a presentation writer (Impress). These are equivalent to Microsoft Office Word, Excel, and PowerPoint, respectively. As a bonus, OpenOffice enables you to write or convert your documents into Microsoft readable form, so you can still share your data with non-Linux friends! It comes standard in Ubuntu and Fedora, as well as many other flavors of Linux.

Internet Browser

Now, let’s go to the Internet. We’ll start with your browser. My favorite is good ol’ Mozilla Firefox. I imagine many of you already use this or have at least heard of it. Firefox is F/OSS and managed by Mozilla, a very digital freedom friendly company. If you are extremely finicky, you may prefer Iceweasel, which is Firefox minus the copyrighted Firefox logo. An honorable mention is Seamonkey, a web suite also managed by Mozilla. Stay away from Chromium, the F/OSS parent of Google Chrome, as it was commandeered by Google.

The above browsers are great options, and clear of malware and backdoors. However, the browser can only do so much to protect your privacy. Your physical location is still visible to anyone who cares to look, including the government. To address this issue, there is TOR. TOR stands for The Onion Router and was designed by the Navy. Utilizing a system of routers, TOR obfuscates your location by passing you through three other computers first. These computers are run by volunteers around the world in a decentralized network. TOR also gives you access to the dark web– the Internet not accessible to Google and other search engines. These sites end in “.onion” instead of “.com”, “.org”, or any of the other common top level domains. Note that the dark (or deep) web has many sites dedicated to pornography and drug trafficking, so proceed with caution. You can use TOR without accessing the deep web, but using darknets for legitimate sites like DuckDuckGo (I believe JWR at one time suggested one for SurvivalBlog) will increase your anonymity. TOR is also automatically formatted to bolster privacy, so it comes with the NoScript add-on (I recommend this for regular Firefox, too) and will not play YouTube videos, due to their inherent vulnerability. To make TOR even easier to use, you can get TOR wifi.

Internet Search Engine

Now that we have a web browser, we need to replace Google as our search engine. Enter https://www.duckduckgo.com/ to reach the search engine/company that doesn’t track you. DuckDuckGo was founded on web anonymity and is ,you guessed it, open source. It’s a fully functioning search engine and more than capable of replacing Google. Other options include http://www.ixquick.com and http://www.startpage.com

Virus Protection

Since we’re hooked up to the Internet, we’d probably better get an antivirus. We’ll start with ClamAV and ClamTK (ClamAV’s graphical user interface (GUI). These are great for finding viruses, but they don’t actually cure them. For that, we’ll have to download a closed source program like Avast (www.avast.com). There are a few other antiviruses that work on Linux, but Avast is my personal favorite.

Secure Email

Now, let’s secure our email. The short answer to this problem is: it’s impossible. Email just isn’t secure. That’s not the way it was designed. (There is a movement to make it more so) However, there is a little bit we can do to improve our email security and make ourselves a hard target to the NSA. First, dump your Gmail, Yahoo, Hotmail, AOL, or any other conventional email provider. There are a number of private, secure email sources, both paid and free. Some of my favorites are ProtonMail and Lavaboom. (I’m still waiting to try Lavaboom.) These two providers are free. (Both say they will eventually offer paid premium accounts and offer automatic encryption between users. There is more on this below.) ProtonMail is hosted in Switzerland, and Lavaboom is hosted in Germany. Both of these are “zero knowledge providers”, which means that they don’t have any information about you. In fact, they can’t even access your password. I prefer the Swiss hosting of ProtonMail, while I prefer Lavaboom’s open source aspect, as well as their incorporation of Darkmail. An honorable mention is OpaqueMail, which I haven’t quite figured out yet, and thus haven’t had a chance to try. It is completely open source, self hosted, and was designed to combat NSA spying. It appears to be a DIY email client. If you want to host your own email but need a trustworthy domain for a dynamic IP and don’t want to pay for one, check out PageKite. It’s written by the same people behind MailPile (see below). Next, we’ll return to our friends at Mozilla and download Thunderbird– the open source email client. You can use either the IMAP or POP3 protocol. The difference is that IMAP will sync with your webmail, so when you log into it via an Internet browser, everything is the same. POP3 will store everything locally on your computer. This sucks up memory and leaves any emails you delete in your online inbox. I prefer the IMAP protocol. Next, download the Enigmail add-on for Thunderbird. Enigmail uses OpenPGP (also known as GPG), encryption software invented by Phil Zimmerman in the 1990’s that’s never been compromised, to facilitate public key encryption. (You can also use S/MIME.) Edward Snowden said that OpenPGP (PGP stands for “Pretty Good Privacy”) is one of the few encryption methods the NSA has been unable to crack.