Young - Take Back Your Privacy: The Barefoot Anarchists Guide to Navigating Todays Digital Landscape

This ones for my father. I think he would have enjoyed it. Mostly. Hed also have given me a look of forbearance, for several reasonsnot least among them being that he was good at it.

Thanks, Dad. I remember what you told me.

Its also for Kenneth Vaughan, a neighbor and close family friend who got me interested in cryptography when I was pretty young. Im not sure he even knows he did that. But he did.

Table of Contents

Well, for starters, I do. Writing this has helped me organize my thoughts, and find (sometimes even fill!) gaps in my own knowledge, and generally its given me an excuse to do ridiculous amounts of web-surfing on topics I find amusingum, I mean research. Ive been fascinated by privacy, cryptography, and general so-called security issues for decades now. This goes back at least to a seventh-grade science project in which I programmed a computer to try various methods of breaking codes. Well, ciphers, technically. Back in 1981. Yeah, Im gettin on for old by now. Thanks for noticing.

Along the way Ive worked for major corporations, worked or consulted for a bunch of variously-sized startups, and run my own company a few times. Now, Im a writer. Sothe book thing kinda makes sense, doesnt it? Once you put all that together.

Also, this book gives me a quick way to respond to people when they post an article or offer a product that essentially claims use this wonderful product/service, and youll be insta-anonymous online!

You know what? If you learn nothing else from this book, please walk away knowing this: sweeping statements are dangerous. They hurt people. Uncritical acceptance can hurt you.

Are you suspicious of that claim? Good; youre in the right place. Ill be showing you exactly what I mean. Heres another: unless you do a reasonable amount of research (which I like to think should include reading this book), you may well be better off ignoring all digital-privacy issues entirely. Truth is, attempts to keep your data and communications secure can actually draw attention (Chapter Three, and elsewhere). Some things you might try sound great at the tech-blogger or product-sales level, but if you actually implement them you may find out youve made yourself a much bigger, softer target than you were before you decided to do something about it. Hell, against many kinds of attack you basically didnt exist until you started dodging around.

Dont believe that claim? You are so definitely in the right place. Im going to prove that one over and over.

My guess, since youre reading this book in the first place, is that you will be using systems to help you safeguard your privacy. Ill do what I can to help that work out for you.

Thing is, large-scale unsupported claims and offers of Simple! Cheap! Solutions! help sell products. Apparent panaceas also work very well as clickbait (meaning basically that the headline draws people in), which helps online writers gain notorietyand sell advertising space, which is how most of them generate dollars. Well definitely talk about advertising too, because it matters more to your privacy than you might think. In general, any time you read that a single product, whether its a phone, a browser, a browser add-on, a networking scheme, a digital currency, or whatever it may happen to be, will make you secure? Or anonymous? Or otherwise, somehow, safe? If only youll use it? Well, it wont do that. It really cant. At least, not alwaysand never by itself, without qualifications and reasonable care on your part. Beware the fine print! Which, unfortunately, is generally more metaphorical than real.

It may or may not even help to use a particular product or service. Some of these ideas you read about will probably, when used with appropriate care, be tools youll want to adopt. Others will be actively harmful. Often it will depend on the context in which youre using them. Another fun concept: a lot of the useful tools can also be harmful, if used incorrectly. If you havent yet learned how to understand the tools and how they work together, or dont. Yes, Ill prove that too.

Much of what you are currently doing, right now, is very likely broadcasting far more information about you than you know youre giving out. Even if you write software, or manage computer networks, or do tech support, for a living. But I want to be clear, here: I am optimistic that you can take a much larger degree of control of your digital footprint than you ever have before. Once you know more about what that actually looks like.

Dont let that last paragraph scare you off. If you can currently grasp the difference between the internet and a web browser, youve got just about all the expertise you need to understand this book. If I do my job at all well, youll be way ahead of most IT (information technology) professionals when were done. (Of course, you might already be way ahead. If so, good! Lets see if I can still find some angles you havent yet explored, shall we?)

Here are some things Ive heard in the last couple of months, from one IT pro or another:

• But how can open-source software be secure? I mean, if people can see your code

• I really doubt Google cares about my browsing history.

• People should protect their privacy with the right Facebook settings.

• I use a VPN (or Tor) and that means Im browsing anonymously. Or at least Im more secure.

• I get all my files from Usenet, and I use SSL, so Im anonymous and my ISP cant tell what Im doing.

• Company X says [whatever] in their privacy policy, so if thats true, Im safe from Y.

• Well, my hard drive is encryptedso I dont have to worry about X (where X means ANYTHING but simple theft of the hard drive)

• I only encrypt my home folder, because encrypting the system is overkill.

• I use Linux (or a Mac), so I dont need to worry about this stuff so much.

• I think the government has backdoors into everything, so theres no point in trying to hide anything.

• and so on.

You may already see why all of these are ridiculous. Or maybe, at this point, youre nodding along with one or another of them. Well, if so, this book is definitely for you. Seriously, they all have major flaws (often more than one apiece). And Ill prove that to you. Im not going to nit-pick any of the above and claim some sort of technical victory afterward. Im going to show you, with no room for doubt, that all of the above are just wrong-headed. You really cant even say stuff like the above, at least without a string of caveats, if you understand what Im about to show you.

Im going to be very specific in my recommendations, when I can. Other times, Im going to do what I can to give you a sense of the trade-offs youll make as you go along. But Im also going to show you, as best I can, how to analyze these tools and issues for yourself. In fact that last part is, for me, the most important thing I can do here. Because there will always be new tools and new options to consider.

Im including hundreds of links throughout the book, for a couple of reasons. First, some of what I say will almost certainly strike you as completely outrageous. So, Ill offer evidence. Second is sort of the same issue: Im going to be asking you to doubt everything youre told, by anyone and everyone, about online security. To evaluate each claim, taking the incentives and prejudices of the person or organization making it into account. To understand what to provisionally accept, and what to reject entirely, and why.

So. If you believe a damn thing