Almost everything you do online is being observed by someone. Private and state-sponsored organizations are monitoring and recording the websites you visit, how long you stay at those websites, what you say on social media, who you send emails to, the content of those emails, and more.

Find what steps you can take to protect yourself and your privacy here at Privacy Australia.

Why should I care about my privacy? I’m not saying anything that anyone should care about and I have nothing to hide.

For those who have nothing to hide, we have a special request. We know someone who would like you to send him all of your email addresses and their associated passwords. Not just the ones that you use at work. He would like all of your personal email addresses and passwords too. He will take a look through your email accounts, and if he finds anything that he feels others should know about, he will publish it online for you. So far we haven’t had anyone who wanted to fulfil this request.

— Glenn Greenwald in Why privacy matters – TED Talk

Read Also:

• A look at why people believe they have nothing to hide. – Wikipedia

The Fourteen Eyes is the name of a group of countries that share intelligence with one another. This group consists of Australia, Canada, New Zealand, the United Kingdom, the United States, Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain, and Sweden.

Within this group is a subset called the Five Eyes. The countries that make up the Five Eyes – Australia, Canada, New Zealand, the United Kingdom, and the United States, have made an agreement with one another called the UKUSA Agreement. Under the terms of this agreement, the nations that make up the Five Eyes have agreed to work together to collect, analyse, and share intelligence from different parts of the world. They have also agreed not to spy on each other as adversaries. Even though they have made this agreement, leaks from Edward Snowden revealed that some members of the Five Eyes do in fact spy on each other’s citizens.

They also avoid breaking domestic laws against gathering intelligence about their own citizens by gather intelligence about one another’s citizens and sharing it with each other. The Nine Eyes consists of the countries in the Five Eyes along with Denmark, France, the Netherlands and Norway. The member countries of the Five Eyes share intelligence with the members of the Nine Eyes and Fourteen Eyes. The members of the Five Eyes and third party member countries (those that are in the Nine Eyes and Fourteen Eyes, but not in the Five Eyes) spy on one another.

To protect your privacy, avoid services based in the United States

---

The surveillance programs in the US, along with the use of National Security Letters (NSLs) and associated gag orders, give the US government the freedom to secretly force companies to hand over access to their customer’s telecommunications and financial records. The government can use this access to spy on those customers. The gag orders that are associated with the NSLs prohibit the recipient of this type of request from talking about it. This is why you should avoid US based services.

This scenario took place with a company called Ladar Levison and their secure email service called Lavabit. After the FBI found out that Edward Snowden used this service, they requested that Ladar grant them access to Snowden’s records. Since Lavabit did not keep logs and since it encrypted its customer’s email content, Lavabit could not fulfill the FBI’s request. The FBI responded by serving a subpoena (with a gag order) for Lavabit’s SSL keys. With the SSL keys, the FBI would have access, not only to Snowden’s records but to all real-time communications (both metadata and unencrypted content) for all of Lavabit’s customers.

Levision wasn’t able to win this battle. They gave the SSL keys to the FBI and discontinued Lavabit. In response, the US government accused Levision of violating the subpoena and threatened to arrest Levision.

Levision restarted Lavabit and developed a new email standard called DIME – Dark Internet Mail Environment. DIME is a standard for end to end encrypted email. Lavabit currently offers DIME encrypted email services to consumers and businesses.

Related Information:

• Proof that warrant canaries work based on the surespot example.
• http://en.wikipedia.org/wiki/UKUSA_Agreement
• http://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order
• https://en.wikipedia.org/wiki/Key_disclosure_law

VPN providers with extra layers of privacy

---

Visit our home page to see our full list of recommended VPN Services in Australia.

Our criteria for selecting VPN Providers for our table:

• The provider conducts business outside the member countries of the Five Eyes. For more information read To Protect Your Privacy, Avoid US-based Services
• The provider supports OpenVPN software.
• The provider supports alternate forms of payment including Bitcoin, cash, debit cards or cash cards.
• To open an account, the provider requires no information other than a username, password, and email.

Warrant Canary Examples:

• Discuss this chart on Reddit.

More information about VPNs

• Is Your VPN provider really keeping your data private?
  (Note: the first providers listed are sponsors of this site).
• How to strengthen the security of any VPN
• When choosing a VPN provider, watch out for VPN companies that pay for advertising and fake reviews.
• Ten Lies Exposed About VPNs
  (Note: this is great article, but the site promotes itself in the piece).
• VPN provider spies on its own customers to stop hacker.
• IVPN collects the email address and IP address of customers after they sign up.
  Read their email statement in response.
• blackVPN will no longer keep connection logs with timestamps when customers connect and disconnect from their services. They will now delete that information when a customer disconnects.
• Avoid the LT2P/IPSec Protocol. Select a different one instead.

The Warrant Canary Defined

---

A warrant canary is a notice that informs users of a service that the service provider has not been served with a warrant or secret subpoena. If the warrant canary is removed or if it ceases to be updated, users of the service should assume that the service provider has been served a warrant or secret subpoena, and the users should stop using the service.

Additional VPN Providers 

1. https://www.ivpn.net/resources/canary.txt
2. https://www.bolehvpn.net/canary.txt
3. https://www.ipredator.se/static/downloads/canary.txt

Additional VPN Providers

• Warrant Canary FAQs
• A list of companies that maintain warrant canaries.
• Bruce Schneier, an internationally renowned security technologist, criticizes warrant canaries in an article on his blog.

Recommended Browsers

---

Make Sure Your Browser Is Not Leaving Fingerprints As You Browse The Web.

---

Visit Panopticlick.eff.orgThere are two ways to prevent your browser from uniquely identifying you. The first way is to make your browser send the same type of information that most other browsers are sending so that you cannot be uniquely identified. To do this you should have the same fonts, plugins, and extensions as most people have on their browsers. If your browser allows it, you should use a spoofed user agent string to make your browser identify as something else. You should disable DNT and enable WebGL like the majority of web users. If you disable Javascript, or use Linux or TBB, your browser will identify you as unique and make it easy to identify you.

An easier way to keep your browser from uniquely identifying you is to use plugins like Privacy Badger, uBlock Origin, and Disconnect. These plugins will help you to keep your identity private.

Additional Information About Browser Fingerprinting

Make Sure Your Browser Is Not Leaving Fingerprints As You Browse The Web.

---

While software like NoScript prevents this, it’s probably a good idea to block this protocol directly as well, just to be safe

How to disable WebRTC in Firefox?

In short: Set “media.peerconnection.enabled” to “false” in “about:config”.

Explained:

1. Enter “about:config” in the firefox address bar and press enter.
2. Press the button “I’ll be careful, I promise!”
3. Search for “media.peerconnection.enabled”
4. Double click the entry, the column “Value” should now be “false”
5. Done. Do the WebRTC leak test again.
   If you want to make sure every single WebRTC related setting is really disabled change these settings:
   • media.peerconnection.turn.disable = true
   • media.peerconnection.use_document_iceservers = false
   • media.peerconnection.video.enabled = false
   • media.peerconnection.identity.timeout = 1

Now you can be 100% sure WebRTC is disabled.

How to disable WebRTC in Google Chrome.

It is not possible to completely disable WebRTC in Chrome, but you can prevent leaks by changing Chrome’s routing settings. Two open source extensions to help you do this are WebRTC Leak Prevent and uBlock Origin. With WebRTC Leak Prevent you will need to check the options and adjust them as needed for your situation. With uBlock Origin, you need to go to “Settings” and select “Prevent WebRTC from leaking local IP addresses.”

How to disable WebRTC in Chrome on iOS, Internet Explorer, or Safari.[

Chrome on iOS, Internet Explorer, and Safari do not use the WebRTC protocol at this time. Our recommendation is that you use Firefox on all of your devices.

Firefox: Privacy Related “about:config” Tweaks

---

Privacy Badger

uBlock Origin

Cookie AutoDelete

HTTPS Everywhere

Decentraleyes

This add-on comes with several commonly used files, and when your browser needs to access one of them, Decentraleyes will load it locally, which prevents your browser from making a call externally for the file, and at the same time protects your privacy. Decentraleyes is compatible with content blockers like uBlock Origin and Adblock Plus. It is available for Firefox. Source code available at GitHub.

uMatrix

NoScript Security Suite

Recommended Firefox Add-ons For Protecting Your Privacy

---

Getting started

1. Enter “about:config” in the firefox address bar and press enter.
2. Press the button “I’ll be careful, I promise!”
3. Follow the instructions below…

Preparation:

1. privacy.firstparty.isolate = true
   • A result of the Tor Uplift effort, this preference isolates all browser identifier sources (e.g. cookies) to the first party domain, with the goal of preventing tracking across different domains.
2. privacy.resistFingerprinting = true
   • A result of the Tor Uplift effort, this preference makes Firefox more resistant to browser fingerprinting.
3. privacy.trackingprotection.enabled = true
   • This is Mozilla’s new built in tracking protection. It uses Disconnect.me filter list, which is redundant if you are already using uBlock Origin 3rd party filters, therefore you should set it to false if you are using the add-on functionalities.
4. browser.cache.offline.enable = false
   • Disables offline cache.
5. browser.safebrowsing.malware.enabled = false
   • Disable Google Safe Browsing malware checks. Security risk, but privacy improvement.
6. browser.safebrowsing.phishing.enabled = false
   • Disable Google Safe Browsing and phishing protection. Security risk, but privacy improvement.
7. browser.send_pings = false
   • The attribute would be useful for letting websites track visitors’ clicks.
8. browser.sessionstore.max_tabs_undo = 0
   • Even with Firefox set to not remember history, your closed tabs are stored temporarily at Menu -> History -> Recently Closed Tabs.
9. browser.urlbar.speculativeConnect.enabled = false
   • Disable preloading of autocomplete URLs. Firefox preloads URLs that autocomplete when a user types into the address bar, which is a concern if URLs are suggested that the user does not want to connect to. Source
10. dom.battery.enabled = false
    • Website owners can track the battery status of your device. Source
11. dom.event.clipboardevents.enabled = false
    • Disable that websites can get notifications if you copy, paste, or cut something from a web page, and it lets them know which part of the page had been selected.
12. geo.enabled = false
    • Disables geolocation.
13. media.navigator.enabled = false
    • Websites can track the microphone and camera status of your device.
14. network.cookie.cookieBehavior = 1
    • Disable cookies
    • 0 = Accept all cookies by default
    • 1 = Only accept from the originating site (block third party cookies)
    • 2 = Block all cookies by default
15. network.cookie.lifetimePolicy = 2
    • cookies are deleted at the end of the session
    • 0 = Accept cookies normally
    • 1 = Prompt for each cookie
    • 2 = Accept for current session only
    • 3 = Accept for N days
16. network.http.referer.trimmingPolicy = 2
    • Send only the scheme, host, and port in the Referer header
    • 0 = Send the full URL in the Referer header
    • 1 = Send the URL without its query string in the Referer header
    • 2 = Send only the scheme, host, and port in the Referer header
17. network.http.referer.XOriginPolicy = 2
    • Only send Referer header when the full hostnames match. (Note: if you notice significant breakage, you might try 1 combined with an XOriginTrimmingPolicy tweak below.) Source
    • 0 = Send Referer in all cases
    • 1 = Send Referer to same eTLD sites
    • 2 = Send Referer only when the full hostnames match
18. network.http.referer.XOriginTrimmingPolicy = 2
    • When sending Referer across origins, only send scheme, host, and port in the Referer header of cross-origin requests. Source
    • 0 = Send full url in Referer
    • 1 = Send url without query string in Referer
    • 2 = Only send scheme, host, and port in Referer
19. webgl.disabled = true
    • WebGL is a potential security risk. Source

Related Information:

• ffprofile.com – Helps you to create a Firefox profile with the defaults you like.
• mozillazine.org – Security and privacy-related preferences.
• user.js Firefox hardening stuff – This is a user.js configuration file for Mozilla Firefox that’s supposed to harden Firefox’s settings and make it more secure.
• Privacy Settings – A Firefox addon to alter built-in privacy settings easily with a toolbar panel.

Privacy-Conscious Email Providers – No Affiliates

---

Another Email Service Provider You May Be Interested In

• Confidant Mail – Confidant Mail is a non-SMTP encrypted email system. It uses GNU Privacy guard to encrypt and authenticate communications, and TLS 1.2 to encrypt transport. Your private key stays with you, not the Confidant Mail server. This provides much more security for you than SMTP based email systems. Confidant Mail is available for Windows, macOS, and Linux. https://www.confidantmail.org/

Host Your Own Email Service

Mail-in-a-Box allows you to take total control of your email by enabling you to operate your own mail server. To set up Mail-in-a-Box you will need a cloud-based server with at least 1 GB of RAM running Ubuntu 14.04 and your own domain name. For more information visit https://mailinabox.email/

Additional Resources To Help You Keep Your Email Private

• gpg4usb.org – a free, open source, portable text editor that enables you to encrypt and decrypt text messages and files.
• Mailvelope – a browser extension for Chrome and Firefox that enables the user to encrypt email sent through services like Gmail, Yahoo mail, and Outlook. It encrypts messages using OpenPGP.
• Enigmail – an add-on for Thunderbird and SeaMonkey. It uses OpenPGP for encryption, decryption, digital signatures, and verification of email messages.
• TorBirdy – an extension that enables Thunderbird users to connect to the Tor network.
• Email Privacy Tester – This tool runs several tests to see if your email client is compromising your privacy.

Links to Articles about Email Privacy

• If your email messages are stored in the cloud, they may not be as private as you think. The Electronic Communications Privacy Act (ECPA), which at one time protected the privacy of email messages stored on servers, has not kept pace with technology. Email that has been stored on a server for longer than six months is considered abandoned and the government can search it. This article takes a look at how this affects the privacy of your data when it is stored in the cloud.
• [OpenMailBox link not pulling up]
  
• FBI seizes server of progressive ISP – An update to the FBI seizure of a server from May First/People Link and Riseup.
  
• Police investigation causes server to become compromised – the Italian Postal Police used an investigation into one mailbox to spy on all communications going through the Autistici/Inventati server.

Recommended Email Clients

---

Links to Articles about Email Privacy

Alternatives to Email

---

Search Engines That Respect Your Privacy

---

An Extension For Firefox That Protects Privacy

• Google search link fix – an open source addon that prevents Google and Yandex from changing the URLs of your search results when you click them. By disabling this behavior, this addon also prevents these search engines from tracking your clicks. Google search link fix is available for Firefox, Chrome, and Opera. (Open Source)

Other Search Engines With Privacy Features

• Qwant – Qwant is a search engine based in France. Qwant protects the privacy of its users by encrypting their search queries and by not tracking them or recording their searches.
• MetaGer – MetaGer is an open source search engine based in Germany. To protect the privacy of its users, MetaGer doesn’t save IP addresses, doesn’t track its users, encrypts data transmission, and offers a proxy server so that search results can be viewed anonymously.
• ixquick.eu – ixquick.eu is a metasearch engine that excludes results from Google and Yahoo. It is maintained by the same company that runs Startpage.com. It offers results by proxy and does not record information about you or place cookies in your browser.

Instant Messengers with Encryption

---

Other Instant Messaging Services With Privacy Features

Additional information about Encrypted Instant Messengers

• Ricochet passes professional security audit and demonstrates that they are serious about security.
• How to communicate online without being watched or tracked.
• A link to download the Signal APK if you are an advanced user with special needs. Not recommended for regular users.
• Wire stores a list of all customer contacts until the customer account has been deleted.
• An audit demonstrates that the Telegram messaging app is not IND-CCA secure.
• A reddit discussion thread about Telegram and whether or not it is actually private as advertised.

Video and Voice Messengers with Encryption

---

Other Video and Voice Messaging Services With Privacy Features

Articles and Links with additional information about Encrypted Voice and Video Messengers

File Sharing Services with Privacy Features

---

Cloud Storage Services with Privacy Features

---

Another Cloud Storage Service To Consider

• Muonium – Muonium is a free, open source cloud storage provider that offers anonymity and end-to-end encryption for your files.

Additional Information

• Cryptomator – a simple, free, open source file storage application that enables you to encrypt file content and names with AES. Available for Windows, macOS, Linux, Android, and iOS
• Top NBN Plans – Although slightly unrelated, this is a guide to the best NBN providers in Australia. I compared them by speed and privacy features as some ISPs are known to actively sell customer data.

Applications That Let You Host Your Own Cloud Server

---

Additional Information

• NextCloud – NextCloud is a file storage application that allows its users to securely store their data at home, on a server of their choice, or with one of NextCloud’s service providers. NextCloud is free and open source.
• Muonium – Muonium is a free, open source cloud storage provider that offers anonymity and end-to-end encryption for your files.
• Web Hosting Reviews – We looked at the top hosting companies and compared them based on speed and security.

File Syncing Applications with Privacy Features

---

Other Cloud Server Applications with Privacy Features

• git-annex – git-annex is a command line application that allows you to synchronize your files with git. If you are uncomfortable with using the command line, you can use git-annex assistant which comes bundled with git-annex.

Password Management Applications

---

Other Password Management Applications

• Secure Password Generator – An online tool that generates strong and random passwords. All password generation is done in the browser.
• Strong Password Generator – a free, open source password generator that runs in your browser. It generators strong, secure passwords quickly and easily. Your passwords are never stored or transmitted.
• Password Safe – a free, open source password application that let you manage your existing passwords and generate new passwords according to your own rules. With Password Safe, you store your passwords in one or several encrypted databases. Designed with love by security expert Bruce Schneier, we strongly recommend using PW Safe if you want to support the open source privacy tools movement.

Additional Information About Password Generation

• John Oliver of Late Week Tonight and Edward Snowden discuss passwords (Youtube).

International Laws Regarding Key Disclosure

---

Links related to Key Disclosure Laws

Key disclosure laws determine the conditions under which an individual is compelled to give encryption keys to law enforcement officials. The laws differ in each country, but most countries require a warrant. Steganography and data encryption methods that ensure plausible deniability are two of the ways that individuals can use to defend themselves against key disclosure laws.

Steganography refers to hiding one message, image, or file inside of another message, image, or file. For the purposes of our context, the message being hidden is usually one that contains encrypted information. To ensure plausible deniability, the message that is hidden would have to be encrypted in such a way as to prevent an adversary from being able to prove that the hidden message exists.

Nations that have Key disclosure laws

1. Antigua and Barbuda
2. Australia
3. Canada
4. France
5. India
6. Norway
7. South Africa
8. United Kingdom

Nations where Key disclosure laws may or may not apply

1. Belgium *
2. Finland *
3. New Zealand (unclear)
4. Sweden (proposed)
5. The Netherlands *
6. United States (see related information)

Nations where Key disclosure laws do not apply

1. Czech Republic
2. Poland

Links to Additional File Encryption Services

• An in-depth look at Key disclosure laws from Wikipedia.
• Answers to a question about key disclosure laws at Law Stack Exchange.
• Maria Hoffman, Senior Staff Attorney for the Electronic Frontier Foundation, speaks about key disclosure laws and forced decryption at DEFCON 20.

File Encryption Applications

---

Links to Additional File Encryption Services

• Cryptomator – a simple, free, open source file storage application that enables you to encrypt file content and names with AES.
• miniLock – an audited, peer-reviewed file encryption addon for Google Chrome and Chromium.
• AES Crypt – a file encryption application based on the Advanced Encryption Standard. It is simple to use and after installation it only requires clicking on a file and entering a password to use. Available for Windows, Mac, Linux and Android.
• DiskCryptor – an open source file encryption application that can be used to encrypt some or all disk partitions on a disk drive. Supports AES, Twofish, and Serpent. Runs on Windows.

Networks Outside of the Surface Web

---

Links to Additional Networks Outside of the Surface Web

• ZeroNet – A peer to peer network using the BitTorrent network and Bitcoin cryptography.
• Retroshare – free, open source software that allows the user to create a secure, anonymous, and decentralized network to send encrypted communications.
• GNUnet – a suite of tools and applications for building decentralized applications that protect privacy.
• IPFS – a peer-to-peer file distribution system. The goal of IPFS is to replace HTTP and make the internet more efficient and cost effective. [Link to privacy warning].

Networks Outside of the Surface Web

---

A Link to an Additional Decentralized Social Network

• Mastodon – a free, open source, decentralized social network. It is based on GNU Social.

Additional Information about Social Networks

Domain Name Services for Greater Security

---

Links to Additional Domain Name Services

• NoTrack – NoTrack is a DNS server that protects your privacy by overriding tracking requests from over 10,000 tracking domains. It can also be used to block ads. Available for Linux.
• NameCoin – NameCoin is a free and open source application based on bitcoin that powers the .bit TLD.

Secure Note Taking Applications

---

Link to an Additional Secure Note Taking Application

• Paperwork – a free, open source note taking application. To use it you need a server with Linux, Apache, MySQL and PHP.

Secure Note Taking Applications

---

Links to Additional Secure Pastebins

• Disroot – Disroot offers a suite of secure services including a PrivateBin pastebin.
• Hastebin – Hastebin is an open source pastebin application. You can use it on the web, or download the code and run it on your own server.

Productivity Tools

---

Links to Additional Productivity Tools

• Disroot – Disroot offers a suite of secure services including Etherpad and EtherCalc.
• Dudle – A free, online polling and scheduling application. It doesn’t require registration to use.

Security Enhanced Operating Systems

---

Warning

Links to Additional Operating Systems

• OpenBSD – a free operating system based in Canada that was designed to resemble UNIX. The goal of the developers is to be number one in security. Cryptography is embedded in several places in the OpenBSD OS. In addition, they have a security auditing team which has been auditing OpenBSD since 1996.
• Arch Linux – Arch Linux was designed to be the do-it-yourselfer’s version of Linux. The default installation contains only what is needed to operate the OS, and the user can modify it as needed. Parabola is a free, open source OS derived from Arch Linux.
• Whonix – Whonix is a free operating system based on Tor and Debian GNU/Linux. It was designed for security and privacy and accomplishes this by using the Tor network and an architecture that uses virtual machines.
• Subgraph OS – Subgraph was designed to be easy to use but difficult to attack. It comes with a kernel hardened with Grsecurity, it requires users to have encrypted filesystems, it restricts applications so that they only use the Tor network, and it comes with a secure instant messaging and a secure email client. Subgraph is based on Debian GNU/Linux.

OWASP’s 10 Most Critical IoT Vulnerabilities

1. Weak, Guessable, or Hardcoded Passwords – Use of easily brute-forced, publicly available, or unchangeable credentials, including backdoors in firmware or client software that grants unauthorized access to deployed systems.
2. Insecure Network Services – Unneeded or insecure network services running on the device itself, especially those exposed to the internet, that compromise the confidentiality, integrity/authenticity, or availability of information or allow unauthorized remote control…
3. Insecure Ecosystem Interfaces – Insecure web, backend API, cloud, or mobile interfaces in the ecosystem outside of the device that allows compromise of the device or its related components. Common issues include a lack of authentication/authorization, lacking or weak encryption, and a lack of input and output filtering.
4. Lack of Secure Update Mechanism – Lack of ability to securely update the device. This includes lack of firmware validation on device, lack of secure delivery (un-encrypted in transit), lack of anti-rollback mechanisms, and lack of notifications of security changes due to updates.
5. Use of Insecure or Outdated Components – Use of deprecated or insecure software components/libraries that could allow the device to be compromised. This includes insecure customization of operating system platforms, and the use of third-party software or hardware components from a compromised supply chain.
6. Insufficient Privacy Protection – User’s personal information stored on the device or in the ecosystem that is used insecurely, improperly, or without permission.
7. Insecure Data Transfer and Storage – Lack of encryption or access control of sensitive data anywhere within the ecosystem, including at rest, in transit, or during processing.
8. Lack of Device Management – Lack of security support on devices deployed in production, including asset management, update management, secure decommissioning, systems monitoring, and response capabilities.
9. Insecure Default Settings – Devices or systems shipped with insecure default settings or lack the ability to make the system more secure by restricting operators from modifying configurations.
10. Lack of Physical Hardening – Lack of physical hardening measures, allowing potential attackers to gain sensitive information that can help in a future remote attack or take local control of the device.

Privacy Enhanced Live Operating Systems

---

A Link to an Additional Live Operating System

• Tiny Core Linux – Tiny Core is a live operating system designed to be tiny. Tiny Core is based on Linux. It is 10 megabytes and does not ship with end user applications.

Privacy Enhanced Mobile Operating Systems

---

Links to Additional Mobile Operating Systems

• Replicant – a mobile operating system that is a modification of LineageOS and that had been designed with extra security and privacy features.
• OmniROM – a free mobile operating system designed to be an alternative to Android.
• MicroG – A collection of software programs designed to replace Google’s Android apps and libraries.

Open Source Router Applications

---

Links to Other Open Source Router Applications

• OpenBSD – a free operating system based in Canada that was designed to resemble UNIX. OpenBSD runs on Ubiquiti Networks EdgeRouters.
• DD-WRT – free and open source firmware developed for several IEEE 802.11a/b/g/h/n wireless routers. DD-WRT does not require product activation and does not include tracking.

Open Source Router Applications

---

1. Windows 10 includes data syncing by default. This includes:
   • your browsing history, URLs you have typed, your favorites.
   • our app settings
   • Wifi hotspot names and your passwords for them.
2. Windows 10 tags your device with a unique advertising ID. This setting is on by default.
   • The unique ID is used to serve customized advertising to you.
3. By default, Cortana, the virtual assistant that comes with Windows 10, is learning about you. It does this by collecting information about you such as:
   • your search history
   • your mic input
   • your calendar entries
   • your purchase history
   • your credit card data
   • your music preferences
   • your keyboard stroke patterns
4. According to Microsoft’s own privacy statement, the following types of data may be collected when you interact with a Microsoft product:
   • your identity
   • your passwords
   • your demographics
   • your interests
   • your device and usage data
   • your content
   • your location
   • your contacts and people you are connected to
5. Microsoft can share your data with or without your consent.
   • When you download Windows 10, you are giving Microsoft permission to share your data with any third party “with your consent or as necessary…”

Information and links to help you protect your privacy even if you use Windows 10.

• WindowsSpyBlocker – an open source application to stop Windows from tracking and spying on you.
• Windows 10 Privacy Tools – a link to an article at ghacks.net reviewing privacy tools for Windows 10.
• A guide for fixing the settings in Windows 10 so that you can maintain some privacy – from fix10.isleaked.com.
• A guide for adjusting the default settings in Windows 10 so that your privacy is respected – from arstechnica.com
• A guide for turning off data logging in Windows 10 – from reddit.

Links to articles that discuss how Windows 10 is violating your privacy.

• Adjusting the privacy settings does not stop Windows 10 from spying on you. – the Hacker News
• Windows 10 continues to violate the privacy of users that have disabled its data collection features. – Ars Technica.
• Microsoft’s terms of service give it permission to disable software and hardware that it has determined is unauthorized. – Techdirt

Quotes

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”

－Edward Snowden on reddit

“But just as the Internet has opened up the world for each and every one of us, it has also opened up each and every one of us to the world. And increasingly, the price we’re being asked to pay for all of this connectedness is our privacy. Today, what many of us would love to believe is that the Internet is a private place; it’s not. And with every click of the mouse and every touch of the screen, we are like Hansel and Gretel leaving breadcrumbs of our personal information everywhere we travel through the digital woods. We are leaving our birthdays, our places of residence, our interests and preferences, our relationships, our financial histories, and on and on it goes.”

Gary Kovacs at TED2012

“Privacy is one of the biggest problems in this new electronic age. At the heart of the Internet culture is a force that wants to find out everything about you. And once it has found out everything about you and two hundred million others, that’s a very valuable asset, and people will be tempted to trade and do commerce with that asset. This wasn’t the information that people were thinking of when they called this the information age.”

Andy Grove

Links to Recommended Resources on Privacy

---

Guides

• Protect Yourself from Surveillance – a guide from the Electronic Frontier Foundation containing tutorials, overviews, and briefings on how to protect yourself from electronic spying.
• CryptoPaper – a documented collection of the thoughts, knowledge, and experiences on the subject of security, privacy, and anonymity from Crypto | Seb
• Email Encryption – a guide from the Free Software Foundation on how to encrypt your email.
• A Guide to Staying Private Online – an article by Douglas Crawford at BestVPN
• A Guide to Internet Privacy – a series of privacy guides from IVPN.

Information

• Security Now! – a weekly podcast covering personal computer security.
• TechSNAP – a weekly podcast covering systems, networking, and administration topics for people in the tech industry.
• Keybase.io – a free, open source security app for mobile and desktop devices. It is similar to Slack, but it provides end-to-end encryption.
• Freedom.press – Freedom of the Press Foundation is an organization that supports journalists and whistleblowers all over the world.
• Secure Australian Credit Cards – Although definitely not open source, my guide to the best Australian credit cards discussing the cards with the best history of financial security and protecting customer data.
• Erfahrungen.com – a site that reviews privacy related services. The site is in German.
• TOSDR.org – a service that rates and summarizes the Terms of Service for various sites on the web.
• ipleak.net – web based tools that show you your IP addresses, your DNS address, your location, your system information, and other bits of data that are being collected about you.
• Privacy Testing Tools – The folks at ghacks.net have put together a list of tools that you can use to test your privacy.
• Prism-Break.org – A directory of resources for protecting your privacy online.
• SecurityinaBox.org – a guide to online privacy for human rights advocates.
• AlternativeTo.net – a database of over 64,000 software applications listed as alternatives to mainstream applications. Users get to rate the applications and leave reviews.
• SecureDrop.org – an encrypted, open-source system that whistleblowers can use to submit information to the media anonymously. SecureDrop is a project of the Freedom of the Press Foundation.
• Privacy Pack – A collection of links to tools to help you maintain your privacy and security online.
  [The website hosting Security First returns a 404 error]
• Best Web Hosting – Best hosting has consistently been a security risk for small business websites. This guide walks new buyers through the choices available to them.

---

You May Also Like:

• Best Free VPNs
• Best VPNs for Netflix
• Best Home Security Systems
• Best Free Antivirus Software