Privacy and Security Resources - Cypherpunk
Source
Guides
- Anonymous Planet 108 [Tor 1] - a community contributed online guide to anonymity written for activists, journalists, scientists, lawyers, whistle-blowers, and good people being oppressed, censored, harassed anywhere
- Privacy Guides 42 [Tor 2] - a non-profit, socially motivated website that provides information for protecting your data security and privacy
- Extreme Privacy 4th Edition 51 - Michael Bazzell has helped hundreds of celebrities, billionaires, and everyday citizens disappear completely from public view.
- Nihilism Network 23 [Tor] - ultimately, this blog aims to showcase that technology, when used correctly, can allow one to transcend any limitation. be it to transcend surveillance, centralisation, deanonymization, lack of security. any ability that we have as humans, such as privacy, decentralisation, anonymity, security, plausible deniability can be protected and enhanced by using the correct technology.
- Anonymous Land 18 - a community dedicated to providing anonymity enhancing guides and services
- No Trace Project 33 [Tor] - no trace, no case. a collection of tools to help anarchists and other rebels understand the capabilities of their enemies, undermine surveillance efforts, and ultimately act without getting caught
- Qubes OS for Anarchists 20 [Tor 1] - Qubes OS is a security-oriented operating system (OS), which means it is an operating system designed from the ground up to be more difficult to hack. Given that anarchists are regularly targeted for hacking in repressive investigations, Qubes OS is an excellent choice
- GrapheneOS for Anarchists 29 - [Tor] - anarchists should not have phones. if you must use a phone, make it as difficult as possible for an adversary to geotrack it, intercept its messages, or hack it. this means using grapheneos
- Tails for Anarchists 4 [Tor 1] - tails is an operating system that makes anonymous computer use accessible to everyone. tails is designed to leave no trace of your activity on your computer unless you explicitly configure it to save specific data
- Tails Opsec for Anarchists 4 [Tor] - additional precautions you can take that are relevant to an anarchist threat model - operational security for tails
- Make Your Electronics Tamper-Evident 15 [Tor 1] - if the police ever have physical access to an electronic device like a laptop, even for five minutes, they can install hardware keyloggers, create images of the storage media, or otherwise trivially compromise it at the hardware, firmware, or software level. one way to minimize this risk is to make it tamper-evident
- Encrypted Messaging for Anarchists 12 [Tor 2] - This article provides an overview and installation instructions for Tails, Qubes OS, and GrapheneOS encrypted messengers
- The Cop in Your Pocket: Your Phone’s Location is tracked at ALL times 11 [Tor 1] - your phone’s location is tracked at all times, and this data is harvested by private companies, allowing police to bypass laws requiring them to obtain a warrant
- Remove Identifying Metadata From Files 7 [Tor] - metadata is ‘data about data’ or ‘information about information’. in the context of files, this can mean information that is automatically embedded in the file, and this information can be used to deanonymize you
- Defending against Stylometric attacks 7 [Tor 1] - stylometric fingerprinting analyzes unique writing style (i.e., it uses stylometry) to identify the author of a work. it’s one of the most common techniques for de-anonymization, used by adversaries ranging from trolls to law enforcement
- Prism Break 8 - opt out of global data surveillance programs like prism, xkeyscore and tempora.
- The New Oil 9 [Tor 1] - the beginner’s guide to data privacy & cybersecurity
- Techlore 7 - a small team educating people about digital rights, privacy, security, digital control, and other important topics to push the world towards a safer internet
- Into the Crypt 10 [Tor] - the art of anti-forensics
- Advanced Privacy and Anonymity Using VMs, VPN’s, Tor 8 - a series of guides that explains how to obtain vastly greater freedom, privacy and anonymity through compartmentalization and isolation through nested chains of VPNs and Tor
- How to create anonymous Telegram and Signal accounts without a phone 25 - a guide for using Whonix & Anbox to create anonymous mobile accounts without a phone
- Security Tips & Devices for Digital Nomads 9 - various tools and gadgets for OpSec, written with a preference for practical usability
- Telegram Security Best Practices 13 - quick tips that will help you sleep better at night when using Telegram
- EFF Surveillance Self-Defense: The Basics 5 - surveillance self-defense is a digital security guide that teaches you how to assess your personal risk from online spying. it can help protect you from surveillance by those who might want to find out your secrets, from petty criminals to nation states
- EFF Surveillance Self-Defense: Tool Guides 5 - step-by-step tutorials to help you install and use handy privacy and security tools
- EFF Street Level Surveillance 1 - EFF’s street-level surveillance project shines a light on the surveillance technologies that law enforcement agencies routinely deploy in our communities
Android
Secure Messengers
- The Guide to Peer-to-Peer, Encryption, and Tor: New Communication Infrastructure for Anarchists 9 - an exhaustive anarchist overview and guide to various apps and tech that utilize peer-to-peer and encryption
- Secure Communications Comparison 4 - communicating securely over the internet is a must. this article compares available and actively-developed projects that are used for secure communications
- Signal Privacy Concerns (2019) 5 - arguments against the popular secure messenger signal
- A security analysis comparison between Signal, WhatsApp and Telegram [PDF] 4 - a security analysis comparison between the three popular instant messaging apps. The analysis will focus on the encryption protocols used by each app and the security features they offer
- Wire (and Signal) use privacy-hostile Amazon AWS - wire (and signal) are centralized on amazon’s aws… there are substantial privacy and ethical issues with this
- XMPP: An Under-appreciated Attack Surface 5 - a demonstration for why XMPP is of interest to penetration testers, security researchers, and defenders
- Wiretapping the largest Russian XMPP server 4 - xmpp (jabber) instant messaging protocol encrypted tls connection wiretapping (man-in-the-middle attack) of jabber[.]ru (aka xmpp[.]ru) service’s servers on hetzner and linode hosting providers in germany
- XMPP: Admin-in-the-middle 1 - in our opinion, you can’t refer to xmpp-based messaging as “privacy-friendly” as long as you don’t control all xmpp servers. an xmpp administrator (or any other server-side party) can inject arbitrary messages, modify address books, and log passwords in cleartext
- What a malicious Matrix homeserver admin can do 6 - potential passive and active attacks from malicious homeserver admins
- Matrix? No, thanks. 11 - matrix keeps growing. even the french government decided to use it. however, many free software activists refuse to use it
- Session’s Lack of Perfect Forward Security 5 - “we don’t have any current plans to reintroduce pfs”
- Matrix Metadata Leakage 1 - exactly what metadata Matrix leaks and why
- Matrix linked Amdocs found tapping South African cell phones 3 - south african agents wrote in a 2009 document that they suspected that israel’s secret service, mossad, was using israeli software giant amdocs to eavesdrop on mobile phone conversations and gather data
- Why Not Matrix? 14 - 22 reasons why not to use matrix
Desktop
Tor and VPNs
General
- Security and Privacy Advice 9 - security and privacy advice for desktop, mobile, browser, messengers, email, passwords, 2FA, and social media.
- Despite DoH and ESNI, with OCSP, web activity is insecure and not private 2 - how OCSP responses are a privacy nightmare
- Badness Enumeration 2 - why badness enumeration as a concept is flawed and some examples of its failings in practice
- The Six Dumbest Ideas in Computer Security 2 - default permit, badness enumeration, penetrate and patch, hacking is cool, educating users, action is better than inaction
- Threat Modeling 3 - the first task a person should do when taking steps to protect their privacy and security
- The right thing for the wrong reasons: FLOSS doesn’t imply security 1 - source unavailability doesn’t imply insecurity, and source availability doesn’t imply security
- FLOSS Security 3 - while source code is critical for user autonomy, it isn’t required to evaluate software security or understand run-time behavior
- Two types of privacy 1 - two main approaches to privacy: “tracking reduction” and “tracking evasion”
- Recovering redacted information from pixelated videos 1 - image/video blurring methods and their weaknesses
- Let’s Enhance! How we found @rogerkver’s $1,000 wallet obfuscated private key 2 - by overcoming blurring techniques
- Email (In)security 2 - email is an inherently insecure protocol, conceived at a time when security was an afterthought
Fingerprinting Articles
Fingerprinting Tests
- TorZillaPrint 6 - comprehensive, all-in-one, fingerprinting test suite
- No-JS fingerprinting 2 - demonstration of how fingerprinting can occur even in the absence of JavaScript
- CSS Fingerprint 1 - exploiting CSS to collect various characteristics about the visitor
- CreepJS 1 - creepy device and browser fingerprinting
- Kloak 4 - Kloak is a Keystroke Anonymization Tool
- AudioContext Fingerprint 2 - tests browser-fingerprinting using the AudioContext and Canvas API
- Available Fonts 1 - gets available fonts on browser without flash
- Browser Fingerprinting 1 - analysis of Bot Protection systems with available countermeasures
- BrowserLeaks 2 - a gallery of web technologies security testing tools
- Canvas Test - checks if the addon CanvasBlocker can be detected by websites
- CSS Exfil Vulnerability Tester - test to see if your browser is vulnerable to Cascading Style Sheets (CSS) data leakage
- Device Info 2 - a web browser security testing, privacy testing, and troubleshooting tool
- DNS Cookie Demonstration - uses DNS caches as a side-channel to identify related network flows
- EFF: Cover Your Tracks 1 - understand how easy it is to identify and track your browser based on how it appears to websites
- Epic Tracker - fingerprinting demo with some automated lookups using modern Javascript APIs
- Extension Fingerprints - detecting Chrome extensions by fetching web accessible resources
- Firefox Addon Detector 1 - tracking 400+ firefox addons through chrome:// URI trickery!
- Iphey 1 - Browser Fingerprinter
- Mouse Wheel Tracking Test 1 - fingerprint based on tracking your mouse’s wheel
- Nothing Private 2 - proof of concept to show any website can identify and track you
- PicassAuth - canvas fingerprinting
- Pixelscan - basically a bot check
- Privacy Check - this website aims to focus on each fingerprinting technique in detail
- scheme flooding 1 - this vulnerability uses information about installed apps on your computer to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN.
- SuperCookie 1 - uses favicons to assign a unique identifier to website visitors. this ID can be stored almost persistently and cannot be easily cleared by the user
- Webgl Fingerprinting - uses different techniques to recognize whether a browser extension is spoofing the webgl fingerprint
- Zardaxt.py 4 - TCP/IP fingerprinting for VPN and Proxy Detection
Surveillance Technology
- Ears and Eyes 5 - searchable database of cases of physical surveillance devices (microphones, cameras, location trackers) hidden by law enforcement and intelligence agencies to surveil people or groups engaged in subversive activities
- Bugged Planet 5 - a wiki about signals intelligence (SIGINT), communication intelligence (COMINT), tactical and strategical measures used to intercept communications and the vendors and governmental and private operators of this technology
- Harris: Wide Area Airborne Motion Imagery 1 - wide-area motion imagery offers persistent, real-time surveillance for enhanced situation awareness through an intelligent, airborne sensor system
- CRI LodeStar Wide Area Motion Imagery (WAMI) 3 - a demonstration of cri lodestar wide area motion imagery (wami) system
- Harris: Airborne Augmented Reality - video with augmented reality overlays enhances situation awareness for teams in the field, analysts and decision makers. overlays poi features, building names, and road names
- Harris: Locate GPS Jamming - harris signal sentry 1000 is a gps interference detection and geolocation solution. it provides a web-based visualization tool to support timely and effective actionable intelligence.
- Harris: Material Identification - harris material identification technology enables remote sensing systems to detect, identify and geolocate the presence of solid materials and gasses – on earth and in the atmosphere
- Elbit Systems / SPECTRO XR 1 - spectro xr integrates a wide range of digital imaging, high-definition optical sensors and advanced lasers, providing simultaneous multi-spectral observation capabilities and enabling ultra-long-range detection.
- Police thermal imaging finds cannabis factory 1 - It was a case of being caught red handed when the West Midlands Police helicopter found this cannabis factory using its thermal imaging camera
- The Stingray: How Law Enforcement Can Track Your Every Move 2 - a “cell site simulator” initially developed for military use, Stingrays have made their way into local police and sheriff’s departments around the country
- How Police Cameras Recognize and Track You 3 - wired spoke with several experts about the explosion of surveillance technology, how police use it, and what the dangers might be. as tech advances, street cameras can now employ facial recognition and even connect to the internet. what does this mean for the future of privacy?
- How China’s Surveillance Is Growing More Invasive 2 - analysis of over 100,000 government bidding documents found that China’s ambition to collect digital and biological data from its citizens is more expansive and invasive than previously known
- Homeland Security Uses AI Tool to Analyze Social Media of U.S. Citizens and Refugees 4 - babel x may provide to analysts a target’s name, date of birth, address, usernames, email address, phone number, social media content, images, IP address, Social Security number, driver’s license number, employment history, and location data based on geolocation tags and also cell phone gps tracking
Further Reading