The New Oil

I'm amused – and slightly sad – that as I began to do my research for this blog post, every result for a search of “tracking links” or “tracking URLs” returned the same thing: web-hosting and analytics companies giving a very benign overview of what they are and then explaining why everyone who owns a website should be using them. I shouldn't be surprised. Like most surveillance technologies, the proliferation of tracking links is aided by two main concepts: the first is that they provide a very useful trade off, and the second is that people don't really understand or consider the danger of the capabilities.

What are tracking links?

Tracking links or tracking URLs are hyperlinks that not only direct you to a website, but also record information about you when you click on them. These can appear in the form of shortened links, such as the common “bit.ly” service, or it can appear in the full link, usually beginning with a question mark or a slash then followed by a bunch of other information.

This is not to say that every shortened link contains tracking, although it's hard to tell without seeing the full link. Likewise, not every question mark or slash signals the beginning of tracking information. But they are the most common indicators.

What do they do?

Tracking links, as the name suggests, track information when you click on them. As a business owner, I understand the value of certain metrics. It's useful to know if the majority of your website visitors are coming from mobile or desktop so you know how much focus you need to give to making your site responsive. It could even be useful to know if they're specifically coming from Apple or Android devices in case you were developing an app and needed to know which to prioritize. For advertisers, knowing what site your visitors are coming from helps you know where your advertising is most effective.

However, as with most good technologies gone wrong, tracking links get so much more invasive than simple, useful metrics require. It's not uncommon for tracking links to be able to trace unique, personal information like IP address, MAC address, operating system down to which specific version or upgrade has been installed (ex: iOS 13.2). Some of them can even be used to track who sent the link, what time it was opened, other apps that are installed on the device, or websites that have been visited (this, I would imagine, involves the use of cookies stored on your device and therefore this becomes a coordinated effort from the tracking link). This is significantly more information than any website would need to know for metrics' sake, and it runs the high risk of identifying you personally in what's supposed to be anonymous data designed to help improve the site or service. Why does a recipe website need to know what other websites you've visited? What use does a clickbait article site have knowing the apps on the phone of the friend you shared the article with? It's a massive invasion of privacy.

Facebook's obnoxiously long tracking links

How can you avoid tracking links?

Thankfully, the easiest way to avoid tracking links on a desktop/laptop environment is to install uBlock Origin. The developer recently added a powerful tracking-link remover to the menus, which I explain how to enable here. However one should never rely solely on technology and should always know how to take matters into their own hands if necessary. (Also this solution isn't available for most mobile users.) The key giveaway is to look for the aforementioned questions marks and gibberish. A link that goes “https://www.website.com/article-title/gfm-feed-12456" probably doesn't need that last bit (“gfm-feed-12456”). I've found the most effective solution is to erase it and see if the link still works. If it does, congratulations! You've erased the tracking link and helped protect the privacy of both yourself and your friends! Same thing applies with question marks. “https://www.website.com/article-title.html?=feed-123456." Delete everything from the question mark on, and check the link. This does require you to learn how to read a link, but honestly it's not that hard. Usually key words from the title will appear in the link, and it's a safe bet that anything you don't recognize beyond “.html” is probably not required. It's also a good idea to check the link before sharing it. I've found as I post news links to The New Oil's Mastodon account that some websites have gibberish-looking parts of their URL that are actually necessary (Forbes comes to mind, their links tend to look something like “forbes.com/article-title/12356” but deleting the gibberish actually brings up a 404 error page).

Stripping tracking links will not negatively impact the necessary metrics of a website, and frankly it won't stop invasive data collection. Any owner interested in the analytics will still be able to tell who visits their site, what device, how long they stay, and a ton of other invasive information that quite frankly they don't need. But it will help to protect both your privacy and the privacy of those around you by removing small parts of the puzzle – the fact that you sent your friend to that site, for example, or other invasive information that helps corporations and governments create a more complete but unnecessary picture of you that can and usually does get abused. And the more we take conscious stands against this kind of stuff and show that we as consumers will no longer tolerate it, the less common it will become (hopefully).

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

I personally am indifferent to New Year’s demarcations. I can often be found on any given NYE at midnight sleeping soundly in my bed. That’s not to say I don’t care for them, I just don’t care about them. Having said that, I do think it’s important to set goals for one’s self, and the arbitrary (if necessary) line in the sand of “new year” seems like a good time to revisit that for anyone. As 2019 draws to a close, I am assessing the past year both personally and professionally – what worked, what didn’t, etc – and am planning what’s to come in the next twelve months. Once a month, I post asking for financial support on Liberapay for this project, and so in the interest of transparency I wanted to take just a moment to outline what my goals are for this project. I want those who do support me to know what I’m doing with their hard-earned money, and possibly entice those who are on the fence about supporting me. And as always, if you are unable to support financially, I am totally okay with that and appreciate simply interacting with my posts, sharing them, and similar free shows of support.

If I had to define 2019 for The New Oil in one word, I’d call it “successful.” I hate when people say things like “this project has gone beyond my wildest dreams” because we all know that’s not true. Even bands who keep their hopes in check have dreams of playing the Superbowl (or similar large-scale successes) and even I myself have similar dreams for the scope of this project. But I will say I am pleasantly surprised how fast I’ve grown, as well as the overwhelming outpouring of positive feedback and interaction I’ve received.

When I started this project, I had one goal in mind: I wanted to take privacy and security – particularly against digital surveillance of all kinds – and make it accessible to “normal” people – that is, people who aren’t programmers, system admins, tech enthusiasts, etc and make them realize that it’s not as hard as they think to take some basic-level protections. There’s tons of great resources out there, but it’s not accessible to people like my mom, my girlfriend, or my best friend. They don’t understand it, and they need a translator to explain it to them in terms they get. That’s what my goal was with this site.

When I started the project, I had the same dreams as anyone else, but I tempered them with realistic expectations: I expected a few followers, the occasional hater, and overall I assumed this would become a passion project with no real effect. Instead I was greeted with tons of positive feedback, from “great article” to “everyone check this guy out.” Just last month I got my first financial supporter on Liberapay and broke 100 followers on Mastodon. I’ve even got people asking me questions about my thoughts on things or how I recommend tackling certain issues.

I have to remember that I am still a small fish in a small pond. There are people who are much more knowledgeable about this stuff than I am. Honestly, I like it that way. Snowden once said that his biggest challenge in presenting mass surveillance to the public was how to take complex issues and explain them in a way that everyday people could grasp. By keeping myself out of the higher levels of technical skill, I force myself to understand things at a general-public level, which I think (or hope at least) helps me present these things to the general public in an understandable format.

In 2019, I think I successfully found a sustainable foundation for the site going forward. I formed a working solution for selecting and posting articles based on a criteria that keeps them mostly relevant to the site. I created a solution for posting blog posts weekly, thought that one really comes down to just being disciplined. I think I showed both myself and my supporters that I’m serious about this project.

In 2020, I want to expand. In the closing weeks of 2019, I took a leap and started my own home server. Right now I mainly use it for things like RocketChat and Nextcloud, but I also run a TOR bridge. This is something I’ve wanted to do for years, to do my part to support digital freedom. In the coming weeks I plan to add a second relay for regular TOR users. In the future, I’d like to run a PeerTube instance and maybe even a Mastodon instance, as Eugen has indicated that Mastodon is growing rapidly and needs more servers. I’m currently torn between buying my own server and renting a VPS through a provider. There are pros and cons to both, feel free to message me your thoughts that might help me make a decision. This is still some time off, for now I’ll stick to running to small, personal services on the old desktop tower under my desk. But I do hope to have a professional-grade server running more advanced services before the end of the year.

In addition, I hope to start hosting regular cryptoparties in my area. Cryptoparties are basically classes where you explain encryption and surveillance to folks and help them get set up with things like 2FA, encrypted messaging, VPNs, and other simple such services and concepts. There are a startling lack of them in my area, despite being a major tech town, and I want to remedy that. Ideally I’d like to do them once a month, but I think I may aim for once per quarter so I don't overload myself.

In 2020, I also hope to attract more financial support for this project. This will help me cover the obvious things like hosting costs, VPS services (if I go that route), hardware maintenance (if I go that route) and other related expenses. Any excess support would go to helping me cover my own bills like housing, transportation, and groceries. I’m not a materialistic person, I actually identify as a minimalist, so rest assured that any “excess support” is not going to paying for a new Lexus or an expensive house. It’s going towards a moderate apartment and a used Toyota, and maybe some frugally-executed vacations in the future. And also two cats. They’re not very expensive though.

In the long term, I hope to be able to travel and speak and more on this project, lending my help wherever possible. I’ve got a few EFF links I need to look into this weekend about signing petitions against facial recognition and such. I work closely with my local EFF chapter to help bring these subjects to the general public in my area. I would love to be more closely involved in these types of organizations wherever I can. I would love to educate wherever I can. I would love to offer services and solutions of my own, hence my desire to invest in servers.

The purpose of this post was partially to put my own thoughts in order, but also to express transparency and let you guys know what to expect from me in the coming year. Two goals are actually not much for me, as someone who’s constantly on the go. Today is supposed to be my day off, but in the four hours since I woke up I changed a small part on my car, rescheduled a doctor’s appointment, made an appointment for the cats to get their annual shots, wrote this blog, and checked into some payroll stuff at my day job, so I’m not really much of “day off” kind of person. I wish I had more goals for this project in 2020, so if you see room for improvement please don’t hesitate to message me and let me know. And also feel free to keep suggesting services and products for me to review and add to the site, I want visitors to have as many options as possible.

For those who supported me in 2019, thank you so much. You honestly do inspire me to keep going on days when it feels hopeless or meaningless. For those who are new to the site, thank you for joining and I hope it lives up to your expectations. For those considering supporting me financially, I hope this post has helped you make the choice either way by explaining what I hope to accomplish in the future. And for those who can’t do so, I hope you can support me by sharing the site, the articles, the blogs, or whatever else you find worthy of sharing, and I hope it helps make this important subject more accessible to the general public.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

The other day I found myself talking with some friends about privacy and security. I was sharing that my partner had recently jumped on board the privacy train with me. That may surprise some readers to know that I chose to involve myself so closely with someone who didn’t share my views, but I think that’s pretty in-keeping with the message of this site: you don’t have to draw lines in the sand all the time, sometimes you can make compromises, and it's all about making educated decisions. Until recently, my partner respected my use of Signal for daily communication and my use of a VPN on the home network. She even lets me do stuff like set up her Firefox browser for her and disable a lot of the telemetry on her computer. Basically as long as it didn’t inconvenience her too much, she didn’t mind. But then her boss casually informed her that corporate is able to read all communications sent over the company WiFi. I’m not sure how the subject came up, and needless to say this wasn’t exactly a new thing, but something about being told to her face by the company itself (more or less) really rattled her. That night, without any prodding from me, she downloaded a VPN on her phone, switched to ProtonMail, and invited all her coworkers to use Signal.

As I was regaling my friends with this story, one friend spouted his usual response that privacy enthusiasts the world over have become allergic to: “I don’t really care about that stuff, my work can read my texts, I have nothing to hide.” He wasn’t dismissing my partner’s choices or criticizing her, just stating that he personally couldn’t care less. I explained to him that while he may not care, “arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.” (Edward Snowden, 2015). Basically while he may not care, he should care for others. That friend, for example, is bisexual, and is very open about it. He makes no effort to hide it. I explained to him that while he should absolutely have the right to not care if his sexuality is a secret, someone else should have the right to care and hide it for any reason so they so choose, including but not limited to “it’s nobody’s damn business.”

My friend immediately agreed with me and respected that. “But,” he countered, “I don’t understand what I can do. How does my using Signal or a VPN help them?”

“Three ways,” I offered. “Herd Immunity, economics, and normalization.” (Originally I tried to divide these into bullet points in this post, but I found them to be too closely intertwined to do so meaningfully.)

Let’s take an example community of 100 people. Let’s pretend all of these people use encrypted messaging of one kind or another. Lately, in real life, the FBI and Interpol have both been making the claim that End-to-End Encryption allows for the proliferation of illegal activities such as drug dealing and pedophilia.

According to The Hamilton Project, which claims to offer statistics to help lawmakers make better-informed decisions regarding policy in the United States, drug arrests in the US accounted for only 1% of the population on average in 2015. A WorldAtlas article from 2018 lists the total number of sex offenders (not just pedophiles) in the United States as 747,408. If the population in the US in 2018 was estimated at about 327.876 million, then that means sex offenders account for less than a quarter of a percent of the population.

So let’s be generous with our imaginary community of 100 people. Let’s pretend that a whopping 5 percent of them are criminals – not just sex offenders and drug dealers, but all violent criminals (in the United States, violent criminals account for less than 1% of the population). That means there’s still 95 people – 95% of the population – who are perfectly normal, law-biding citizens who use encryption for any number of completely legal, valid reasons, like trading sensitive information (in another blog post, I talked about how I can send my partner the credit card number safely in case of an emergency), avoiding unwanted surveillance capitalism, or any other of millions of perfectly okay things. If only the criminals were using that encryption, then it would validate what those agencies are saying. So if everyone were to use encryption, it invalidates those claims. It goes from looking suspicious that you use encryption to it just being something everyone does. Everyone wears clothes in public, too, does that mean everyone who wears clothes is hiding a weapon? Or drugs? Of course not. No agency would ever publicly state that we need to ban clothes because criminals use them to smuggle illegal goods, even though such a claim is rooted in a fact. Nobody ever says we need to ban airplane luggage because criminals sometimes sneak bombs in on them. We all know that privacy comes with risks, but we also know that as a general rule, criminals are a minority and just because some people are doing bad things doesn’t mean everyone else gets stripped of their rights. So why should you care about your privacy even if you have nothing to hide? Because it normalizes it. When everyone is using encryption, nobody looks weird for doing so. It goes from “what are you hiding?” to “of course you are.” Nobody ever looks at me suspiciously in public for locking my phone when I’m not using it, and nobody should be looked at suspiciously for digitally securing their public lives. This is normalization. When we all take basic, effective measures to protect our privacy, we stop looking crazy or suspicious. We normalize it.

Most of you reading this are likely familiar with the “anti-vax movement,” the belief that children shouldn’t be vaccinated for diseases like measles and mumps for a variety of reasons. This is a controversial opinion for many reasons, and I’m not going to get into it on this site so don’t bother contacting me about it. I mention it because of one specific argument that medical experts cite, called “herd immunity.” Basically, there are some people who cannot be vaccinated for safety reasons, such as a severe allergic reaction or complication to the ingredients in the shots, particularly among children and elderly. So the experts argue that the more people who get vaccinated who are able to, the less likely those diseases are to spread, and it protects the unvaccinated just as effectively. Basically, the whole herd is immune, so the one person who isn’t has such a low chance of encountering the disease that they’re essentially safe as well.

A threat on par with government surveillance is corporate surveillance (partially because the government has access to that information, and partially because it’s actually more invasive and effective than government surveillance, as is usually the case with these types of things). This surveillance is fueled not by the desire for control but for money (which inadvertently becomes about controlling you to make you spend money, but that's a blog post for another day). Corporations are trying to build the most accurate picture of you so they can sell you things. They don’t want to waste the money showing you fifty ads that may or may not convince you to buy a product or service, they want to spend money once to show an ad that will definitely make you buy a product or service. In order to do that, they need to know as much about you as possible. They need to know your hobbies, interests, which devices you’re watching on, what times you watch, what motivates you to spend money on something, and more. The biggest threat with this, as I said, is that it can be abused by anyone from state agencies to Facebook. So that’s another layer of reasoning to protect yourself from “surveillance capitalism,” as it’s called.

In the previous section, I argued that everyone should use encryption because it protects the people who actually need it. In this section, it protects the people who can’t. A popular notion in the privacy community is to delete Facebook. Really all social media, but Facebook especially. They are, by far, the most egregious offender in this realm. But for some people, that’s not always an option. Early in my career I worked a job where work was conducted via a secret Facebook group – schedules posted, bulletins to other technicians, etc. Not using Facebook wasn’t an option if I wanted that job, and since I was early in my career I needed any job I could get.

Going back to our 100-person community, let’s say 5 people can’t use encryption for whatever reason. Their phones are old and don’t support the option, the people they do business with can’t support the protocols for it, whatever one of a million valid reasons. If 95 people are using encryption, it stops making financial sense for corporations to keep sucking up all that data. The data – previously unencrypted, revealing, and useful – has become encrypted, unreadable, and useless. After a while, it becomes a financial loss to keep pouring so much funding into projects to scoop up all this data and get almost nothing from it, so they stop. After a while, that means even unprotected people are now protected because nobody is watching. This is both herd immunity and the economic angle. Herd immunity has protected the few who can’t participate, and the proliferation of security has made surveillance uneconomical.

Maybe you have nothing to hide (first off, that’s a blatant misconception: we all have things to hide whether it’s our bank accounts or access to our homes or cars or whatever). Even if you don’t, it’s selfish to assume that nobody else does, and while it may not seem as effective as going to a protest or becoming a hacker, even simple things like the products, services, and techniques shared on this site can add up and create a larger change, often at little or no expense to your own convenience or lifestyle. So I recommend you implement as much of this as you can, if not for yourself than for others.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

In my time in the privacy community, I’ve noticed a prevailing myth. Sometimes this myth is brought in by newbies who have a preconceived notion. Sometimes it is inadvertently (or intentionally) perpetuated by hardcore privacy enthusiasts. But in short, the myth is the idea that privacy is a binary thing, an all-or-nothing game, go big or go home, start building your cabin in the woods or don’t even bother using two-factor authentication. Quite frankly, this is a crock of garbage.

Privacy and security are often sliding scales. It’s rarely a binary yes or no, but rather a spectrum. Very few people are 100% secure or 0% secure. If you use a password – any type of password, even “password” or “admin” – that’s a level of security above just having an open account or document. But that’s a poor level of security against a password such as “(z”a8j#;uU$>s!;–;6!G”. That’s a far better password with far better security. But even that’s only 20 characters, and can be improved. It’s almost always a spectrum.

Most of us, by default and the way we were raised, tend to fall on the “less secure” end of the spectrum. We use easily remembered – and therefore easily guessed or hacked – passwords. We don’t use 2FA. We use Google Search and Google Calendar and Gmail.

The goal of my website, as I’ve said before, is to nudge you to the “more secure” side of the spectrum. It actually doesn’t take much to get there. Using 2FA, password managers, and similar techniques discussed on this site will actually move you considerably far on the spectrum. Because the thing is, the spectrum is relative. If we have a group of 100 people and 90 of them aren’t using 2FA but you do, that automatically puts you in the top 10% of the “most secure” spectrum. If the other 90 people add 2FA, the bar has been raised. Sadly a lot of the techniques I share on this site aren’t being used by the majority of people, so just doing these basic things dramatically moves you along the spectrum.

Now I do want it to be noted that where you need to be on that spectrum depends heavily on your threat model. So while Person A’s threat model may be as simple as 2FA and a VPN, Person B might have need of secure messaging and even extra protection against location tracking. Person C might opt to not even have a phone and live in an apartment rented in cash or a shell corporation (totally legal, I assure you). It’s different for each person.

I encourage you to go as far as you can and do as much as you can for the sake of herd immunity. If everyone uses encrypted messaging or a VPN, then it doesn’t stand out and look suspicious, and it makes reading the traffic uneconomical for the companies who do it. But at the end of the day, you’re still doing something even if you only do a little bit. Some people – including your own doubts – might lead you to believe that if you aren’t going whole-hog – deleting Facebook, deleting Google, and hosting your own email server – then you aren’t doing enough. Those are certainly great things to do if you can, but honestly don’t listen to those people. If you eat two dozen donuts every day for breakfast and suddenly decide to cut down to one dozen, you’ve still made a difference. It may not be enough to run a marathon and you'll probably still have some health problems, but it’s certainly better than eating two dozen and it may even be the first step towards a healthier lifestyle in the long run. Don’t let anyone make you feel bad for not going as hardcore as them. It’s a journey, and there is no one-size-fits-all solution. Do what you can and go from there.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

With gift-giving season officially in full swing in the United States (and at least a few other places, I presume), I figured this would be a great time to discuss safe shopping tactics. I don’t feel like this needs any sort of real introduction, it’s pretty self-explanatory, so let’s begin.

• Pay with cash in person. In general using your card is a bad idea for both security and privacy. In addition to the risk of having your card number stolen, there’s also the privacy invasion of having banks selling your shopping habits. Both of these risks can be eliminated completely by simply paying cash wherever possible. This also helps if you’re buying a gift for someone who has access to your bank statements (significant other, parent, etc). They can’t see how much you spent or where.

• For online transactions, use pre-paid cards or card-masking services like Privacy.com and Blur to avoid having your real information stolen. Be aware that Privacy.com essentially functions as a bank, so they will ask for some personal information that some people may not be comfortable with. Blur is a little less invasive, but you’re basically just creating digital pre-paid cards. Personally I’m a fan of Privacy.com for a lot of reasons, but this isn’t the time or place. Feel free to check out their site and see if it’s right for you.

• Use HTTPS. HTTPS is a powerful and effective encryption method for data-in-transit (aka web traffic) that helps protect your sensitive information as it shoots across the web. The vast majority of the internet is now securely encrypted but why take any unnecessary risks? The web browser plugin HTTPS Everywhere will automatically ensure an HTTPS connection wherever it’s offered, regardless of search engine or browser settings.

• Use a VPN. VPNs are popular for people looking to change their location online to do things like get around country restrictions on YouTube or Netflix, but they can also serve a number of other purposes, such as providing additional encryption and security, especially if you're a fan of using public wifi such as the library or coffee shops.

• Use a PO Box. PO Boxes can serve tons of great purposes that you didn’t even know you needed. For starters, they start off inexpensive, in some places as little as $20/year. They can be handy because your packages don’t sit unguarded on your porch while you’re at work, they sit safely inside the building of your box. And of course, you don’t have to worry about some stranger on the internet snagging your home address, whether that’s the random person on Etsy, the rogue employee at Amazon, or the hacker who hopefully didn’t steal your information because you already implemented the above bullet points.

• Don’t quit on December 26. The thing about these habits is that they’re great year-round, not just around the holidays. Shopping is something we do all the time, all year, and these strategies can be implemented there, too. You can pay cash at the grocery store. HTTPS and VPN encryption can protect your Facebook login just as much as your card number. Online data breaches are quickly becoming a daily occurrence, so using card-masking can prevent your card number from getting permanently posted to the dark web (if you’re not worried about that, clearly you’ve never had the hassle of updating EVERY service you use after a card number changed for any reason). Even a PO Box can be a neat thing to have on hand if you rent and move in the same area frequently, if you need an address on file for work (again, data breaches), or freelance and need somewhere to send checks or a return address for merchandise you sell.

Take some time to think about which of these strategies can benefit you most. HTTPS and VPNs are things that take just a few minutes to set up and you never have to think about them again. A PO Box can be easily added into your routine by renting one nearby or on your way to/from work (if you have a concern about stalkers, you may want to consider getting one in a nearby town instead). Cash can be handy as well to help you stick to a budget. I hope these tips help keep you safer online this holiday season, and good luck finding that perfect gift!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

Social media is a ubiquitous part of modern life. I am the last person here to decry the negative effects of it, though for the record there are some we should be aware of address outside of privacy and security. No, for an introvert and avowed hater-of-small-talk like myself, social media is a godsend. I hate calling or even texting someone to go “hey, I have no reason to be bugging you but what's new? Let's chat.” Instead I love the ability to peruse the timeline at my leisure and respond to whatever someone else felt was worth sharing, whether it's their latest meal, their child, or their trip to the brewery.

Still, many of us are aware that social media comes with wide-ranging risks, from cyber-stalking and cyber-bullying to full on identity theft. Many of us likely know someone who was or have been ourselves victims of someone pretending to be us on Facebook. This usually isn't a problem when you can just post “hey, that isn't me, don't give them money.” But what happens when you're a well-known, respected person and your social-media doppelganger is posting things you would never endorse in a million years? Well, it happens. And sometimes, it has nothing to do with you. Another common abuse of social media is to use the information one over-shares for “social engineering.” For example, I can check your Facebook page, see your banner picture is the Green Bay Packers, and if your bank's security question is “who is your favorite sports team?” I now have a pretty good guess. Or on a more complex level, I can assume that the Packers might be part of your password and I can use that for a dictionary or brute-force attack.

So am I here to tell you not to have social media? Well, sort of. Not to be “that guy” but the quality of my friendships has increased dramatically since I deleted Facebook. I find it much more meaningful when my friends personally invite me to hang out rather than send me a faceless, impersonal, mass event invite. We also put more intentionality into our talks, even our texts. It's more engaging than a casual like while lying in bed at night waiting to fall asleep.

At very least, I do encourage you to ditch traditional social medias like Facebook, Instagram, Twitter, TikTok, Snapchat, and others in favor of more privacy-respecting services like Mastodon, Friendica, Pleroma, PixelFed, Riot, and others. Traditional social media companies are terrifyingly abusive in both the ways and extents that they collect data about you and process it. But that's a post for another time. Instead, this post is about how to best-use your social media – be it Facebook or Mastodon – and how to be smart about it to enjoy the best aspects of it while avoiding some of the worst.

-Ditch mainstream. I know I already said that, but I assume some people are going to skim this post, and it bears repeating anyways. Seriously. Here's just one site full of good reasons why Facebook sucks, and there's plenty more where that came from from each major company.

-Think about your privacy settings. This one is pretty well-known these days so I'm not going to spend much time harping on it, but unless you're a public figure intentionally attempting to reach the masses, you may want to consider locking down your profile behind as much privacy as you can. Making your Twitter private may cost you some followers, but it will make you significantly safer and make your experience more enjoyable.

-Think about what's really worth posting. Again, I'm not here to decry “the good old days” and make fun of people who post their lunch on Instagram all the time, but does it really make you happy? Does “vaguebooking” about your unhappiness really fix the problem? Does sharing that link (that you didn't even read or fact-check) actually change anyone's mind? Don't just impulsively dump things into your profile or feed. Take a few seconds to ask “do I really want to share this?”

-Think about what you're posting. Okay, so you've thought about it and you're REALLY feeling that selfie. Your hair has never looked so good. Great! But do you really need to angle the camera in such a way that the company logo is visible on your work shirt that you're wearing? Did you leave any mail or personally identifiable information in the background? Is everyone in the picture consenting to be in the picture? I don't care if my partner posts a selfie to Facebook but I politely ask her to angle the camera in such a way that it leaves me out. Think about what information someone could potentially learn from that photo, such as where you live or work, and remember that people search websites are a tragically real thing. (I'll do a post about that someday too). Again though, it's not just you. When you post a picture of your child to Facebook, that picture stays on Facebook's servers forever. Someday your child will be grown, and they should have the right to decide if they want Facebook to have their facial recognition data on file. Carelessly posting even statuses or location check ins can sometimes reveal more information than you or the people you're with may be comfortable with. Be sure to think about what information you're revealing and be sure everyone involved is okay with it.

-Remember who your audience isn't. One big reason I dislike mainstream social media is the lack of privacy. If your profile isn't set to private, literally anyone can see your posts, pictures, likes, and more. “I don't care if my friends see where I work,” you say as you check-in with your latest tweet, but what about the stranger? The Guardian wrote an article reminding us how easily one can “stalk” someone – even by accident – with how much information social media reveals about us.

-Remember who your audience might be. This story of a nurse who got fired after posting benign comments about her job on Facebook shows how even the best intentions can backfire when you overshare on social media. Even if you make a post privately or in a closed group, you can't guarantee that it won't be screenshotted, printed out, or otherwise shared with someone it was never intended to see. Always assume anything you put on the internet is wide open to the public, even if it isn't.

-The internet never forgets. So you had a little too much to drink last night, or maybe the anesthesia the dentist gave you was pretty strong, or maybe you just were real depressed and it felt cathartic to make some depressing posts. You can just delete them later, or set your profile to private, right? Allow me to introduce you to the Wayback Machine. The Wayback Machine is a free service from Archive.org that automatically creates a copy of every page on the internet it can find at all times for the sake of history. It's not trying to make everyone remember that picture of you in 8th grade, it's trying to ensure that a hundred years from now we have a copy of the front-page news from major events in history and such. The problem is that it's a bot. It doesn't discriminate. Now obviously the bot can't be everywhere at once, and it can't possibly get everything all the time, but it tries hard. The longer you keep something online, the more likely it is to get swept up in archiving services, and the harder it will be to remove. And Wayback isn't the only service that does this. Anything you post, even briefly, has the potential to stay on the internet forever, if not on the social media provider's servers then on an archiving service. The odds of this increase as your social media presence grows – aka, if you're a notable figure of some kind (musician, actor, influencer, etc). Posting something online and then deciding later “nah, I don't really think I want to share that with the world after all” isn't really an option. It's there forever and whatever prompted you to remove it – such as personal information, non-consenting parties, or even just bad lighting – will be there forever to haunt that decision.

Once again, I'm not here to bash social media (this time). I'm not here to tell you to delete Facebook (though I do encourage it). But I do want you to take the time to think about what you're sharing and make sure you know what you're getting into. Be smart with your social media usage. As I said in my first blog post, our goal is to reduce our “attack surface.” We want to make ourselves a less convenient target so that bad actors go after an easier target. Think twice about anything you post on any social media platform, and that alone will get you pretty far. I hope the pointers above have been helpful in that regard and given you some factors to consider. Use wisely!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

If you've been online for any time at all, you've probably at least heard mention of Linux. What is it exactly? And is it worth your time?

Linux, put simply, is an operating system, just like Windows or Mac. Linux, however, is open-source and as such there's dozens of variations of it. Some require more technical knowledge than others. Some versions are run by an official team, such as Fedora, and others are purely made on a volunteer basis, like Debian. Some are specialized towards a specific job or purpose, like AVLinux, and others are designed to be used by anyone and everyone.

So first off, why should you consider switching to Linux? For starters, security. Linux has relatively fewer viruses and malware compared to Windows or Mac, mainly due to it's low market share and fewer users. That's not to say it's built more secure, it's more of a “security-through-obscurity” thing so don't go being reckless with your clicking.

Another advantage to Linux is privacy and customization. Linux has no central owner, so there's nowhere to “call home” to. Windows 10, on the other hand, has been caught with a keylogger on even their most minuscule software like Calculator and Office. (Source) That's an incredible jump in privacy right off the bat by ditching all that telemetry. Also, because Linux is open source, there's a million ways to customize it if you feel comfortable messing with that. And if you don't, there's so many flavors that you're likely to find one that feels right for you. There's versions designed to look like MacOS or Windows XP. Even the same version of Linux could have multiple different desktop environments for you to pick from, completely changing the feel of the system.

In light of all that, should you switch to Linux? The short answer I would recommend is “if you can.” Unfortunately some of us have specific hobbies or jobs that require Windows/Mac only software. Hardcore or professional gamers, for example, will be hard pressed to find a Linux distro that can support some of the popular titles or use the same stability as a conventional OS (though I encourage them to check out Pop!_OS, as Linux gaming has a come a long way in recent years). Other people, such as graphic designers and musicians, may find that the software they rely on that most benefit their workflow are not available on Linux. And of course, there are tons of other jobs that rely on proprietary software that are only available for Windows or Mac. So before I give a hard “yes, everyone should switch,” it's important to note that sadly that's not an option for everyone. Of course, there's nothing to stop you from having a work computer and a personal computer that runs Linux (except perhaps finances). You could also try dual-booting if you feel comfortable with that and have the authority to do so on your machine.

How hard is it to use Linux? Again, it depends. Distributions such as Qubes require a high degree of technical knowledge and comfort. Other versions like Mint and Ubuntu are very straightforward and come with a high level of support online through the communities who use them.

Which version do you want? If you're a Mac user, ElementaryOS is probably the place to start. It's gorgeous and looks a lot like MacOS. It will probably feel most at home as an introduction to Linux. If you're a Windows user, Mint looks like Windows XP and will probably be your best introduction. If you're tech savvy and feel comfortable diving right into a different operating system altogether, Ubuntu is by far the most popular Linux distribution. I personally recommend Fedora or Debian. Debian will be the most easily compatible with many of the programs you may already be used to – like Slack or Discord – but Fedora offers significantly better security. Just about any distribution – except perhaps the highly specialized ones – will give you the same basic ability to check your email, watch Netflix, listen to music, browse the web, and create text documents. If you need anything more than that, I recommend checking the program's website to see what operating systems it supports. You could also check “app stores” like Flatpak and Snapcraft.

If you're interested and curious about switching, in addition to just searching “getting started with Linux,” I recommend this site which quizzes you about what's important to you and recommends different distributions based on that. I also strong encourage readers to try Linux out for a test period – either through dual-booting, running off a Live USB, or a virtual machine – to find which one is right for you and if you're even able to switch at all. Good luck, and I hope you're able to find a Linux distro that works for you!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

For those who don't know, this blog is part of a larger site dedicated to providing tools and news about information security for the average person. As part of that mission, every morning I browse the headlines and post privacy/security-related articles on The New Oil's Mastodon account, acting as a sort of news feed for stories I think are important and the average person should at least be aware of. (I try to do that every morning, sometimes the day job gets in the way, so quick shameless plug for my Liberapay where you can help me be less dependent on the day job so I focus more time and energy on The New Oil.) Data breaches, even though I share them, are nothing new to me. I see them multiple times a week, literally almost every day. But lately I've seen an additional worrisome rising trend: the rise of ransomware. And it's becoming a big deal lately, so I want to talk to you about how to avoid it and protect yourself from it.

First off, what is ransomware? Basically it's a virus that encrypts your computer and doesn't give you the password, requiring you instead to pay an anonymous criminal via Bitcoin to get it unlocked. It's becoming an increasingly common attack, especially on governments and government services. So far at the time of this writing South Africa, Florida, Maryland, Ohio, Maine, New York, Georgia, Colorado, and Texas have all been hit, and in some cases the government has agreed to pay to get the systems unlocked. In this post I'm gonna be talking about the really nasty, scary stuff. A lot of the time a virus will claim to be ransomware but in reality it's just a normal annoying virus that requires you to boot into safemode or a use an antivirus USB stick to fix it with no damage to your files. This article is about the scary stuff in the headlines as those will do the most damage if they ever hit you.

How can you avoid it? The same way you can avoid any other virus: don't click links you aren't 100% sure of. If something feels off, it probably is. Don't download anything you aren't 100% sure of. Do regular virus scans, etc.

But what if it happens anyways? We're all humans. Once in a while my virus scan detects stuff, and sometimes my links get hijacked. It's part of life in this digital age. Well if it's already been locked, I'm afraid this blog won't help you. Sorry. You can pay. Or trash it. Or take it to an actual cybersecurity expert and see if they can help. It's up to you. But there's some things you can do beforehand to mitigate the damage in case it ever does happen to you.

First and foremost, backups. This is a tale as old as computers themselves and the only real insurance plan I know if you fall victim to ransomware. Multiple terabyte external hard drives are available for less than $100 these days. Consider it an investment. There are a lot of programs out there that offer automatic backup services (Windows 10 and Mac even have their own built in) but I personally prefer to manually backup everything once per month. I set reminders every month on my calendar so I don't forget, then I set it to go during a couple hours when I won't be using my computer. That way even if I lose my data, I'm never more than a month behind, and which for me isn't a huge loss. Your work may be different, and in your case you may want to back up once a week or even once per day. That's something only you can answer. Additionally, I'm backing up EVERYTHING. Project files, text files, even my movie and music libraries. You may decide those are less important and choose only to back up family photos or text files. That's up to you. Either way, decide what's important to you and create a system to back it up regularly.

Second, don't click any links you aren't 100% sure of. I know I already said, that but it bears repeating. Phishing – where a malicious actor sends you a link and that link, once clicked, secretly allows them access to your computer either directly or as a virus – is still, after all these years, the number one way of gaining access to an otherwise secured machine. Despite years and years of being told not to click links, to double check who the email is from, to be 100% positive, people still fall for it every day. Sometimes an email looks legit and comes from a legit source, I get that. But you can avoid probably 90-95% of actual hacking attempts just by being judicious with your clicking.

Third, I mentioned antivirus. Having a solid antivirus software in place is great. Personally I'm not a fan of the more mainstream options like Norton, AVG, and Symantec. I've had lots of cyber people I trust tell me that there's a lot of stuff going on behind the scenes that isn't virus-related, like telemetry (reporting the usage statistics of the software) and cosmetic stuff. They tend to be bloated and slow to actually add current viruses that are in the wild. Instead, you may be surprised to learn that both Windows and Mac come with built-in antivirus programs that experts agree are plenty powerful. Windows Defender was a joke a few years ago, but these days it's been heavily improved and most experts don't recommend a third-party antivirus. Mac also comes with XProtect buried in the programs menu.

Finally, if possible, you might consider switching to Linux. Now, this isn't always possible. For my day job, I am required to have access to several key pieces of proprietary software that are exclusive to Windows or MacOS. I can (and do) have a personal Linux machine, but I am required to have a Windows or Mac computer available for work. Not all of us can have two computers or dual-boot, and not all of us have the option of switching to Linux. But if you do have that option, I highly encourage you to consider it. Ubuntu is the most common flavor of Linux, and as such has by far the most support. Pretty much any problem you search for in a web search engine will almost certainly be answered for Ubuntu. Mint is another common variation. It looks a little old-school, like Windows XP, and it functions similarly, which means you'll probably feel right at home. Personally I recommend Pop!_OS. There's also Elementary for those who are used to the Mac interface. I plan to do a blog post down the road all about Linux, the popular varieties, which ones I recommend, and why. Again, this may not be right for everyone, but because Linux has a far smaller market share, there's less viruses out there for it. It should be noted that that doesn't mean that Linux is inherently more secure, viruses for it do exist and it's on the user to be judicious, but it does mean attackers tend to focus on bigger, more common platforms which does give you a small measure of security through obscurity.

Admittedly, it's highly unlikely your computer will be targeted directly. In a lot of these state-level cases, I suspect that someone emailed an employee a link which they clicked and downloaded the ransomware. In your case, it's much more likely that you'd be searching an unfamiliar portion of the internet and accidentally download a ransomware designed not for any one specific person, but rather for anyone who accidentally clicked on it. In those situations, your antivirus will be your most likely defense. And, god forbid, if you do fall victim, your backup is your saving grace. Personally if I were to fall victim to a ransomware attack right now, it would be incredibly annoying but not really a big deal. I would just reformat my computer and load the data from my backups without paying anyone a dime. But you can only pull that off if you're consistent with your backups and have good practices for dealing with online content. And as I said before, always be aware that it may just be a scare tactic and it may be something you can fix with a normal virus scan.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

I’m sure this topic will be nothing to new to many of my readers here, however it seems only appropriate to start from the beginning, and this is a fundamental topic to keep in mind as you move through life and your information security journey. The term “threat model” is – in the context of privacy and security – just a fancy way to say “what are you hiding and who are you hiding it from?” For example:

• A journalist may want to protect their sources from harm or retaliation. Therefore their threat model will include ways to avoid location tracking, encrypt or otherwise protect the uncensored information they receive from their source, and other similar information that might reveal who their sources is or allow others to track them to their sources.

• A member of law enforcement may wish to protect their home location in a variety of ways to avoid putting their families in danger from criminals seeking revenge or just general criminals with a grudge against the system.

• An activist in a repressive country make take steps to hide their research, gatherings, or other activities so the government can’t track their real identity and use it against them.

We all share some common threat models. For example, we all want to take steps to protect our bank accounts. Other people may have stricter threat models. While there’s basic “best practices” that do apply to almost (if not) everyone, there’s really no one-size-fits-all solution for everyone. Some people need more protection. Most people want to find a healthy balance between protection and ease of use. That’s why this site exists.

The example I like to use is infamous serial killer Richard Chase. Chase stalked the Los Angeles area between 1977 and 1978. One of the reasons he was so difficult to catch was because he didn’t have a pattern. He said on record after he was caught that he would just cruise around neighborhoods until he spotted a house he felt compelled to try. But here’s what made Chase odd: if the doors and windows were locked, he would go on his way and try a different house. He didn’t force his way in.

We should all be trying to defend ourselves from the Richard Chase’s of the digital world. Many people argue that security is inconvenient. It is. It’s much more convenient to use your daughter’s name and birth year for every single account instead of a randomly-generated password that you don't reuse anywhere. It’s very convenient to stay logged in or not use Two-Factor Authentication. My own VPN drives me crazy sometimes. But it’s also inconvenient to have to unlock my door and open it up whenever I come home, but the amount of security I get from not leaving my door wide open at all times and using a simple $2 key more than pays for itself. The same principle applies with information security. Even little things like strong password practices and 2FA can provide a measure of security that outweighs the inconvenience, and it only takes a few weeks or even days for it to become second nature.

What’s your threat model? That’s a question only you can answer. Maybe you just need to lock your front door, so to speak. Maybe you need to hire a security guard. Maybe you need to move to an underground bunker. Everybody is different and everybody’s threat model is different. Some people may find the benefits of Facebook worthwhile and keep their account despite knowing the aggressive surveillance the company performs. Other people may decide they don’t want any social media whatsoever anywhere. These are personal questions. When crafting a threat model, remember those two opening questions: what am I trying protect and from who? Once you narrow that down, the “how” is usually just a couple web searches away. Even a simple Google search like “how can I protect my bank account from hackers” is a pretty solid starting point that will give you some basic ideas.

In the coming articles I will be posting in the future, I’ll be diving into all kinds of threat models and tools and practices. We’ll talk about secure messaging, VPNs, disinformation tools, and more. I’ll compare different services, the pros and cons of each, and what to consider when using these services. I’ll talk about best practices (like the aforementioned “not reusing passwords” thing). Feel free to reach out with any questions I should cover, products you’re curious about, or any of that. Thanks for reading and good luck!

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...