The New Oil

The EARN IT Act

March 21, 2020

If you are even slightly involved in the privacy community, you’ve probably heard by now about the EARN IT Act. If you’re relatively involved in the privacy community, you’re probably sick of hearing about it by now. But it’s important we need to talk about it: what it is and what to do about it either way.

What is the EARN IT Act?

S. 3398, also called the EARN IT Act of 2020, is “A bill to establish a National Commission on Online Sexual Exploitation Prevention, and for other purposes.” Basically, Senator Lindsey Graham and the National Center for Missing and Exploited Children have decided that end-to-end encryption is bad because it allows the proliferation of things like child sexual abuse, human trafficking, and drug trafficking. Without this side-tracking this post too much, the number of registered sex offenders in the US is less than a quarter of a percent of the population in 2018, and drug arrests account for only 1% of the US population (this post has more context, information, and my sources). So first of all, arguing that nobody should have encryption is a lot like saying nobody should have clothes because a few bad people use it to smuggle illegal items, or that nobody should have food because some people use silverware for murder. It’s ridiculous and blown out of proportion. But that’s exactly what the EARN-IT Act asserts. It’s a law that would ban end-to-end encryption, the most secure form of encryption around, and force all encryptions to have a “backdoor” for law enforcement. The problem is there’s no such thing as a backdoor that only the good guys can access. Just as your own house door can be broken into by a criminal, so can a technological door. The amount of personal liberty we’re giving up is not proportional to the amount of good it would do.

What to do about it

The bill was introduced earlier this month and is still in the very early phases of the legislative process. So that means there’s still tons of time left to fight it. The most effective way, of course, being to call your local politician and tell them you’re a voter in their district and you want them to vote against it. Don’t know who your politicians are? EFF has made this very handy site that will look them up and email them for you. But calls are more effective than emails, so use this site to find your representatives by zip code, and use this site to find your senators by state, then use DuckDuckGo or the direct links on the Senate and House websites to get the phone numbers of their offices nearest you. Then save them in your phone and set an alarm to call them every day and remind them you are against the EARN IT act. Typically all they ask is name, zip code, and your comment. You can leave it at “I disprove of it and want them to vote against it” or you can go on a whole diatribe about how it’s an assault on civil rights and statistically ridiculous. Just be polite. Finally, you can sign an official White House petition against the EARN-IT Act here. This alone won’t be enough to repeal it, but the more signatures it gets the more it shows that Americans don’t want this bill.

What to do if it passes

If this bill passes, we face some trouble, so it’s best to get your ducks in a row now. One solution is the previously-mentioned Firechat app that I shared in my COVID-19 post last week. Since this app stays off cell networks, it’s undetectable and therefore uncensorable. I first learned of it myself because of the role it plays in the ongoing Hong Kong protests.

Another open-source solution I mention on my site is Matrix. Encryption is not enabled by default but is activated easily with the click of a button, and with a little extra work it can bridge to a variety of apps and services.

The TOR Network is another valuable tool, but because it is easily recognizable it can also be easily blocked by internet service providers. So while that is a service to keep in our pockets, it’s important to have alternatives as well. VPNs are likely to not be affected as they are not end-to-end encrypted, but their no-logging policy may come under fire next.

Additionally now is a good time to get comfortable with PGP encryption, as this is a local type of encryption where the keys are stored on your device and you don’t have to rely on anyone else for the security or effectiveness of it. It is most commonly used via email, but it can be used for other types of data-at-rest encryption as well.

Mesh networks are a more complicated solution, but they are a potential solution and hopefully we’ll see them become more user-friendly in the future as a result of this attack.

As I said, now is the time to look into these solutions and start planning as it may be much harder to access these services if the bill gets passed. Hopefully we won’t need them, but better safe than sorry and preparation is key. I plan to put up more posts and tutorials on these subjects in the coming weeks. Up until now I’ve been putting them off as I didn’t think they concerned the average user, but clearly this is no longer the case. In the meantime, the best course of action is keep bugging your elected officials and hopefully this won’t be an issue in the near future.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

Let’s (Not) Talk About COVID-19

March 14, 2020

I’m a little salty. The COVID-19 panic has finally hit my hometown late this week as three confirmed cases popped up in my relatively-large town of over 1 million people. Earlier this week I stopped by the grocery store and it was business as usual. Yesterday my partner gave me a play-by-play of all the people that almost ran her over and sent me pictures of the empty shelves. I’m frustrated because I personally fall into the camp of “the seasonal flu is statistically more dangerous at this point, this is just public panic over nothing.”

Over the past few months, I’ve been publishing a lot of articles on Mastodon about hospital data breaches. It’s a topic I’ve been mulling over, figuring out how to best address the situation. After all, you want to be honest with doctors to get the right treatment but you also don’t want your personal information posted on the dark web simply because you decided to be healthy.

So today I’ve decided to roll a number of topics together to talk about how to handle your privacy in times of a pandemic (or a media panic over nothing). This article is probably going to run a bit longer than my usual post, so bear with me.

How to Handle Hospitals

Even if you’re the type of person to “take an ibuprofen and tough it out,” chances are you will eventually have something serious enough to warrant visiting a hospital, even if just out of caution. So let’s start with how to handle those. Rule number one: don’t lie to your doctor. They became a doctor because they wanted to help people and you’re just wasting their time and risking your own life by lying. Having said that, not all information on a hospital form is mandatory. When they give you the paperwork to fill out, I would ask them what the absolutely essential parts are. I’d also ask if they have a form allowing you to opt out of any data-sharing agreements. They won’t advertise that stuff, but they usually have it. The questions might catch them off guard but ultimately as long as you’re polite and cooperative they don’t really care.

Get a PO Box

I’ve mentioned before some of the benefits of a PO Box. They’re cheap, and they put another layer of protection between your real home address and the public world. And at no additional cost (through USPS, private places may charge) you can sign up to use your PO Box as a street address, which means nobody will even notice that it’s not a real address. This is great for things like hospital forms or employer records as they give those people a legitimate way to get in touch with you without risking your home address showing up in a data breach.

Get a Voice-over-IP (VoIP) Number

This is a thing that deserves its own article and will get one someday. A VoIP number is, in short, a digital phone number that forwards to your real number. I recommend MySudo, but there are plenty of options out there. Keep in mind that no VoIP app is perfect for total privacy, but at least it removes your real number from potential data breaches and public records (I’ve got an article in the works about why that matters but for now just trust me that it does, it’s too much to get into in this already crowded article).

Freeze Your Credit

As is usual in times of chaos, scams are on the rise. So make sure to protect yourself and your dependents: freeze your credit and set fraud alerts. Thanks to the Equifax data breach, freezing your credit is now free by federal law in the US, and identity theft of minors is one of the leading cyber crimes. Freezing your credit will ensure that nobody can open an unauthorized account in your name. Even if you don't suspect yourself of being a target or you argue that your credit is too awful to be useful, rest assured that someone will always be able to open a high-interest account for you that a criminal has no intention of every paying off and now the task falls to you to jump through a million legal hoops and prove it wasn’t you. Just avoid it. Set up a credit freeze, and furthermore set up fraud alerts. Lately people have been finding very easy loopholes to unfreeze credit without a PIN – which defeats the whole purpose. A fraud alert is a second layer of protection to help defend against that.

Pay in Cash

This is kind of one of the foundational principles of privacy and data security. While credit cards do come with a lot of convenience and a few legal protections, the transaction information can and often is sold or shared from your bank to various third parties for advertising purposes. Paying with cash removes that tracking trail. I suspect – pardon my tin foil hat – that it’s only a matter of time before your shopping habits are used to determine things like approval and rates for loans, insurance, and other important aspects of daily life. While I realize that most people in the US can't afford to pay for a hospital visit in cash, you can probably at least buy things like your medication in cash, which helps.

Take Up a Passing Interest in Disaster Prepping and Personal Finance

Admittedly for some of us, this might be too little too late, and of course there's entire blogs, books, websites, and podcasts on both of these subjects so this isn't really going to be a detailed primer. But honestly, there’s a lot of overlap between the worlds of privacy, personal finance, and disaster prep. For example, disaster prep says “plan for the most likely scenarios first – emergency hospital visits, economic collapse, etc – before you plan for the zombie apocalypse.” Personal finance would agree with that logic 100%. Privacy says “use credit as little as possible because it tracks you,” and personal finance would agree that not relying on credit and staying out of small-time debt is a great idea (disaster prep agrees on that last one, too. If you have no debt, you have one less bill to worry about when the economy tanks). Disaster prep doesn’t mean building a doomsday bunker in the backyard with a thousand guns, it means having an emergency fund and a case of bottled water in the pantry just in case. Again, these are topics that are far too broad to get into in a single blog, and for the most part they are their own separate subjects that warrant pages and pages of discussion. Basically, these aren’t subjects I plan to get into too much ever because they simply fall outside the subject and scope of this site (maybe a few posts here and there in the future on relevant subjects). But they do offer some relevant advice on both the current situation and your privacy in general and I encourage you to look into the subjects.

The Aftermath

Okay, allow me to put on my tinfoil hat here, and if this section jumps the conspiracy-theory shark too much for you I completely understand and respect that and I hope you’ll still extract the meaningful advice in the rest of the article: I think we are going to see a suspension of civil liberties as a result of this epidemic. I think for the most part, it’s going to be well meant (and ineffective). However, just like the Patriot Act and the TSA, I think any such suspensions will be here to stay. In 2001, terrorists attacked the World Trade Center in New York and forever changed the course of history in both politics, war, surveillance, culture, and more. Many of our basic freedoms were suspended in the name of “The War on Terror” and to this day – nearly two decades later – we are still fighting to get many of them back. Already we have seen entire cities and regions quarantined, we’ve seen cities ban large gatherings (some as “large” as 500), we’ve seen the government demand more travel data from airlines to track the disease (many Asian countries have already ramped up their surveillance states to successfully combat the outbreak), and I wouldn’t be surprised to see curfews and other such things in the near future. Again, I’m certain that in most cases this is being done with the best intentions. But once Pandora’s Box has been opened, it is so damn hard to shut it again. So as the world scrambles to stop the spread of COVID-19, let’s be sure not to let our fear take us down that road again. Make sure that our civil rights continue to be respected, and make sure they are restored to us as the panic begins to wane. Hold your leaders accountable for that.

Conclusion

Again, I fall into the camp of “I think people are overreacting,” but whether I’m right or wrong we are facing some scary times ahead. Major events are being canceled worldwide, which will lead to economic implications (here in my town we’re already seeing the trickle down). Travel is being restricted, and whole areas are being quarantined. This is going to be a disruption to our daily lives, and it’s important to remember to protect our privacy as well as our health. Please, do visit a hospital if you think you need to. Buy some cold medicine to help with your symptoms. But remember to keep your privacy intact as we all push through this.

A Personal Note from the Author

I mentioned that in my hometown we are already seeing a trickle-down of economic impacts. Here in my home state, our capitol Austin has already canceled the legendary, multi-million-dollar South By Southwest (SXSW), an international week-long music and technology festival that happens every spring in. It’s a huge deal for their economy. This is the first time in over 30 years that’s happened. In response, SXSW had to lay off 1/3 of it’s permanent staff. Elsewhere, all of our local major events centers have canceled all their events for the rest of the year, including sports, concerts, expos, and more – we’re talking arenas that seat tens of thousands. We've also canceled tons of other major economically-advantageous events like rodeos, cities are urging gatherings of more than 250 people to cancel, schools are canceled (or moved online wherever possible), the Austin racing track – which hosts F-1 and Indy and all other international events – is closed. I've heard the Austin City Limits festival is also cancelled, but that's not until October so I don't know if that's true.

My day job is audio/video. I currently work for a small audio/video installer – “less than ten people” small. Yesterday our owner (who is very transparent, which I appreciate) sent out an all-hands email letting us know that times are already getting tough. One of our clients – which was one of these ten-thousand-seat arenas – is having to push back working with us because of funds lost due to cancelled events. Another client that was set to start this month – a college – is also having to push back because of the scramble to move to online classes. Two other clients that were set to start this month – both tech companies – are pushing back because of the disruption of the epidemic. Our owner is doing everything in his power to keep us afloat and not cut any hours, but he is admittedly worried. We were already in a slow season as it is, and now almost all of our upcoming projects (and certainly all of our highest-paying ones) are pushed back indefinitely.

Without going into detail, I assure you that if hours are cut or people are laid off, I will be first on the chopping block. I don’t think it has anything to do with the quality of my work, my work ethic, or me as a person. It’s just a logical choice and one that I wouldn’t blame the owner for making. It’s the same choice I’d make. And I have no doubt that we are not an island – this disruption is happening industry-wide, so despite my impressive resume (I’m serious, I have a fantastic resume) I don’t think I would have an easy time hopping to another job simply because I suspect nobody is hiring right now.

I say all that to say this: I realize times are about to be tough for everyone if they’re not already right now, but I’m facing a pretty scary time ahead as my industry is not essential and neither is my position with my day job. As such, I will be leaning very heavily on side projects like this one and the generosity of its supporters. So, if you are in a position to give anything to help support this project and myself during these times of uncertainty, it would be extremely appreciated. And if you are not in such a position, I get it. Just try to stay healthy and weather through it. Thank you for reading.

https://liberapay.com/thenewoil

Author's Update, May of 2021

I've meant to add this addendum for quite some time but never got around to it before out of a combination of laziness and business. I just wanted to say that obviously when I posted this, COVID was still in its early stages. I don't believe in revisionism, so I don't want to simply delete the arrogant and incorrect views I had at the time (ex, thinking that people were overreacting or that COVID was not a big deal). Especially now, over a year later, my vaccination side effects F*CKED. MY. WORLD. UP. If that's just a fraction of what COVID is like, then I cannot express how wrong I was. At any rate, I also didn't want to leave these views up unchecked so that people think that I still hold those views. So I just wanted to add this quick note to say: I was wrong. I'm not too proud to admit it. COVID was a big deal – if not medically then economically. I was wrong to brush it off, but at the time I simply didn't know. After seeing the scope and the effects, I know now. I'm sorry if anyone thought I was a jerk, I wasn't trying to be, I was simply uninformed. My views have since changed.

One Size Does Not Fit All

March 7, 2020

There’s a problem prevalent in some of the more experienced members of the privacy community: the problem of assuming that privacy and security are binary, that one size fits all. As I peruse questions from new people freshly introduced to privacy, I see more experienced people throw out ridiculous solutions. For example, I often see the question in other forums “should I use ProtonMail or Tutanota?” and without fail there’s always one person who says “self-host your own email. It’s more private cause you own your own data, and more secure because you don’t have to rely on anyone else and you’re not a target for attackers the same way a big company like Proton would be.” These answers aren’t technically wrong, but I find them ridiculous for a number of reasons. For one, there’s the technical obstacles: I have my own Nextcloud server at home and I promise you that was not easy to set up. No average person has the time, energy, resources, or sometimes courage to do that. For another, security is relative. I personally would rather trust a major company rather than trust myself to create a “secure” email. I am far from a cybersecurity expert. I think even a big target like Tutanota would be more secure than my garbage server at home. And there’s that: most people don’t have a spare computer lying around, and they’re not willing to go buy one just to spend weeks starting over and agonizing over how to get it barely working like a Rube Goldberg machine made of tinker toys and duct tape. The thing that most makes these solutions “ridiculous” however, is the egotistical assumption that their offered solution is perfect for everyone.

Privacy is Not Binary

Privacy is a sliding scale. Privacy is not a matter of “delete your Facebook and use Signal and now you’re secure.” Deleting Facebook from your phone makes you MORE secure than keeping Facebook’s app on your phone. Using Signal makes you MORE secure than using regular SMS. Doing both makes you MORE secure than doing just one. However, doing one is still better than doing neither. Deleting Facebook altogether is a great idea for so many reasons, but only accessing Facebook from your browser is MORE private than using the phone app. There is a gray area in between “go live in a cabin in the woods purchased under a fake name” and “post your Social Security number on Twitter.”

Privacy is Not One-Size Fits All

More importantly, privacy and security is not a one-size-fits-all solution. That’s exactly why I’ve organized my site in a “pros/cons” format. Using instant messaging as an example, Signal is world-renowned for their security and it’s ease of use, but it requires a phone number. That can be an issue for someone trying to maintain a degree of anonymity. Some people aren’t worried about that. My mom doesn’t care about privacy. If I want her to respect my private communications wishes, I have to find a solution that’s easy for her to adopt, and it doesn’t get much easier than Signal. In the early days of my career, I worked a job where work schedules and announcements were disseminated via a private Facebook group. If I didn’t at least have an account to access the group, I didn’t get my schedule or important updates. And that early in my career, I was still very much in the “take any job you can get” phase (these days I have a more robust resume and I can afford to be picky).

There are many, many valid reasons that a person may choose to keep their Facebook account. Or WhatsApp. Or Gmail. Or Windows operating system. There are even more valid reasons that a person may choose to use a service someone else created and hosts like Firefox, Wire, Tutanota, Bitwarden, and more. Privacy and security are not black-and-white “either you are secure or you aren’t.” In running this site, I have made myself less secure by creating a public image, posting regularly, and engaging with others. If I wanted total privacy and security, I wouldn’t do any of that. I would stay off the internet. But I’ve also reduced my “attack surface” by doing things like using services that don’t require a real name, using the Tor network to post, and using services that don’t track me such as Write.As and Mastodon.

I will always encourage you, my reader, to be as secure and private as possible because digital rights are human rights. But don’t let the more elitist hipsters of the privacy community fool you: if you’re reading their opinion online, they could be doing better as well. There are circumstances that sometimes require you to take a less secure option: work requires you to use Apple products, or your family simply refuses to leave WhatsApp, or you need Twitter to stay updated on a local issue, etc. I will always suggest you opt out of those things as much as possible and find workarounds, but I will also respect that that’s not always possible. And while you should try to be as strict with your privacy and security as you reasonably can, don’t beat yourself up. The fact that you’re here means you’re going in the right direction, and sometimes it’s enough just to lock your doors and windows.

The Question of Trust

February 29, 2020

About once a week or so, I see a post in the privacy community that says something along the lines of “If Product X is open source, how do we know The-Company-Behind-Product-X hasn’t just modified the public code to look good while secretly running something else on their servers?” The short answer is: we don’t.

You Always Trust Someone Somewhere. Always. Period.

My dad is one of those “I walked uphill in the snow both ways to school” types. To his defense, this is isn’t always a bad thing. His attitude taught me a lot about self-reliance, taking initiative and control of my own future, and self-improvement. That was a good thing. But I remember one time where I was completely broke through no fault of my own. I don’t believe in playing the victim. Almost always you got yourself into a situation and you should take responsibility for that.But sometimes things happen that are genuinely out of your control and you truly are the victim. It’s rare (on an individual level) but it happens. I had three sources of income at the time and all three failed to pay me for reasons that – in all three cases – were legitimately out of my hands. I’ll never forget my dad telling me that it was my fault, that I should never trust anyone for anything and there had to have been SOMETHING I could’ve or should’ve done differently. To this day, over a decade later, I insist my dad was full of crap about that particular situation.

The fact is, you ALWAYS put SOME measure of trust in SOMEONE SOMEWHERE. Always. Period. Without question. You trust that your boss is going to pay you when you show up for work. You trust the other drivers to stay in their lanes when you drive (for the most part). You trust the food you get at the grocery store to be safe. You trust the construction of your home. You are ALWAYS trusting SOMEONE at SOME POINT. Even if you demand to be paid up front, you’re trusting that the check won’t bounce. Or that the economy won’t suddenly spiral into a recession with hyper inflation. Or that your bank won’t spontaneously close your account. Or that they won’t give you counterfeit bills. You are ALWAYS trusting SOMEONE SOMEWHERE. End of story. Period.

Trust and Due Diligence

The privacy community is a paranoid one. Sometimes that’s good, and sometimes that’s bad. A little paranoia is a good thing in a world where data breaches aren’t disclosed, apps and services lie about what they’re really doing, and companies are aggressively going out of their way to track you. But too much paranoia is bad. Uncontrolled paranoia can lead to problems like anxiety, depression, suicidal thoughts, and other legitimate mental health concerns. (If you suspect you might be spiraling or have spiraled into that territory, please seek help. You are not alone.)

The point is that it’s about balance. Trust should not be blindly given in almost any context. You wouldn’t hire a random person off the street to babysit your kids, you wouldn’t pick a bank you’ve never heard of to manage your money, and you shouldn’t pick services you haven’t researched to safeguard your sensitive information, metadata, and communications. You should absolutely do your research. Is the company/app/service well respected? Do they have a track record of putting their money where their mouth is? They may be open source, but have they been audited? Has anyone expressed any legitimate concerns about their practices?

The key word there was “legitimate.” Lots of people dislike ProtonMail because it costs significantly more money than Tutanota, but their list of complaints ends there. While that may be a deciding factor for you, it doesn’t make ProtonMail any less trustworthy or reliable. As you research a product or service in the privacy community, you will find no shortage of people who have minor complaints about a product. “They’re based in the United States.” “They use X programming language instead of Y.” “They could be more secure if they did ABC.” It’s the privacy equivalent of someone who prefers vinyl over CD. They’re not technically wrong, but you risk getting lost in the weeds. If you’re so obsessed with finding the perfect turntable, cables, speakers, signal processing, and so forth you risk never actually listening to the music.

Instead, focus on legitimate complaints. Are they owned by an advertising company, or a company with a history of packaging malware? Has their code been audited? How do they make their money? If a product is free, you are the product, so if they don’t have a paid model of some kind they’re probably not very trustworthy. Are they using an encryption that’s known to be weak? Does their privacy policy state they log information that you find troubling? Are there credible whistle-blowers from inside the company that have made troubling claims or leaked documents that suggest troubling practices? These are all legitimate complaints. “They cost too much” or “I don’t like their mobile app” is not a legitimate complaint.

Trust Varies

There is something to be said for individual levels of trust and threat modeling. I use Signal as my primary messenger of choice. I do this because I have a VoIP number that I use only for Signal and nothing else. Anyone who searches my Signal number will find very little information about it or me. I can safely hand that phone number out like candy without fear of sacrificing my privacy. Not everyone has access to a VoIP number though, and thus they may only be able to use Signal by using their real phone number, and that may be a risk they don’t want to take. That’s not to say that Signal isn’t trustworthy. It has repeatedly stood up to scrutiny, auditing, data leaks, and has shown itself to be a reliable, secure messenger. But because of its limitations, it’s not right for everyone. Others may choose to use something like Wire or Wickr because they don’t rely on phone numbers. Your specific threat model determines what’s right for you, and picking one service over another doesn’t necessarily mean you don’t trust it.

At the end of the day however, you have to trust something somewhere along the line. The goal of this site is not to remove trust. That’s impossible. The goal is to teach you how to evaluate things for yourself and decide the right level of trust. If your goal is simply to communicate securely (and cheaply) with family in another country, Signal is great. Even something like WhatsApp or Telegram is technically acceptable. But if your goal is to protect a whistle-blower who’s revealing top-secret information to you, a journalist, then you need a higher standard of trust.

Your Phone is Not Your Friend

February 9, 2020

The other day I posted an article on my feed about how the US Immigration service is using cell phone location data to track immigrants. In light of this article, I feel it a good time to remind you that cell phones are not your friends.

The Problem

Cell phones are 24/7 GPS surveillance devices, constantly leaking data at all times. At any given time, your phone is broadcasting your location. It’s also usually broadcasting a bunch of other information such as WiFi connection information and usage data. Recently, Privacy International found that some devices and apps even transmit personally identifying information such as name, date of birth, and gender without using any type of encryption or security measures. Even within the device itself, there’s a messy web of apps requesting information that they don’t really need and transferring that information to their own creators, leaking even more information about people who didn’t consent to having their information shared to people who don’t need it. (Source, just one of many.)

The Reminder

Phones have made life incredibly easy and convenient in so many ways, and as usual I’m not here to decry the rise of technology. Technology is fantastic and I love it. I have a phone. I have a smart TV. I use decentralized social media. But remember that our phones have been usurped as surveillance devices, constantly betraying us. Our messages, our locations – which are then correlated with other phone locations to create a network of who we know, further creating a startlingly accurate guess at our socio-economic status and a whole host of other things – even the games we play and shows we watch. It’s all being collected at all times for various ends. Some companies just want to sell things to us, some agencies want to catch the bad guys, and a small few of powerful people want to control things. The more data they have, the easier it is to do that. If you need a reminder of how this power can be abused, just take a moment to browse through this page.

The Solution

It’s hard to recommend a course of action. I personally have taken to simply leaving my phone at home as much as possible. If I’m going out to dinner with my partner, I pay in cash and leave the phone at home. After all, my goal is to spend time with her. Leaving my phone not only ensures that “they” don’t know where I went, but also keeps me from getting an email or browsing memes when I should be spending time with her. I’ve also taken to doing as little as possible on my phone. I have Signal and Wire both loaded onto my computer, as well as my password manager. I try to keep my phone as clean as possible of apps, only keeping those that I absolutely need to do my job or be responsive as needed. Even though my phone still betrays my location, I try to replace my map app with something like OSMAnd, an open source navigator, to mitigate the amount of data reported. I believe I may have mentioned that I stopped sleeping with my phone in my room a few months ago and replaced it with an old-school digital alarm clock (not the smart kind, the $10 “just tells time and beeps real loud” kind).

As with most things, reasonably abandoning my phone hasn’t had any negative impacts and if anything has only made my life better. I sleep better, I focus more on where I’m at, and I tend to be more in-the-moment. Again, I’m the last person to decry technology, and obviously some of us can’t turn our phones off when we go home, but the goal of this post is not to tell you what to do. Just to give you a quick reminder that your phone, while undoubtedly having improved your life in many ways, is not your friend. Don’t forget that. Keep it on as short a leash as you reasonably can.

Tracking Links

January 12, 2020

I'm amused – and slightly sad – that as I began to do my research for this blog post, every result for a search of “tracking links” or “tracking URLs” returned the same thing: web-hosting and analytics companies giving a very benign overview of what they are and then explaining why everyone who owns a website should be using them. I shouldn't be surprised. Like most surveillance technologies, the proliferation of tracking links is aided by two main concepts: the first is that they provide a very useful trade off, and the second is that people don't really understand or consider the danger of the capabilities.

What are tracking links?

Tracking links or tracking URLs are hyperlinks that not only direct you to a website, but also record information about you when you click on them. These can appear in the form of shortened links, such as the common “bit.ly” service, or it can appear in the full link, usually beginning with a question mark or a slash then followed by a bunch of other information.

This is not to say that every shortened link contains tracking, although it's hard to tell without seeing the full link. Likewise, not every question mark or slash signals the beginning of tracking information. But they are the most common indicators.

What do they do?

Tracking links, as the name suggests, track information when you click on them. As a business owner, I understand the value of certain metrics. It's useful to know if the majority of your website visitors are coming from mobile or desktop so you know how much focus you need to give to making your site responsive. It could even be useful to know if they're specifically coming from Apple or Android devices in case you were developing an app and needed to know which to prioritize. For advertisers, knowing what site your visitors are coming from helps you know where your advertising is most effective.

However, as with most good technologies gone wrong, tracking links get so much more invasive than simple, useful metrics require. It's not uncommon for tracking links to be able to trace unique, personal information like IP address, MAC address, operating system down to which specific version or upgrade has been installed (ex: iOS 13.2). Some of them can even be used to track who sent the link, what time it was opened, other apps that are installed on the device, or websites that have been visited (this, I would imagine, involves the use of cookies stored on your device and therefore this becomes a coordinated effort from the tracking link). This is significantly more information than any website would need to know for metrics' sake, and it runs the high risk of identifying you personally in what's supposed to be anonymous data designed to help improve the site or service. Why does a recipe website need to know what other websites you've visited? What use does a clickbait article site have knowing the apps on the phone of the friend you shared the article with? It's a massive invasion of privacy.

Facebook's obnoxiously long tracking links

How can you avoid tracking links?

Thankfully, the easiest way to avoid tracking links on a desktop/laptop environment is to install uBlock Origin. The developer recently added a powerful tracking-link remover to the menus, which I explain how to enable here. However one should never rely solely on technology and should always know how to take matters into their own hands if necessary. (Also this solution isn't available for most mobile users.) The key giveaway is to look for the aforementioned questions marks and gibberish. A link that goes “https://www.website.com/article-title/gfm-feed-12456" probably doesn't need that last bit (“gfm-feed-12456”). I've found the most effective solution is to erase it and see if the link still works. If it does, congratulations! You've erased the tracking link and helped protect the privacy of both yourself and your friends! Same thing applies with question marks. “https://www.website.com/article-title.html?=feed-123456." Delete everything from the question mark on, and check the link. This does require you to learn how to read a link, but honestly it's not that hard. Usually key words from the title will appear in the link, and it's a safe bet that anything you don't recognize beyond “.html” is probably not required. It's also a good idea to check the link before sharing it. I've found as I post news links to The New Oil's Mastodon account that some websites have gibberish-looking parts of their URL that are actually necessary (Forbes comes to mind, their links tend to look something like “forbes.com/article-title/12356” but deleting the gibberish actually brings up a 404 error page).

Stripping tracking links will not negatively impact the necessary metrics of a website, and frankly it won't stop invasive data collection. Any owner interested in the analytics will still be able to tell who visits their site, what device, how long they stay, and a ton of other invasive information that quite frankly they don't need. But it will help to protect both your privacy and the privacy of those around you by removing small parts of the puzzle – the fact that you sent your friend to that site, for example, or other invasive information that helps corporations and governments create a more complete but unnecessary picture of you that can and usually does get abused. And the more we take conscious stands against this kind of stuff and show that we as consumers will no longer tolerate it, the less common it will become (hopefully).

Looking Ahead

January 4, 2020

I personally am indifferent to New Year’s demarcations. I can often be found on any given NYE at midnight sleeping soundly in my bed. That’s not to say I don’t care for them, I just don’t care about them. Having said that, I do think it’s important to set goals for one’s self, and the arbitrary (if necessary) line in the sand of “new year” seems like a good time to revisit that for anyone. As 2019 draws to a close, I am assessing the past year both personally and professionally – what worked, what didn’t, etc – and am planning what’s to come in the next twelve months. Once a month, I post asking for financial support on Liberapay for this project, and so in the interest of transparency I wanted to take just a moment to outline what my goals are for this project. I want those who do support me to know what I’m doing with their hard-earned money, and possibly entice those who are on the fence about supporting me. And as always, if you are unable to support financially, I am totally okay with that and appreciate simply interacting with my posts, sharing them, and similar free shows of support.

If I had to define 2019 for The New Oil in one word, I’d call it “successful.” I hate when people say things like “this project has gone beyond my wildest dreams” because we all know that’s not true. Even bands who keep their hopes in check have dreams of playing the Superbowl (or similar large-scale successes) and even I myself have similar dreams for the scope of this project. But I will say I am pleasantly surprised how fast I’ve grown, as well as the overwhelming outpouring of positive feedback and interaction I’ve received.

When I started this project, I had one goal in mind: I wanted to take privacy and security – particularly against digital surveillance of all kinds – and make it accessible to “normal” people – that is, people who aren’t programmers, system admins, tech enthusiasts, etc and make them realize that it’s not as hard as they think to take some basic-level protections. There’s tons of great resources out there, but it’s not accessible to people like my mom, my girlfriend, or my best friend. They don’t understand it, and they need a translator to explain it to them in terms they get. That’s what my goal was with this site.

When I started the project, I had the same dreams as anyone else, but I tempered them with realistic expectations: I expected a few followers, the occasional hater, and overall I assumed this would become a passion project with no real effect. Instead I was greeted with tons of positive feedback, from “great article” to “everyone check this guy out.” Just last month I got my first financial supporter on Liberapay and broke 100 followers on Mastodon. I’ve even got people asking me questions about my thoughts on things or how I recommend tackling certain issues.

I have to remember that I am still a small fish in a small pond. There are people who are much more knowledgeable about this stuff than I am. Honestly, I like it that way. Snowden once said that his biggest challenge in presenting mass surveillance to the public was how to take complex issues and explain them in a way that everyday people could grasp. By keeping myself out of the higher levels of technical skill, I force myself to understand things at a general-public level, which I think (or hope at least) helps me present these things to the general public in an understandable format.

In 2019, I think I successfully found a sustainable foundation for the site going forward. I formed a working solution for selecting and posting articles based on a criteria that keeps them mostly relevant to the site. I created a solution for posting blog posts weekly, thought that one really comes down to just being disciplined. I think I showed both myself and my supporters that I’m serious about this project.

In 2020, I want to expand. In the closing weeks of 2019, I took a leap and started my own home server. Right now I mainly use it for things like RocketChat and Nextcloud, but I also run a TOR bridge. This is something I’ve wanted to do for years, to do my part to support digital freedom. In the coming weeks I plan to add a second relay for regular TOR users. In the future, I’d like to run a PeerTube instance and maybe even a Mastodon instance, as Eugen has indicated that Mastodon is growing rapidly and needs more servers. I’m currently torn between buying my own server and renting a VPS through a provider. There are pros and cons to both, feel free to message me your thoughts that might help me make a decision. This is still some time off, for now I’ll stick to running to small, personal services on the old desktop tower under my desk. But I do hope to have a professional-grade server running more advanced services before the end of the year.

In addition, I hope to start hosting regular cryptoparties in my area. Cryptoparties are basically classes where you explain encryption and surveillance to folks and help them get set up with things like 2FA, encrypted messaging, VPNs, and other simple such services and concepts. There are a startling lack of them in my area, despite being a major tech town, and I want to remedy that. Ideally I’d like to do them once a month, but I think I may aim for once per quarter so I don't overload myself.

In 2020, I also hope to attract more financial support for this project. This will help me cover the obvious things like hosting costs, VPS services (if I go that route), hardware maintenance (if I go that route) and other related expenses. Any excess support would go to helping me cover my own bills like housing, transportation, and groceries. I’m not a materialistic person, I actually identify as a minimalist, so rest assured that any “excess support” is not going to paying for a new Lexus or an expensive house. It’s going towards a moderate apartment and a used Toyota, and maybe some frugally-executed vacations in the future. And also two cats. They’re not very expensive though.

In the long term, I hope to be able to travel and speak and more on this project, lending my help wherever possible. I’ve got a few EFF links I need to look into this weekend about signing petitions against facial recognition and such. I work closely with my local EFF chapter to help bring these subjects to the general public in my area. I would love to be more closely involved in these types of organizations wherever I can. I would love to educate wherever I can. I would love to offer services and solutions of my own, hence my desire to invest in servers.

The purpose of this post was partially to put my own thoughts in order, but also to express transparency and let you guys know what to expect from me in the coming year. Two goals are actually not much for me, as someone who’s constantly on the go. Today is supposed to be my day off, but in the four hours since I woke up I changed a small part on my car, rescheduled a doctor’s appointment, made an appointment for the cats to get their annual shots, wrote this blog, and checked into some payroll stuff at my day job, so I’m not really much of “day off” kind of person. I wish I had more goals for this project in 2020, so if you see room for improvement please don’t hesitate to message me and let me know. And also feel free to keep suggesting services and products for me to review and add to the site, I want visitors to have as many options as possible.

For those who supported me in 2019, thank you so much. You honestly do inspire me to keep going on days when it feels hopeless or meaningless. For those who are new to the site, thank you for joining and I hope it lives up to your expectations. For those considering supporting me financially, I hope this post has helped you make the choice either way by explaining what I hope to accomplish in the future. And for those who can’t do so, I hope you can support me by sharing the site, the articles, the blogs, or whatever else you find worthy of sharing, and I hope it helps make this important subject more accessible to the general public.

Why Your Individual Privacy Matters for the Wider Population

December 28, 2019

The other day I found myself talking with some friends about privacy and security. I was sharing that my partner had recently jumped on board the privacy train with me. That may surprise some readers to know that I chose to involve myself so closely with someone who didn’t share my views, but I think that’s pretty in-keeping with the message of this site: you don’t have to draw lines in the sand all the time, sometimes you can make compromises, and it's all about making educated decisions. Until recently, my partner respected my use of Signal for daily communication and my use of a VPN on the home network. She even lets me do stuff like set up her Firefox browser for her and disable a lot of the telemetry on her computer. Basically as long as it didn’t inconvenience her too much, she didn’t mind. But then her boss casually informed her that corporate is able to read all communications sent over the company WiFi. I’m not sure how the subject came up, and needless to say this wasn’t exactly a new thing, but something about being told to her face by the company itself (more or less) really rattled her. That night, without any prodding from me, she downloaded a VPN on her phone, switched to ProtonMail, and invited all her coworkers to use Signal.

As I was regaling my friends with this story, one friend spouted his usual response that privacy enthusiasts the world over have become allergic to: “I don’t really care about that stuff, my work can read my texts, I have nothing to hide.” He wasn’t dismissing my partner’s choices or criticizing her, just stating that he personally couldn’t care less. I explained to him that while he may not care, “arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.” (Edward Snowden, 2015). Basically while he may not care, he should care for others. That friend, for example, is bisexual, and is very open about it. He makes no effort to hide it. I explained to him that while he should absolutely have the right to not care if his sexuality is a secret, someone else should have the right to care and hide it for any reason so they so choose, including but not limited to “it’s nobody’s damn business.”

My friend immediately agreed with me and respected that. “But,” he countered, “I don’t understand what I can do. How does my using Signal or a VPN help them?”

“Three ways,” I offered. “Herd Immunity, economics, and normalization.” (Originally I tried to divide these into bullet points in this post, but I found them to be too closely intertwined to do so meaningfully.)

Let’s take an example community of 100 people. Let’s pretend all of these people use encrypted messaging of one kind or another. Lately, in real life, the FBI and Interpol have both been making the claim that End-to-End Encryption allows for the proliferation of illegal activities such as drug dealing and pedophilia.

According to The Hamilton Project, which claims to offer statistics to help lawmakers make better-informed decisions regarding policy in the United States, drug arrests in the US accounted for only 1% of the population on average in 2015. A WorldAtlas article from 2018 lists the total number of sex offenders (not just pedophiles) in the United States as 747,408. If the population in the US in 2018 was estimated at about 327.876 million, then that means sex offenders account for less than a quarter of a percent of the population.

So let’s be generous with our imaginary community of 100 people. Let’s pretend that a whopping 5 percent of them are criminals – not just sex offenders and drug dealers, but all violent criminals (in the United States, violent criminals account for less than 1% of the population). That means there’s still 95 people – 95% of the population – who are perfectly normal, law-biding citizens who use encryption for any number of completely legal, valid reasons, like trading sensitive information (in another blog post, I talked about how I can send my partner the credit card number safely in case of an emergency), avoiding unwanted surveillance capitalism, or any other of millions of perfectly okay things. If only the criminals were using that encryption, then it would validate what those agencies are saying. So if everyone were to use encryption, it invalidates those claims. It goes from looking suspicious that you use encryption to it just being something everyone does. Everyone wears clothes in public, too, does that mean everyone who wears clothes is hiding a weapon? Or drugs? Of course not. No agency would ever publicly state that we need to ban clothes because criminals use them to smuggle illegal goods, even though such a claim is rooted in a fact. Nobody ever says we need to ban airplane luggage because criminals sometimes sneak bombs in on them. We all know that privacy comes with risks, but we also know that as a general rule, criminals are a minority and just because some people are doing bad things doesn’t mean everyone else gets stripped of their rights. So why should you care about your privacy even if you have nothing to hide? Because it normalizes it. When everyone is using encryption, nobody looks weird for doing so. It goes from “what are you hiding?” to “of course you are.” Nobody ever looks at me suspiciously in public for locking my phone when I’m not using it, and nobody should be looked at suspiciously for digitally securing their public lives. This is normalization. When we all take basic, effective measures to protect our privacy, we stop looking crazy or suspicious. We normalize it.

Most of you reading this are likely familiar with the “anti-vax movement,” the belief that children shouldn’t be vaccinated for diseases like measles and mumps for a variety of reasons. This is a controversial opinion for many reasons, and I’m not going to get into it on this site so don’t bother contacting me about it. I mention it because of one specific argument that medical experts cite, called “herd immunity.” Basically, there are some people who cannot be vaccinated for safety reasons, such as a severe allergic reaction or complication to the ingredients in the shots, particularly among children and elderly. So the experts argue that the more people who get vaccinated who are able to, the less likely those diseases are to spread, and it protects the unvaccinated just as effectively. Basically, the whole herd is immune, so the one person who isn’t has such a low chance of encountering the disease that they’re essentially safe as well.

A threat on par with government surveillance is corporate surveillance (partially because the government has access to that information, and partially because it’s actually more invasive and effective than government surveillance, as is usually the case with these types of things). This surveillance is fueled not by the desire for control but for money (which inadvertently becomes about controlling you to make you spend money, but that's a blog post for another day). Corporations are trying to build the most accurate picture of you so they can sell you things. They don’t want to waste the money showing you fifty ads that may or may not convince you to buy a product or service, they want to spend money once to show an ad that will definitely make you buy a product or service. In order to do that, they need to know as much about you as possible. They need to know your hobbies, interests, which devices you’re watching on, what times you watch, what motivates you to spend money on something, and more. The biggest threat with this, as I said, is that it can be abused by anyone from state agencies to Facebook. So that’s another layer of reasoning to protect yourself from “surveillance capitalism,” as it’s called.

In the previous section, I argued that everyone should use encryption because it protects the people who actually need it. In this section, it protects the people who can’t. A popular notion in the privacy community is to delete Facebook. Really all social media, but Facebook especially. They are, by far, the most egregious offender in this realm. But for some people, that’s not always an option. Early in my career I worked a job where work was conducted via a secret Facebook group – schedules posted, bulletins to other technicians, etc. Not using Facebook wasn’t an option if I wanted that job, and since I was early in my career I needed any job I could get.

Going back to our 100-person community, let’s say 5 people can’t use encryption for whatever reason. Their phones are old and don’t support the option, the people they do business with can’t support the protocols for it, whatever one of a million valid reasons. If 95 people are using encryption, it stops making financial sense for corporations to keep sucking up all that data. The data – previously unencrypted, revealing, and useful – has become encrypted, unreadable, and useless. After a while, it becomes a financial loss to keep pouring so much funding into projects to scoop up all this data and get almost nothing from it, so they stop. After a while, that means even unprotected people are now protected because nobody is watching. This is both herd immunity and the economic angle. Herd immunity has protected the few who can’t participate, and the proliferation of security has made surveillance uneconomical.

Maybe you have nothing to hide (first off, that’s a blatant misconception: we all have things to hide whether it’s our bank accounts or access to our homes or cars or whatever). Even if you don’t, it’s selfish to assume that nobody else does, and while it may not seem as effective as going to a protest or becoming a hacker, even simple things like the products, services, and techniques shared on this site can add up and create a larger change, often at little or no expense to your own convenience or lifestyle. So I recommend you implement as much of this as you can, if not for yourself than for others.

The Privacy Myth: Binary vs Spectrum

December 22, 2019

In my time in the privacy community, I’ve noticed a prevailing myth. Sometimes this myth is brought in by newbies who have a preconceived notion. Sometimes it is inadvertently (or intentionally) perpetuated by hardcore privacy enthusiasts. But in short, the myth is the idea that privacy is a binary thing, an all-or-nothing game, go big or go home, start building your cabin in the woods or don’t even bother using two-factor authentication. Quite frankly, this is a crock of garbage.

Privacy and security are often sliding scales. It’s rarely a binary yes or no, but rather a spectrum. Very few people are 100% secure or 0% secure. If you use a password – any type of password, even “password” or “admin” – that’s a level of security above just having an open account or document. But that’s a poor level of security against a password such as “(z”a8j#;uU$>s!;–;6!G”. That’s a far better password with far better security. But even that’s only 20 characters, and can be improved. It’s almost always a spectrum.

Most of us, by default and the way we were raised, tend to fall on the “less secure” end of the spectrum. We use easily remembered – and therefore easily guessed or hacked – passwords. We don’t use 2FA. We use Google Search and Google Calendar and Gmail.

The goal of my website, as I’ve said before, is to nudge you to the “more secure” side of the spectrum. It actually doesn’t take much to get there. Using 2FA, password managers, and similar techniques discussed on this site will actually move you considerably far on the spectrum. Because the thing is, the spectrum is relative. If we have a group of 100 people and 90 of them aren’t using 2FA but you do, that automatically puts you in the top 10% of the “most secure” spectrum. If the other 90 people add 2FA, the bar has been raised. Sadly a lot of the techniques I share on this site aren’t being used by the majority of people, so just doing these basic things dramatically moves you along the spectrum.

Now I do want it to be noted that where you need to be on that spectrum depends heavily on your threat model. So while Person A’s threat model may be as simple as 2FA and a VPN, Person B might have need of secure messaging and even extra protection against location tracking. Person C might opt to not even have a phone and live in an apartment rented in cash or a shell corporation (totally legal, I assure you). It’s different for each person.

I encourage you to go as far as you can and do as much as you can for the sake of herd immunity. If everyone uses encrypted messaging or a VPN, then it doesn’t stand out and look suspicious, and it makes reading the traffic uneconomical for the companies who do it. But at the end of the day, you’re still doing something even if you only do a little bit. Some people – including your own doubts – might lead you to believe that if you aren’t going whole-hog – deleting Facebook, deleting Google, and hosting your own email server – then you aren’t doing enough. Those are certainly great things to do if you can, but honestly don’t listen to those people. If you eat two dozen donuts every day for breakfast and suddenly decide to cut down to one dozen, you’ve still made a difference. It may not be enough to run a marathon and you'll probably still have some health problems, but it’s certainly better than eating two dozen and it may even be the first step towards a healthier lifestyle in the long run. Don’t let anyone make you feel bad for not going as hardcore as them. It’s a journey, and there is no one-size-fits-all solution. Do what you can and go from there.

Safe Shopping

December 2, 2019

With gift-giving season officially in full swing in the United States (and at least a few other places, I presume), I figured this would be a great time to discuss safe shopping tactics. I don’t feel like this needs any sort of real introduction, it’s pretty self-explanatory, so let’s begin.

Pay with cash in person. In general using your card is a bad idea for both security and privacy. In addition to the risk of having your card number stolen, there’s also the privacy invasion of having banks selling your shopping habits. Both of these risks can be eliminated completely by simply paying cash wherever possible. This also helps if you’re buying a gift for someone who has access to your bank statements (significant other, parent, etc). They can’t see how much you spent or where.
For online transactions, use pre-paid cards or card-masking services like Privacy.com and Blur to avoid having your real information stolen. Be aware that Privacy.com essentially functions as a bank, so they will ask for some personal information that some people may not be comfortable with. Blur is a little less invasive, but you’re basically just creating digital pre-paid cards. Personally I’m a fan of Privacy.com for a lot of reasons, but this isn’t the time or place. Feel free to check out their site and see if it’s right for you.
Use HTTPS. HTTPS is a powerful and effective encryption method for data-in-transit (aka web traffic) that helps protect your sensitive information as it shoots across the web. The vast majority of the internet is now securely encrypted but why take any unnecessary risks? The web browser plugin HTTPS Everywhere will automatically ensure an HTTPS connection wherever it’s offered, regardless of search engine or browser settings.
Use a VPN. VPNs are popular for people looking to change their location online to do things like get around country restrictions on YouTube or Netflix, but they can also serve a number of other purposes, such as providing additional encryption and security, especially if you're a fan of using public wifi such as the library or coffee shops.
Use a PO Box. PO Boxes can serve tons of great purposes that you didn’t even know you needed. For starters, they start off inexpensive, in some places as little as $20/year. They can be handy because your packages don’t sit unguarded on your porch while you’re at work, they sit safely inside the building of your box. And of course, you don’t have to worry about some stranger on the internet snagging your home address, whether that’s the random person on Etsy, the rogue employee at Amazon, or the hacker who hopefully didn’t steal your information because you already implemented the above bullet points.
Don’t quit on December 26. The thing about these habits is that they’re great year-round, not just around the holidays. Shopping is something we do all the time, all year, and these strategies can be implemented there, too. You can pay cash at the grocery store. HTTPS and VPN encryption can protect your Facebook login just as much as your card number. Online data breaches are quickly becoming a daily occurrence, so using card-masking can prevent your card number from getting permanently posted to the dark web (if you’re not worried about that, clearly you’ve never had the hassle of updating EVERY service you use after a card number changed for any reason). Even a PO Box can be a neat thing to have on hand if you rent and move in the same area frequently, if you need an address on file for work (again, data breaches), or freelance and need somewhere to send checks or a return address for merchandise you sell.

Take some time to think about which of these strategies can benefit you most. HTTPS and VPNs are things that take just a few minutes to set up and you never have to think about them again. A PO Box can be easily added into your routine by renting one nearby or on your way to/from work (if you have a concern about stalkers, you may want to consider getting one in a nearby town instead). Cash can be handy as well to help you stick to a budget. I hope these tips help keep you safer online this holiday season, and good luck finding that perfect gift!