The New Oil

Decentralized Communication: The Way of the Future

May 3, 2020

I mentioned last week that Signal has earned my skepticism and I’ve decided to move on to Riot as a replacement. There were a number of factors that went into this decision, and I spent weeks doing my research. Factors considered included user friendliness, multi-platform support, security features, and privacy. But one of the biggest concerns that went into that choice was decentralization. You see, I think decentralized communication is the way of the future in the sense that it’s the safest way forward.

The Problem of the Past

In the past, communication has been largely centralized. While the message itself may bounce around from server to server, all the servers are controlled exclusively by a single entity or set of entities. When you, a Verizon subscriber, text your friend, a Sprint subscriber, the text stays isolated in those two networks. Because of the proprietary and monopolistic nature of those networks, they are extremely vulnerable to government and social pressure. In other words, it’s real easy for your text messages to be intercepted, read, and even altered or blocked for any reason. Maybe the government doesn’t like your activism. Or maybe you were just born a way the government didn’t like. Maybe you just hold socially unpopular opinions that the providers don’t want to help propagate, even if you have a legal right to hold those opinions.

The Solutions of the Future

Decentralization, as the name suggests, works by making a network run on a variety of providers rather than a single centralized network. Take the Tor network, for example. As I type this, I have an old computer under my desk at my feet running a tor middle relay. Nobody authorized me to do that, I didn’t have to get a license or register with the government. I just needed the hardware and an internet connection. And this applies to anyone in the world, so if the state government came knocking down my door and carried off my relay, people in other states could still run them. And if the federal government outlawed them, people in other countries could still run them. In fact, Tor is a popular tool used in countries like China to help bypass censorship. Because of its decentralized nature, Tor is extremely hard to squash.

We are facing an increasingly hostile environment in the privacy world. The California Consumer Protection Act is often called “GDPR Lite” because it gave California residents so much protection from the sale of their personal data by data broker companies, but the state organizations like the post office and the Department of Motor Vehicles were explicitly exempted from the rules. The FBI and Interpol have both declared end-to-end encryption to be a menace. The US is explicitly working on a bill that would allow them to outlaw end-to-end encryption. Governments around the world are beefing up their surveillance each day, and personally I find these developments disturbing. Even if you genuinely believe they aren’t doing anything bad with those capabilities right now, having the framework in place is dangerous, especially in the modern world where leadership and agendas change every few years. All it takes is one bad leader to abuse the power, and the infrastructure is already in place.

I’m not here to tell everyone to get off Signal or Wire and switch to Session or Riot. Those solutions are still valid, and hopefully all these anti-encryption efforts and censorship trends die off and become nothing. However, I sadly personally find myself regularly disappointed by people and their astounding ability to remain passive and apathetic to clear assaults on their civil liberties that should’ve warranted resistance many times over. So personally, I’m placing emphasis on self-hosted and decentralized solutions in the future to try to prepare for this eventuality.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...

Why You (Yes You, Reading This) Need to Take the Lead in Privacy & Security

April 26, 2020

I have a lot of my friends on encrypted messengers. Some of them even have an encrypted email provider. But for a lot of them, I’m the only person they communicate with using those services and when I try to convince them to get their friends and family to join, they respond with something along the lines of “they just don’t care about privacy or security.” But it’s up to you to lead the charge into an era of privacy and security, and here’s why:

1. They Probably Won’t Do it on Their Own

Humans are creatures of habit, and it almost always takes some sort of external force to get us to change our ways. That could be a simple as stepping on the scale one day and going “holy crap, I didn’t realize I put on so much weight” or as serious as a near-death experience that forces us to quit drinking and find Jesus. It could also be as simple as your close friend or family member asking you to download a messenger app, or explaining to you why Facebook is bad. Chances are you, the person reading this, didn’t just wake up one day and go “I should care about my privacy.” You probably read an article, saw a documentary, had a chat with a friend, or were a victim of some sort of data abuse. Your friends won’t just wake up one day and start using Signal. You have to guide them into it.

2. You Have to Normalize It

Even right now, with headlines about privacy and data abuse at an all-time high, I still regularly run into the same resistant arguments: “I have nothing to hide,” “they already know everything about me anyways,” “I like Facebook,” etc. But when you insist on this stuff, it normalizes it. I talked in another blog post about the idea that if everybody used encryption, it wouldn’t seem suspicious or weird. I used clothes as an example: nobody ever looks at somebody in a coat and goes “oh, what are they hiding?” They think “oh, that person must be cold. Fair enough.” (Unless maybe you’re wearing a coat in Miami in the summer.) When you insist on using privacy-protecting services and practices, it normalizes it and people respect that. Once, at work, the marketing guy asked if it was okay to post a picture of me on the company’s Facebook page celebrating that I had achieved a major certification. I’m sure legally he had every right to do so, but he respected my privacy and knew I hate Facebook and wanted to be sure I was okay with the information he was planning to share. (And, actually, the post was fine by my standards. I gave the okay.) When you normalize privacy, people will respect it and not think of it as strange.

3. It’s a Moral Issue

At the height of the 2016 election, when I was sadly still a Facebook user, I saw a meme that still makes me chuckle and I wish I had a copy of it. A friend of mine was third-party and was vehemently opposed to the “two party system” that US politics has evolved into. He posted a meme once of Jesus teaching the masses saying “when confronted with two awful candidates, always pick the lesser of two evils because doing the right thing is a waste if nobody else is doing it.” Privacy is the same. Just because Facebook already has your data or because nobody else cares about their privacy or security doesn’t mean you should sacrifice your own. Don’t be afraid to take a moral stance. Of course, don’t be a self-righteous dick. One of the reasons our marketing guy at work respected my views on Facebook is because I’m not arrogant about privacy. I will definitely tell people why I don’t want to use a certain product. When we finally started working from home in the wake of the pandemic, I sent my boss an email politely requesting that we not use Zoom, citing my reasons why, but also explaining that I knew we had to do what was best for the company in the end. Originally he had planned to use Zoom, but decided at the last minute that Google Meet was better for us since we already used G-Suite products anyways. I don’t know if I had anything to do with that decision, but I’m certain I didn’t do any harm. Stand up for your convictions, but also balance it out with a healthy dose of respect for others and reality of the situation.

4. Most People Will Humor You

Today, I messaged my mom on Signal and told her that I’d like to switch to Matrix. I explained that lately Signal has been doing some stuff that I don’t fully approve of, and I feel like Matrix better fits my values. I also explained, however, that I will be holding onto Signal for those couple of people who won’t bother to switch. Despite it’s recent issues, Signal still has top-notch security and I would rather people use Signal than Facebook, WhatsApp, or regular SMS, so I’ll be keeping Signal to talk to them. I definitely expected my mother to be one of the people who would reply with “no thanks, I’ll stick to Signal” but to my surprise she asked me to send her a link to a Matrix client. I had to walk her through some steps over the phone but eventually we did get an encrypted room set up for us to communicate and now we’re on Matrix. The point is, most people will humor you. More often than not, your friends value you and respect your values even if they don’t share them. Your friends probably won’t humor you if you ask them to delete Facebook, but if you ask them to switch to a user-friendly app like Wire or ask them to use an encrypted email provider like Proton or Tutanota, they probably will when talking to you. (I made the deal with my mom that if I set up a Proton account for her, she would be willing to use it, and she has.) And while they may only use these apps with you, that’s better than nothing. And it opens the door for you to explain to them why you want to use these apps, how it benefits them, and why they should get their friends and family to use them as well. But it all starts with you.

But How?

Honestly, my best experiences have always come with approaching it from a place of transparency and humility. When I started using encrypted messengers, I asked my friends and family if they’d be willing to switch, explaining that I don’t want my cell carrier reading my messages. Only one person resisted the change, and that was cause he didn’t have room on his phone for another app. Eventually even he came around once he had a bigger phone. When I start dating someone, I tell them up front that I’m very interested in data privacy and that if things go well I’ll probably ask them to use some type of encrypted messenger. You’d be amazed how often that person asks which one and starts trying to set it up without me even officially asking them to switch. It’s shocking. The important thing is to be patient with people, to explain to them why it’s important to you, and realize they’re doing you a favor. In the end, it may grow on them. My mother asked my sister to start using Signal without me prompting her at all. My partner got all of her coworkers and some of her Facebook friends on Signal with no input from me. But it all starts with you taking the lead and being the example.

Website Overhaul

April 12, 2020

Today, I don't have a blog about a new app, a new concept, or a news article. But I do have a current even to share: I have completely redesigned The New Oil from the ground up. I have deleted some of the old, redundant blogs but kept some of the others that cover things the website doesn't.

As you'll learn from visiting the new site, I have decided to change the site to a more e-book style layout. There's already a lot of great websites out there that have lists of tools, and they are fantastic at what they do. The problem with those sites is none of them (that I've seen, at any rate) help you make a decision. They just go “here's five encrypted messengers” and it's up to you to understand which one is right for you, what the pros and cons are, and why certain messengers are or aren't listed on the site. That was one thing I aimed to fix when I made this site, and it existed in the original version: a table that lists the pros and cons of each service to help you decide what's right for you.

However, more and more I'm seeing people get introduced to the privacy community with questions and comments like “where do I even start?” or “what are some behaviors I should change?” or, sometimes, “how do I do X?” not realizing that X requires behavior changes and not just an app. So I decided the site was due for an overhaul.

For a while now I've been considering writing a book (as everyone does) about these very subjects, but I realized that a book will quickly become outdated. Plus, I think important information should be free, and I think surveillance defense counts as important information. So I decided instead to roll these two projects into one. I rewrote the site to be an e-book, complete with links and everything. This will allow me to go in-depth into various concepts, subjects, behaviors, and recommendations, but because it's also an active website, I can keep the content current and updated.

As I say in the site/book, any major changes will be noted here on the blog. In the meantime, I will probably continue to use the blog to talk about things that fall outside the scope of the site, and maybe even discuss major current events relating to data privacy. I welcome all discussion about the site itself and the content within, so please feel free to let me know if you see any room for improvement. Just remember: this site is built for the “average person.” It's not aimed at people who are willing to set up a home server, self-host their email, put Lineage on their Android device, or any of the other more advanced techniques. It's designed for the people who are willing to switch email providers, download Signal on their iOS device, or use a password manager. Don't get too caught up in the weeds.

Thank you for your support, and I hope this new design continues to serve my audience well.

The EARN IT Act

March 21, 2020

If you are even slightly involved in the privacy community, you’ve probably heard by now about the EARN IT Act. If you’re relatively involved in the privacy community, you’re probably sick of hearing about it by now. But it’s important we need to talk about it: what it is and what to do about it either way.

What is the EARN IT Act?

S. 3398, also called the EARN IT Act of 2020, is “A bill to establish a National Commission on Online Sexual Exploitation Prevention, and for other purposes.” Basically, Senator Lindsey Graham and the National Center for Missing and Exploited Children have decided that end-to-end encryption is bad because it allows the proliferation of things like child sexual abuse, human trafficking, and drug trafficking. Without this side-tracking this post too much, the number of registered sex offenders in the US is less than a quarter of a percent of the population in 2018, and drug arrests account for only 1% of the US population (this post has more context, information, and my sources). So first of all, arguing that nobody should have encryption is a lot like saying nobody should have clothes because a few bad people use it to smuggle illegal items, or that nobody should have food because some people use silverware for murder. It’s ridiculous and blown out of proportion. But that’s exactly what the EARN-IT Act asserts. It’s a law that would ban end-to-end encryption, the most secure form of encryption around, and force all encryptions to have a “backdoor” for law enforcement. The problem is there’s no such thing as a backdoor that only the good guys can access. Just as your own house door can be broken into by a criminal, so can a technological door. The amount of personal liberty we’re giving up is not proportional to the amount of good it would do.

What to do about it

The bill was introduced earlier this month and is still in the very early phases of the legislative process. So that means there’s still tons of time left to fight it. The most effective way, of course, being to call your local politician and tell them you’re a voter in their district and you want them to vote against it. Don’t know who your politicians are? EFF has made this very handy site that will look them up and email them for you. But calls are more effective than emails, so use this site to find your representatives by zip code, and use this site to find your senators by state, then use DuckDuckGo or the direct links on the Senate and House websites to get the phone numbers of their offices nearest you. Then save them in your phone and set an alarm to call them every day and remind them you are against the EARN IT act. Typically all they ask is name, zip code, and your comment. You can leave it at “I disprove of it and want them to vote against it” or you can go on a whole diatribe about how it’s an assault on civil rights and statistically ridiculous. Just be polite. Finally, you can sign an official White House petition against the EARN-IT Act here. This alone won’t be enough to repeal it, but the more signatures it gets the more it shows that Americans don’t want this bill.

What to do if it passes

If this bill passes, we face some trouble, so it’s best to get your ducks in a row now. One solution is the previously-mentioned Firechat app that I shared in my COVID-19 post last week. Since this app stays off cell networks, it’s undetectable and therefore uncensorable. I first learned of it myself because of the role it plays in the ongoing Hong Kong protests.

Another open-source solution I mention on my site is Matrix. Encryption is not enabled by default but is activated easily with the click of a button, and with a little extra work it can bridge to a variety of apps and services.

The TOR Network is another valuable tool, but because it is easily recognizable it can also be easily blocked by internet service providers. So while that is a service to keep in our pockets, it’s important to have alternatives as well. VPNs are likely to not be affected as they are not end-to-end encrypted, but their no-logging policy may come under fire next.

Additionally now is a good time to get comfortable with PGP encryption, as this is a local type of encryption where the keys are stored on your device and you don’t have to rely on anyone else for the security or effectiveness of it. It is most commonly used via email, but it can be used for other types of data-at-rest encryption as well.

Mesh networks are a more complicated solution, but they are a potential solution and hopefully we’ll see them become more user-friendly in the future as a result of this attack.

As I said, now is the time to look into these solutions and start planning as it may be much harder to access these services if the bill gets passed. Hopefully we won’t need them, but better safe than sorry and preparation is key. I plan to put up more posts and tutorials on these subjects in the coming weeks. Up until now I’ve been putting them off as I didn’t think they concerned the average user, but clearly this is no longer the case. In the meantime, the best course of action is keep bugging your elected officials and hopefully this won’t be an issue in the near future.

Let’s (Not) Talk About COVID-19

March 14, 2020

I’m a little salty. The COVID-19 panic has finally hit my hometown late this week as three confirmed cases popped up in my relatively-large town of over 1 million people. Earlier this week I stopped by the grocery store and it was business as usual. Yesterday my partner gave me a play-by-play of all the people that almost ran her over and sent me pictures of the empty shelves. I’m frustrated because I personally fall into the camp of “the seasonal flu is statistically more dangerous at this point, this is just public panic over nothing.”

Over the past few months, I’ve been publishing a lot of articles on Mastodon about hospital data breaches. It’s a topic I’ve been mulling over, figuring out how to best address the situation. After all, you want to be honest with doctors to get the right treatment but you also don’t want your personal information posted on the dark web simply because you decided to be healthy.

So today I’ve decided to roll a number of topics together to talk about how to handle your privacy in times of a pandemic (or a media panic over nothing). This article is probably going to run a bit longer than my usual post, so bear with me.

How to Handle Hospitals

Even if you’re the type of person to “take an ibuprofen and tough it out,” chances are you will eventually have something serious enough to warrant visiting a hospital, even if just out of caution. So let’s start with how to handle those. Rule number one: don’t lie to your doctor. They became a doctor because they wanted to help people and you’re just wasting their time and risking your own life by lying. Having said that, not all information on a hospital form is mandatory. When they give you the paperwork to fill out, I would ask them what the absolutely essential parts are. I’d also ask if they have a form allowing you to opt out of any data-sharing agreements. They won’t advertise that stuff, but they usually have it. The questions might catch them off guard but ultimately as long as you’re polite and cooperative they don’t really care.

Get a PO Box

I’ve mentioned before some of the benefits of a PO Box. They’re cheap, and they put another layer of protection between your real home address and the public world. And at no additional cost (through USPS, private places may charge) you can sign up to use your PO Box as a street address, which means nobody will even notice that it’s not a real address. This is great for things like hospital forms or employer records as they give those people a legitimate way to get in touch with you without risking your home address showing up in a data breach.

Get a Voice-over-IP (VoIP) Number

This is a thing that deserves its own article and will get one someday. A VoIP number is, in short, a digital phone number that forwards to your real number. I recommend MySudo, but there are plenty of options out there. Keep in mind that no VoIP app is perfect for total privacy, but at least it removes your real number from potential data breaches and public records (I’ve got an article in the works about why that matters but for now just trust me that it does, it’s too much to get into in this already crowded article).

Freeze Your Credit

As is usual in times of chaos, scams are on the rise. So make sure to protect yourself and your dependents: freeze your credit and set fraud alerts. Thanks to the Equifax data breach, freezing your credit is now free by federal law in the US, and identity theft of minors is one of the leading cyber crimes. Freezing your credit will ensure that nobody can open an unauthorized account in your name. Even if you don't suspect yourself of being a target or you argue that your credit is too awful to be useful, rest assured that someone will always be able to open a high-interest account for you that a criminal has no intention of every paying off and now the task falls to you to jump through a million legal hoops and prove it wasn’t you. Just avoid it. Set up a credit freeze, and furthermore set up fraud alerts. Lately people have been finding very easy loopholes to unfreeze credit without a PIN – which defeats the whole purpose. A fraud alert is a second layer of protection to help defend against that.

Pay in Cash

This is kind of one of the foundational principles of privacy and data security. While credit cards do come with a lot of convenience and a few legal protections, the transaction information can and often is sold or shared from your bank to various third parties for advertising purposes. Paying with cash removes that tracking trail. I suspect – pardon my tin foil hat – that it’s only a matter of time before your shopping habits are used to determine things like approval and rates for loans, insurance, and other important aspects of daily life. While I realize that most people in the US can't afford to pay for a hospital visit in cash, you can probably at least buy things like your medication in cash, which helps.

Take Up a Passing Interest in Disaster Prepping and Personal Finance

Admittedly for some of us, this might be too little too late, and of course there's entire blogs, books, websites, and podcasts on both of these subjects so this isn't really going to be a detailed primer. But honestly, there’s a lot of overlap between the worlds of privacy, personal finance, and disaster prep. For example, disaster prep says “plan for the most likely scenarios first – emergency hospital visits, economic collapse, etc – before you plan for the zombie apocalypse.” Personal finance would agree with that logic 100%. Privacy says “use credit as little as possible because it tracks you,” and personal finance would agree that not relying on credit and staying out of small-time debt is a great idea (disaster prep agrees on that last one, too. If you have no debt, you have one less bill to worry about when the economy tanks). Disaster prep doesn’t mean building a doomsday bunker in the backyard with a thousand guns, it means having an emergency fund and a case of bottled water in the pantry just in case. Again, these are topics that are far too broad to get into in a single blog, and for the most part they are their own separate subjects that warrant pages and pages of discussion. Basically, these aren’t subjects I plan to get into too much ever because they simply fall outside the subject and scope of this site (maybe a few posts here and there in the future on relevant subjects). But they do offer some relevant advice on both the current situation and your privacy in general and I encourage you to look into the subjects.

The Aftermath

Okay, allow me to put on my tinfoil hat here, and if this section jumps the conspiracy-theory shark too much for you I completely understand and respect that and I hope you’ll still extract the meaningful advice in the rest of the article: I think we are going to see a suspension of civil liberties as a result of this epidemic. I think for the most part, it’s going to be well meant (and ineffective). However, just like the Patriot Act and the TSA, I think any such suspensions will be here to stay. In 2001, terrorists attacked the World Trade Center in New York and forever changed the course of history in both politics, war, surveillance, culture, and more. Many of our basic freedoms were suspended in the name of “The War on Terror” and to this day – nearly two decades later – we are still fighting to get many of them back. Already we have seen entire cities and regions quarantined, we’ve seen cities ban large gatherings (some as “large” as 500), we’ve seen the government demand more travel data from airlines to track the disease (many Asian countries have already ramped up their surveillance states to successfully combat the outbreak), and I wouldn’t be surprised to see curfews and other such things in the near future. Again, I’m certain that in most cases this is being done with the best intentions. But once Pandora’s Box has been opened, it is so damn hard to shut it again. So as the world scrambles to stop the spread of COVID-19, let’s be sure not to let our fear take us down that road again. Make sure that our civil rights continue to be respected, and make sure they are restored to us as the panic begins to wane. Hold your leaders accountable for that.

Conclusion

Again, I fall into the camp of “I think people are overreacting,” but whether I’m right or wrong we are facing some scary times ahead. Major events are being canceled worldwide, which will lead to economic implications (here in my town we’re already seeing the trickle down). Travel is being restricted, and whole areas are being quarantined. This is going to be a disruption to our daily lives, and it’s important to remember to protect our privacy as well as our health. Please, do visit a hospital if you think you need to. Buy some cold medicine to help with your symptoms. But remember to keep your privacy intact as we all push through this.

A Personal Note from the Author

I mentioned that in my hometown we are already seeing a trickle-down of economic impacts. Here in my home state, our capitol Austin has already canceled the legendary, multi-million-dollar South By Southwest (SXSW), an international week-long music and technology festival that happens every spring in. It’s a huge deal for their economy. This is the first time in over 30 years that’s happened. In response, SXSW had to lay off 1/3 of it’s permanent staff. Elsewhere, all of our local major events centers have canceled all their events for the rest of the year, including sports, concerts, expos, and more – we’re talking arenas that seat tens of thousands. We've also canceled tons of other major economically-advantageous events like rodeos, cities are urging gatherings of more than 250 people to cancel, schools are canceled (or moved online wherever possible), the Austin racing track – which hosts F-1 and Indy and all other international events – is closed. I've heard the Austin City Limits festival is also cancelled, but that's not until October so I don't know if that's true.

My day job is audio/video. I currently work for a small audio/video installer – “less than ten people” small. Yesterday our owner (who is very transparent, which I appreciate) sent out an all-hands email letting us know that times are already getting tough. One of our clients – which was one of these ten-thousand-seat arenas – is having to push back working with us because of funds lost due to cancelled events. Another client that was set to start this month – a college – is also having to push back because of the scramble to move to online classes. Two other clients that were set to start this month – both tech companies – are pushing back because of the disruption of the epidemic. Our owner is doing everything in his power to keep us afloat and not cut any hours, but he is admittedly worried. We were already in a slow season as it is, and now almost all of our upcoming projects (and certainly all of our highest-paying ones) are pushed back indefinitely.

Without going into detail, I assure you that if hours are cut or people are laid off, I will be first on the chopping block. I don’t think it has anything to do with the quality of my work, my work ethic, or me as a person. It’s just a logical choice and one that I wouldn’t blame the owner for making. It’s the same choice I’d make. And I have no doubt that we are not an island – this disruption is happening industry-wide, so despite my impressive resume (I’m serious, I have a fantastic resume) I don’t think I would have an easy time hopping to another job simply because I suspect nobody is hiring right now.

I say all that to say this: I realize times are about to be tough for everyone if they’re not already right now, but I’m facing a pretty scary time ahead as my industry is not essential and neither is my position with my day job. As such, I will be leaning very heavily on side projects like this one and the generosity of its supporters. So, if you are in a position to give anything to help support this project and myself during these times of uncertainty, it would be extremely appreciated. And if you are not in such a position, I get it. Just try to stay healthy and weather through it. Thank you for reading.

https://liberapay.com/thenewoil

Author's Update, May of 2021

I've meant to add this addendum for quite some time but never got around to it before out of a combination of laziness and business. I just wanted to say that obviously when I posted this, COVID was still in its early stages. I don't believe in revisionism, so I don't want to simply delete the arrogant and incorrect views I had at the time (ex, thinking that people were overreacting or that COVID was not a big deal). Especially now, over a year later, my vaccination side effects F*CKED. MY. WORLD. UP. If that's just a fraction of what COVID is like, then I cannot express how wrong I was. At any rate, I also didn't want to leave these views up unchecked so that people think that I still hold those views. So I just wanted to add this quick note to say: I was wrong. I'm not too proud to admit it. COVID was a big deal – if not medically then economically. I was wrong to brush it off, but at the time I simply didn't know. After seeing the scope and the effects, I know now. I'm sorry if anyone thought I was a jerk, I wasn't trying to be, I was simply uninformed. My views have since changed.

One Size Does Not Fit All

March 7, 2020

There’s a problem prevalent in some of the more experienced members of the privacy community: the problem of assuming that privacy and security are binary, that one size fits all. As I peruse questions from new people freshly introduced to privacy, I see more experienced people throw out ridiculous solutions. For example, I often see the question in other forums “should I use ProtonMail or Tutanota?” and without fail there’s always one person who says “self-host your own email. It’s more private cause you own your own data, and more secure because you don’t have to rely on anyone else and you’re not a target for attackers the same way a big company like Proton would be.” These answers aren’t technically wrong, but I find them ridiculous for a number of reasons. For one, there’s the technical obstacles: I have my own Nextcloud server at home and I promise you that was not easy to set up. No average person has the time, energy, resources, or sometimes courage to do that. For another, security is relative. I personally would rather trust a major company rather than trust myself to create a “secure” email. I am far from a cybersecurity expert. I think even a big target like Tutanota would be more secure than my garbage server at home. And there’s that: most people don’t have a spare computer lying around, and they’re not willing to go buy one just to spend weeks starting over and agonizing over how to get it barely working like a Rube Goldberg machine made of tinker toys and duct tape. The thing that most makes these solutions “ridiculous” however, is the egotistical assumption that their offered solution is perfect for everyone.

Privacy is Not Binary

Privacy is a sliding scale. Privacy is not a matter of “delete your Facebook and use Signal and now you’re secure.” Deleting Facebook from your phone makes you MORE secure than keeping Facebook’s app on your phone. Using Signal makes you MORE secure than using regular SMS. Doing both makes you MORE secure than doing just one. However, doing one is still better than doing neither. Deleting Facebook altogether is a great idea for so many reasons, but only accessing Facebook from your browser is MORE private than using the phone app. There is a gray area in between “go live in a cabin in the woods purchased under a fake name” and “post your Social Security number on Twitter.”

Privacy is Not One-Size Fits All

More importantly, privacy and security is not a one-size-fits-all solution. That’s exactly why I’ve organized my site in a “pros/cons” format. Using instant messaging as an example, Signal is world-renowned for their security and it’s ease of use, but it requires a phone number. That can be an issue for someone trying to maintain a degree of anonymity. Some people aren’t worried about that. My mom doesn’t care about privacy. If I want her to respect my private communications wishes, I have to find a solution that’s easy for her to adopt, and it doesn’t get much easier than Signal. In the early days of my career, I worked a job where work schedules and announcements were disseminated via a private Facebook group. If I didn’t at least have an account to access the group, I didn’t get my schedule or important updates. And that early in my career, I was still very much in the “take any job you can get” phase (these days I have a more robust resume and I can afford to be picky).

There are many, many valid reasons that a person may choose to keep their Facebook account. Or WhatsApp. Or Gmail. Or Windows operating system. There are even more valid reasons that a person may choose to use a service someone else created and hosts like Firefox, Wire, Tutanota, Bitwarden, and more. Privacy and security are not black-and-white “either you are secure or you aren’t.” In running this site, I have made myself less secure by creating a public image, posting regularly, and engaging with others. If I wanted total privacy and security, I wouldn’t do any of that. I would stay off the internet. But I’ve also reduced my “attack surface” by doing things like using services that don’t require a real name, using the Tor network to post, and using services that don’t track me such as Write.As and Mastodon.

I will always encourage you, my reader, to be as secure and private as possible because digital rights are human rights. But don’t let the more elitist hipsters of the privacy community fool you: if you’re reading their opinion online, they could be doing better as well. There are circumstances that sometimes require you to take a less secure option: work requires you to use Apple products, or your family simply refuses to leave WhatsApp, or you need Twitter to stay updated on a local issue, etc. I will always suggest you opt out of those things as much as possible and find workarounds, but I will also respect that that’s not always possible. And while you should try to be as strict with your privacy and security as you reasonably can, don’t beat yourself up. The fact that you’re here means you’re going in the right direction, and sometimes it’s enough just to lock your doors and windows.

The Question of Trust

February 29, 2020

About once a week or so, I see a post in the privacy community that says something along the lines of “If Product X is open source, how do we know The-Company-Behind-Product-X hasn’t just modified the public code to look good while secretly running something else on their servers?” The short answer is: we don’t.

You Always Trust Someone Somewhere. Always. Period.

My dad is one of those “I walked uphill in the snow both ways to school” types. To his defense, this is isn’t always a bad thing. His attitude taught me a lot about self-reliance, taking initiative and control of my own future, and self-improvement. That was a good thing. But I remember one time where I was completely broke through no fault of my own. I don’t believe in playing the victim. Almost always you got yourself into a situation and you should take responsibility for that.But sometimes things happen that are genuinely out of your control and you truly are the victim. It’s rare (on an individual level) but it happens. I had three sources of income at the time and all three failed to pay me for reasons that – in all three cases – were legitimately out of my hands. I’ll never forget my dad telling me that it was my fault, that I should never trust anyone for anything and there had to have been SOMETHING I could’ve or should’ve done differently. To this day, over a decade later, I insist my dad was full of crap about that particular situation.

The fact is, you ALWAYS put SOME measure of trust in SOMEONE SOMEWHERE. Always. Period. Without question. You trust that your boss is going to pay you when you show up for work. You trust the other drivers to stay in their lanes when you drive (for the most part). You trust the food you get at the grocery store to be safe. You trust the construction of your home. You are ALWAYS trusting SOMEONE at SOME POINT. Even if you demand to be paid up front, you’re trusting that the check won’t bounce. Or that the economy won’t suddenly spiral into a recession with hyper inflation. Or that your bank won’t spontaneously close your account. Or that they won’t give you counterfeit bills. You are ALWAYS trusting SOMEONE SOMEWHERE. End of story. Period.

Trust and Due Diligence

The privacy community is a paranoid one. Sometimes that’s good, and sometimes that’s bad. A little paranoia is a good thing in a world where data breaches aren’t disclosed, apps and services lie about what they’re really doing, and companies are aggressively going out of their way to track you. But too much paranoia is bad. Uncontrolled paranoia can lead to problems like anxiety, depression, suicidal thoughts, and other legitimate mental health concerns. (If you suspect you might be spiraling or have spiraled into that territory, please seek help. You are not alone.)

The point is that it’s about balance. Trust should not be blindly given in almost any context. You wouldn’t hire a random person off the street to babysit your kids, you wouldn’t pick a bank you’ve never heard of to manage your money, and you shouldn’t pick services you haven’t researched to safeguard your sensitive information, metadata, and communications. You should absolutely do your research. Is the company/app/service well respected? Do they have a track record of putting their money where their mouth is? They may be open source, but have they been audited? Has anyone expressed any legitimate concerns about their practices?

The key word there was “legitimate.” Lots of people dislike ProtonMail because it costs significantly more money than Tutanota, but their list of complaints ends there. While that may be a deciding factor for you, it doesn’t make ProtonMail any less trustworthy or reliable. As you research a product or service in the privacy community, you will find no shortage of people who have minor complaints about a product. “They’re based in the United States.” “They use X programming language instead of Y.” “They could be more secure if they did ABC.” It’s the privacy equivalent of someone who prefers vinyl over CD. They’re not technically wrong, but you risk getting lost in the weeds. If you’re so obsessed with finding the perfect turntable, cables, speakers, signal processing, and so forth you risk never actually listening to the music.

Instead, focus on legitimate complaints. Are they owned by an advertising company, or a company with a history of packaging malware? Has their code been audited? How do they make their money? If a product is free, you are the product, so if they don’t have a paid model of some kind they’re probably not very trustworthy. Are they using an encryption that’s known to be weak? Does their privacy policy state they log information that you find troubling? Are there credible whistle-blowers from inside the company that have made troubling claims or leaked documents that suggest troubling practices? These are all legitimate complaints. “They cost too much” or “I don’t like their mobile app” is not a legitimate complaint.

Trust Varies

There is something to be said for individual levels of trust and threat modeling. I use Signal as my primary messenger of choice. I do this because I have a VoIP number that I use only for Signal and nothing else. Anyone who searches my Signal number will find very little information about it or me. I can safely hand that phone number out like candy without fear of sacrificing my privacy. Not everyone has access to a VoIP number though, and thus they may only be able to use Signal by using their real phone number, and that may be a risk they don’t want to take. That’s not to say that Signal isn’t trustworthy. It has repeatedly stood up to scrutiny, auditing, data leaks, and has shown itself to be a reliable, secure messenger. But because of its limitations, it’s not right for everyone. Others may choose to use something like Wire or Wickr because they don’t rely on phone numbers. Your specific threat model determines what’s right for you, and picking one service over another doesn’t necessarily mean you don’t trust it.

At the end of the day however, you have to trust something somewhere along the line. The goal of this site is not to remove trust. That’s impossible. The goal is to teach you how to evaluate things for yourself and decide the right level of trust. If your goal is simply to communicate securely (and cheaply) with family in another country, Signal is great. Even something like WhatsApp or Telegram is technically acceptable. But if your goal is to protect a whistle-blower who’s revealing top-secret information to you, a journalist, then you need a higher standard of trust.

Your Phone is Not Your Friend

February 9, 2020

The other day I posted an article on my feed about how the US Immigration service is using cell phone location data to track immigrants. In light of this article, I feel it a good time to remind you that cell phones are not your friends.

The Problem

Cell phones are 24/7 GPS surveillance devices, constantly leaking data at all times. At any given time, your phone is broadcasting your location. It’s also usually broadcasting a bunch of other information such as WiFi connection information and usage data. Recently, Privacy International found that some devices and apps even transmit personally identifying information such as name, date of birth, and gender without using any type of encryption or security measures. Even within the device itself, there’s a messy web of apps requesting information that they don’t really need and transferring that information to their own creators, leaking even more information about people who didn’t consent to having their information shared to people who don’t need it. (Source, just one of many.)

The Reminder

Phones have made life incredibly easy and convenient in so many ways, and as usual I’m not here to decry the rise of technology. Technology is fantastic and I love it. I have a phone. I have a smart TV. I use decentralized social media. But remember that our phones have been usurped as surveillance devices, constantly betraying us. Our messages, our locations – which are then correlated with other phone locations to create a network of who we know, further creating a startlingly accurate guess at our socio-economic status and a whole host of other things – even the games we play and shows we watch. It’s all being collected at all times for various ends. Some companies just want to sell things to us, some agencies want to catch the bad guys, and a small few of powerful people want to control things. The more data they have, the easier it is to do that. If you need a reminder of how this power can be abused, just take a moment to browse through this page.

The Solution

It’s hard to recommend a course of action. I personally have taken to simply leaving my phone at home as much as possible. If I’m going out to dinner with my partner, I pay in cash and leave the phone at home. After all, my goal is to spend time with her. Leaving my phone not only ensures that “they” don’t know where I went, but also keeps me from getting an email or browsing memes when I should be spending time with her. I’ve also taken to doing as little as possible on my phone. I have Signal and Wire both loaded onto my computer, as well as my password manager. I try to keep my phone as clean as possible of apps, only keeping those that I absolutely need to do my job or be responsive as needed. Even though my phone still betrays my location, I try to replace my map app with something like OSMAnd, an open source navigator, to mitigate the amount of data reported. I believe I may have mentioned that I stopped sleeping with my phone in my room a few months ago and replaced it with an old-school digital alarm clock (not the smart kind, the $10 “just tells time and beeps real loud” kind).

As with most things, reasonably abandoning my phone hasn’t had any negative impacts and if anything has only made my life better. I sleep better, I focus more on where I’m at, and I tend to be more in-the-moment. Again, I’m the last person to decry technology, and obviously some of us can’t turn our phones off when we go home, but the goal of this post is not to tell you what to do. Just to give you a quick reminder that your phone, while undoubtedly having improved your life in many ways, is not your friend. Don’t forget that. Keep it on as short a leash as you reasonably can.

Tracking Links

January 12, 2020

I'm amused – and slightly sad – that as I began to do my research for this blog post, every result for a search of “tracking links” or “tracking URLs” returned the same thing: web-hosting and analytics companies giving a very benign overview of what they are and then explaining why everyone who owns a website should be using them. I shouldn't be surprised. Like most surveillance technologies, the proliferation of tracking links is aided by two main concepts: the first is that they provide a very useful trade off, and the second is that people don't really understand or consider the danger of the capabilities.

What are tracking links?

Tracking links or tracking URLs are hyperlinks that not only direct you to a website, but also record information about you when you click on them. These can appear in the form of shortened links, such as the common “bit.ly” service, or it can appear in the full link, usually beginning with a question mark or a slash then followed by a bunch of other information.

This is not to say that every shortened link contains tracking, although it's hard to tell without seeing the full link. Likewise, not every question mark or slash signals the beginning of tracking information. But they are the most common indicators.

What do they do?

Tracking links, as the name suggests, track information when you click on them. As a business owner, I understand the value of certain metrics. It's useful to know if the majority of your website visitors are coming from mobile or desktop so you know how much focus you need to give to making your site responsive. It could even be useful to know if they're specifically coming from Apple or Android devices in case you were developing an app and needed to know which to prioritize. For advertisers, knowing what site your visitors are coming from helps you know where your advertising is most effective.

However, as with most good technologies gone wrong, tracking links get so much more invasive than simple, useful metrics require. It's not uncommon for tracking links to be able to trace unique, personal information like IP address, MAC address, operating system down to which specific version or upgrade has been installed (ex: iOS 13.2). Some of them can even be used to track who sent the link, what time it was opened, other apps that are installed on the device, or websites that have been visited (this, I would imagine, involves the use of cookies stored on your device and therefore this becomes a coordinated effort from the tracking link). This is significantly more information than any website would need to know for metrics' sake, and it runs the high risk of identifying you personally in what's supposed to be anonymous data designed to help improve the site or service. Why does a recipe website need to know what other websites you've visited? What use does a clickbait article site have knowing the apps on the phone of the friend you shared the article with? It's a massive invasion of privacy.

Facebook's obnoxiously long tracking links

How can you avoid tracking links?

Thankfully, the easiest way to avoid tracking links on a desktop/laptop environment is to install uBlock Origin. The developer recently added a powerful tracking-link remover to the menus, which I explain how to enable here. However one should never rely solely on technology and should always know how to take matters into their own hands if necessary. (Also this solution isn't available for most mobile users.) The key giveaway is to look for the aforementioned questions marks and gibberish. A link that goes “https://www.website.com/article-title/gfm-feed-12456" probably doesn't need that last bit (“gfm-feed-12456”). I've found the most effective solution is to erase it and see if the link still works. If it does, congratulations! You've erased the tracking link and helped protect the privacy of both yourself and your friends! Same thing applies with question marks. “https://www.website.com/article-title.html?=feed-123456." Delete everything from the question mark on, and check the link. This does require you to learn how to read a link, but honestly it's not that hard. Usually key words from the title will appear in the link, and it's a safe bet that anything you don't recognize beyond “.html” is probably not required. It's also a good idea to check the link before sharing it. I've found as I post news links to The New Oil's Mastodon account that some websites have gibberish-looking parts of their URL that are actually necessary (Forbes comes to mind, their links tend to look something like “forbes.com/article-title/12356” but deleting the gibberish actually brings up a 404 error page).

Stripping tracking links will not negatively impact the necessary metrics of a website, and frankly it won't stop invasive data collection. Any owner interested in the analytics will still be able to tell who visits their site, what device, how long they stay, and a ton of other invasive information that quite frankly they don't need. But it will help to protect both your privacy and the privacy of those around you by removing small parts of the puzzle – the fact that you sent your friend to that site, for example, or other invasive information that helps corporations and governments create a more complete but unnecessary picture of you that can and usually does get abused. And the more we take conscious stands against this kind of stuff and show that we as consumers will no longer tolerate it, the less common it will become (hopefully).

Looking Ahead

January 4, 2020

I personally am indifferent to New Year’s demarcations. I can often be found on any given NYE at midnight sleeping soundly in my bed. That’s not to say I don’t care for them, I just don’t care about them. Having said that, I do think it’s important to set goals for one’s self, and the arbitrary (if necessary) line in the sand of “new year” seems like a good time to revisit that for anyone. As 2019 draws to a close, I am assessing the past year both personally and professionally – what worked, what didn’t, etc – and am planning what’s to come in the next twelve months. Once a month, I post asking for financial support on Liberapay for this project, and so in the interest of transparency I wanted to take just a moment to outline what my goals are for this project. I want those who do support me to know what I’m doing with their hard-earned money, and possibly entice those who are on the fence about supporting me. And as always, if you are unable to support financially, I am totally okay with that and appreciate simply interacting with my posts, sharing them, and similar free shows of support.

If I had to define 2019 for The New Oil in one word, I’d call it “successful.” I hate when people say things like “this project has gone beyond my wildest dreams” because we all know that’s not true. Even bands who keep their hopes in check have dreams of playing the Superbowl (or similar large-scale successes) and even I myself have similar dreams for the scope of this project. But I will say I am pleasantly surprised how fast I’ve grown, as well as the overwhelming outpouring of positive feedback and interaction I’ve received.

When I started this project, I had one goal in mind: I wanted to take privacy and security – particularly against digital surveillance of all kinds – and make it accessible to “normal” people – that is, people who aren’t programmers, system admins, tech enthusiasts, etc and make them realize that it’s not as hard as they think to take some basic-level protections. There’s tons of great resources out there, but it’s not accessible to people like my mom, my girlfriend, or my best friend. They don’t understand it, and they need a translator to explain it to them in terms they get. That’s what my goal was with this site.

When I started the project, I had the same dreams as anyone else, but I tempered them with realistic expectations: I expected a few followers, the occasional hater, and overall I assumed this would become a passion project with no real effect. Instead I was greeted with tons of positive feedback, from “great article” to “everyone check this guy out.” Just last month I got my first financial supporter on Liberapay and broke 100 followers on Mastodon. I’ve even got people asking me questions about my thoughts on things or how I recommend tackling certain issues.

I have to remember that I am still a small fish in a small pond. There are people who are much more knowledgeable about this stuff than I am. Honestly, I like it that way. Snowden once said that his biggest challenge in presenting mass surveillance to the public was how to take complex issues and explain them in a way that everyday people could grasp. By keeping myself out of the higher levels of technical skill, I force myself to understand things at a general-public level, which I think (or hope at least) helps me present these things to the general public in an understandable format.

In 2019, I think I successfully found a sustainable foundation for the site going forward. I formed a working solution for selecting and posting articles based on a criteria that keeps them mostly relevant to the site. I created a solution for posting blog posts weekly, thought that one really comes down to just being disciplined. I think I showed both myself and my supporters that I’m serious about this project.

In 2020, I want to expand. In the closing weeks of 2019, I took a leap and started my own home server. Right now I mainly use it for things like RocketChat and Nextcloud, but I also run a TOR bridge. This is something I’ve wanted to do for years, to do my part to support digital freedom. In the coming weeks I plan to add a second relay for regular TOR users. In the future, I’d like to run a PeerTube instance and maybe even a Mastodon instance, as Eugen has indicated that Mastodon is growing rapidly and needs more servers. I’m currently torn between buying my own server and renting a VPS through a provider. There are pros and cons to both, feel free to message me your thoughts that might help me make a decision. This is still some time off, for now I’ll stick to running to small, personal services on the old desktop tower under my desk. But I do hope to have a professional-grade server running more advanced services before the end of the year.

In addition, I hope to start hosting regular cryptoparties in my area. Cryptoparties are basically classes where you explain encryption and surveillance to folks and help them get set up with things like 2FA, encrypted messaging, VPNs, and other simple such services and concepts. There are a startling lack of them in my area, despite being a major tech town, and I want to remedy that. Ideally I’d like to do them once a month, but I think I may aim for once per quarter so I don't overload myself.

In 2020, I also hope to attract more financial support for this project. This will help me cover the obvious things like hosting costs, VPS services (if I go that route), hardware maintenance (if I go that route) and other related expenses. Any excess support would go to helping me cover my own bills like housing, transportation, and groceries. I’m not a materialistic person, I actually identify as a minimalist, so rest assured that any “excess support” is not going to paying for a new Lexus or an expensive house. It’s going towards a moderate apartment and a used Toyota, and maybe some frugally-executed vacations in the future. And also two cats. They’re not very expensive though.

In the long term, I hope to be able to travel and speak and more on this project, lending my help wherever possible. I’ve got a few EFF links I need to look into this weekend about signing petitions against facial recognition and such. I work closely with my local EFF chapter to help bring these subjects to the general public in my area. I would love to be more closely involved in these types of organizations wherever I can. I would love to educate wherever I can. I would love to offer services and solutions of my own, hence my desire to invest in servers.

The purpose of this post was partially to put my own thoughts in order, but also to express transparency and let you guys know what to expect from me in the coming year. Two goals are actually not much for me, as someone who’s constantly on the go. Today is supposed to be my day off, but in the four hours since I woke up I changed a small part on my car, rescheduled a doctor’s appointment, made an appointment for the cats to get their annual shots, wrote this blog, and checked into some payroll stuff at my day job, so I’m not really much of “day off” kind of person. I wish I had more goals for this project in 2020, so if you see room for improvement please don’t hesitate to message me and let me know. And also feel free to keep suggesting services and products for me to review and add to the site, I want visitors to have as many options as possible.

For those who supported me in 2019, thank you so much. You honestly do inspire me to keep going on days when it feels hopeless or meaningless. For those who are new to the site, thank you for joining and I hope it lives up to your expectations. For those considering supporting me financially, I hope this post has helped you make the choice either way by explaining what I hope to accomplish in the future. And for those who can’t do so, I hope you can support me by sharing the site, the articles, the blogs, or whatever else you find worthy of sharing, and I hope it helps make this important subject more accessible to the general public.