In 2019, our privacy is being compromised as our governments meant to protect us are forcing us into an Orwellian high-tech dystopia. Our rights to privacy are curbed in the name of counterterrorism and our individualism is suppressed in the name of society as a whole. This is nothing new and fortunately people actively work to preserve your freedom by developing software and services to keep your activities online private and your identity anonymous. I'm going to illustrate how you can get started taking back your internet privacy. This is our Top 10 best practices in order to go completely off the grid.
10 - Do not associate with your real life persona
A good start to internet freedom and privacy is to have common sense. Do NOT tell people who you are, where you live nor live near, what you do in real life, who you know, and don't post pictures of yourself. Just 10 years ago, posting pictures of yourself online was like a cardinal sin; now it's a social norm. There are many reasons why you shouldn't do this: your face can be identified, your location can be referenced from the background, geo-coordinates are also embedded in photos taken by smartphones. Never use any information that could be tied to you and don't talk to people you usually talk to. Be mindful that you are being profiled at all times. One final token of common sense: don't meet up with people you deal with online, for god's sake.
9 - Get a VPN
There is a very good reason why some countries have banned VPNs; because they work. A VPN will send web requests on your behalf while encrypting your activity. This allows you to appear like you are from a different country, so you will have access to content blocked in your native country and the sites you visit will not know where the requests originated from. Your ISP will still log your requests, though what they will have looks like gibberish being encrypted. Always buy from a trustworthy provider and NEVER get a free one. Free VPNs can timeout after an hour or so and quickly unmask you.
Let's say you bought a couple years worth of a VPN subscription; you selected a server and are now connected. That's all there is to it, right? Dead wrong. Be aware that a VPN is not enough to protect you and in some cases, your service will keep logs of your web requests. Law enforcement can and will obtain warrants to investigate your logs or just straight up compromise a "non-compliant" VPN service. There are ways to subvert this though. When you have your VPN software set up, don't keep connecting to the same country and don't connect to suspicious countries. If you live in the US, don't be connecting from any country that might flag you as a terrorist. I recommend staying in Europe or North America.
The top VPN providers at the time of writing are NordVPN and ExpressVPN—neither keep logs and have good reputations. Both of these companies also allow you to pay for their services in Bitcoin, which could help disassociate even the purchase of a VPN from your identity. Speaking of Bitcoin, check out our next step.
NordVPN — https://nordvpn.com
ExpressVPN — https://www.expressvpn.com
8 - Use Cryptocurrency
Cryptocurrencies like Bitcoin allow you to make transactions for digital or physical goods anonymously—we are referring to pseudo-anonymity here; there are ways to reveal your identity, though the use of cryptocurrency is a step in the right direction. In addition to being able to buy things anonymously, money laundering becomes very easy. There are benign reasons to launder money and it's not illegal if you did not obtain the money illegally. Setting up wallets for these coins and transferring to other wallets is easy and simple. In some cases, it's good to have some money in a few different cryptocurrencies because the sear number in circulation. Bitcoin does have it's flaws, but it is the most widely accepted digital currency and simplest for beginners. Some other cryptos include: Ethereum, LiteCoin, DogeCoin and Monero. Buy your coins from trusted vendors, from people you trust or in cash at Bitcoin ATMs. Bitcoin is the number one coin you'll need if you plan on purchases goods or services on TOR.
Educate yourself, choose a wallet, and put some money into it.
7 - Use Onion Routing
Why do cyber-criminals continue to use The Onion Router (TOR) for their operations? Because it works. Onion routing encrypts and routes your requests to multiple computers in the TOR network—sometimes referred to as "The Deep Web". This kind of network is called a darknet. Darknets are designed to protect your identity while you browse for sites and services that are offered in a closed-off area that is not visible by normal search engines. There are many questionably legal to totally illegal services available on TOR which accept cryptocurrencies as their standard. You can buy anything from drugs to guns to illegal porn. It's not all scary though, and a lot of the stories you hear about onion sites are frabrications for entertainment. I once found a site of some German guy selling pretzels—just pretzels.
To use onion routing you need to download the TOR Browser from https://www.torproject.org. It is not recommended that you run TOR on Windows, which serves as a good segue into the next suggestion.
*BONUS: here is a script that routes all traffic coming from your computer through TOR (Debian distros only).
TORiptables — https://github.com/ruped24/toriptables2
6 - Stop using Microsoft Windows
There is no easy way to stop sending data to Microsoft in Windows 10. You send them occasional web history, Cortana questions, application logs, sometimes even screenshots. You need to stop your own computer from working against you. Fortunately, there are alternatives to Windows in the UNIX world. Linux is a free and open-source alternative to Windows. A whopping 90%+ the world's servers run some form of Linux because system administrators understand how secure and industrial-grade Linux is. There are many Linux distros that you can either setup in under 15 minutes with everything you need out of the box or spend hours customizing and configuring to your personal tastes. The top beginner Linux Distro is Ubuntu, though you can find any other that works just as well or even better for you all for free.
Edward Snowden has gone on record for saying he uses Linux (more specialized distros to be fair) to protect his internet privacy. If Linux can protect a man subject to an international manhunt, it can protect you too. For power users, you might want to look into Whonix or QubesOS. These distros help provide security through isolation and with TOR specially configured to route all traffic through them.
Ubuntu — https://ubuntu.com
Whonix — https://www.whonix.org
QubesOS — https://www.qubes-os.org
5 - Use Virtual Machines
I can't explain too much about Qubes without talking about Virtualization. If completely wiping Windows 10 from your computer is a little overkill for you; don't worry, there is a simpler way. Use Virtual Machines (or VMs for short). Virtual Machines can be thought of computers inside your computer. They create an isolated environment that you can browse the internet through minus any application data, cache or other information that could help identify who you really are on your main OS. You can install any operating system you wish inside a VM, the most popular being Linux for reasons I've stated above. These environments can be spun up and torn down almost instantly and can possibly leave no trace. If you get a virus or some other form of malware in your VM, the threat is completely contained and can not reach your real computer in about 99% of cases. Simply delete it and spin up a new one. The two leading virtualization providers are VirtualBox and VMWare. VirtualBox is free and VMWare is freemium.
Now, back to Qubes. QubesOS gives you the power to virtualize your entire operating system. You can open temporary or permanent containers to do certain types of tasks such as: shopping, chatting, downloading cracked software, etc. Qubes compartmentalizes all your activities. Here's a diagram illustrating this.
Qubes is recommended towards more advanced users though I do encourage you to give it a try sometime. The more you know of what is available to help you, the more empowered you are.
VirtualBox — https://www.virtualbox.org
VMWare — https://www.vmware.com
4 - Close any Applications that could Compromise your Privacy
Don't just switch on your VPN when you want to go off the grid. The applications you have send data to their respective servers whether in the form of connection checks or polling for updates. Close them or log out and close them on your native operating system and in any VMs you have running.
3 - Scan Files
If you ever find yourself pirating some books, movies or software; please scan the files through an online threat identifier such as VirusTotal. Malware writers know how to spread their creations and a good way to do just that is to embed it into highly requested files. Be very careful of the things you download.
If you happen to download an infected file, the embedded malware will "call home" to its creator and can not just compromise your VM environment but your identity as well. Delete the file as fast as possible (kill your internet connection if you feel so inclined) or scrap the virtual environment you're working in. One very useful feature of VMs is snapshots. These allow you to restore your machine to a certain "checkpoint" which is a known-good uninflected system. If possible, look for a "trusted" source for your Warez and media.
2 - Use SOCKS Proxies
SOCKS proxies allow you to connect to sites using someone else's computer as a proxy. This allows you to connect to sites that may be blocked in your country much like a VPN. Finding good SOCKS proxies can be challenging but once you have a few it's possible to route your connection through as many computers as you wish. A very useful tool to use for SOCKS is Proxychains, linked below. SOCKS proxies are very popular amongst pirates, since they're free (mostly) and allow you to download media and software without your ISP knowing about it.
Proxychains — https://github.com/haad/proxychains
1 - Stop using Google and it's products
Google is arguably the biggest offender when it comes to sticking its nose in your business. Every shock video you hear from the news and go look for, every porn search, every questionably legal email is all visible to them. Google Chrome unsurprisingly loves your data as much as it's creator. I recommend using Firefox as your web browser and DuckDuckGo as your search engine. It's as simple as setting DuckDuckGo as your default search engine. https://duckduckgo.com.
What about your beloved Gmail? Ditch it. There are other more secure alternatives to send and recieve emails. You could go looking on TOR for some email providers, but many have been taken down. ProtonMail offers end-to-end encryption, anonymity, and is open source. ProtonMail also has a TOR hidden service that you can access for even more security. Make sure you save your password to a safe place, your inbox is encrypted and decrypted by the password you use. If you need to recover your account, your previous inbox is lost forever. This is suprisingly a pro, because anyone who tries to compromise your account will yield nothing.
It is completely possible to continue to live without having to use any Google products and the payoff is phenomenal. It goes without saying that this rule applies to Facebook, Microsoft and other offenders.
ProtonMail — https://protonmail.com
It should be understood that maintaining your privacy is a full-time job and you have to deliberately follow the best practices in order to be successful. I've seen many people get sloppy or even give up because of the amount of precautions that have to be taken to ensure one's anonymity. The best way above all else to preserve your rights to privacy and anonymity online is to be persistent in the actions you take and not to let any crack in your armour go unnoticed.
I will post a follow-up article detailing some more technically advanced ways you can maintain your anonymity online...eventually. Thanks for reading, stay safe and I'm not liable for any illegal actions this information helps you commit.