{"id":261,"date":"2020-05-05T11:26:24","date_gmt":"2020-05-05T09:26:24","guid":{"rendered":"https:\/\/www.proudsourceit.com\/blog\/?p=261"},"modified":"2020-06-09T16:33:44","modified_gmt":"2020-06-09T14:33:44","slug":"a-practical-guide-to-increasing-online-privacy-and-security-for-non-techies-too","status":"publish","type":"post","link":"https:\/\/www.proudsourceit.com\/blog\/cybersecurity\/a-practical-guide-to-increasing-online-privacy-and-security-for-non-techies-too\/","title":{"rendered":"A practical guide to increasing online privacy and security (for non-techies, too)"},"content":{"rendered":"\n

Introduction<\/h2>\n\n\n\n

The year is 2020 and it is impossible to imagine a day without using a mobile phone, computer, smartwatch or internet in any shape or form. We are so dependent on information in every aspect of our lives and there is certainly a great number of products and services we may choose from in order to communicate, browse, search\u2026 Today, a lot of these products are free, as in, you don\u2019t have to spend a cent on them and still be able to use them, but there is really no such thing as free in a capitalist world. You may not be spending your money, but you are \u201cpaying\u201d, with your personal information. And that is what all of us must be aware of each time we enter the digital world.<\/p>\n\n\n\n

To some people, this is not new. Some do not care. Some go with a point \u201cyeah, like someone out there cares what I eat for breakfast\u201d. All somewhat valid points, until a data breach happens and suddenly, your information is no longer in hand of a \u201ctrustful\u201d company, but it is sold on a dark web, no one knows to whom or what will someone do with it. Or simply, your email address and password are exposed, and you were previously too lazy to set up all your accounts with different passwords, so now, someone can access your other accounts, those who were never in danger to begin with. Or, even worse, your email gets compromised, and now someone can access almost everything you do on the internet. Pretty scary, right?<\/p>\n\n\n\n

Of course, not every scenario plays like this. What is described is among worst case scenarios, but it is important to understand what can happen. Fortunately, there are easy ways to protect yourself and the world itself is making progress in forms of General Data Protection Regulation (GDPR) [1] in European Union and California Consumer Privacy Act (CCPA) [2] in the United States.<\/p>\n\n\n\n

Despite, caution shouldn\u2019t lack.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In this text, we\u2019ll try to help you point out possible weaknesses in your way of using information technology and suggest ways how security and privacy can be increased. We will not go into details on everything, but rather leave links for everyone to explore more.<\/p>\n\n\n\n

Before we dive into the issues directly, we\u2019d like to point out that most of our recommendations will be free and open source software –  we will provide a link to a repository where code is hosted. We believe that it is important for software to be open source, since that ensures a possibility of everyone with the right skills to examine the code and point out flaws, maybe even suggest fixes.<\/p>\n\n\n\n\n\n\n\n

General security<\/h2>\n\n\n\n

Most systems today use username and password as a main way of identifying and authenticating users.<\/p>\n\n\n\n

For an end user, it is important to make a clear distinction between weak and strong passwords. A password is considered weak if it is only one known word, if it contains names (family members) or dates (friends’ birthday) it is short (less than 8 characters) or it is too simple (like pass1234). Such a password is an easy target for many hacking techniques.<\/p>\n\n\n\n

Considering bad practices, like repeatedly using the same password on different services, or putting sticky notes on a monitor with a written password, it becomes way too easy to be a target, intentionally or by accident.<\/p>\n\n\n\n

By contrast, a strong password has nothing of what is mentioned. It is not a known word, it is lengthy (between 8 and 16 characters, even more for some special cases), it is unique, it contains upper and lower case letters, numbers, special characters – in general, it makes no sense to anyone. Such passwords are hard to crack due to lack of any predictable pattern, behavior or emotion tied to it, meaning only brute force can crack it and such method is time and resource consuming.<\/p>\n\n\n\n

In short, a strong password will make you a less attractive target. Also, it is only the first step.<\/p>\n\n\n\n

Two factor authentication (2FA)<\/h3>\n\n\n\n

A common suggestion is to use a second factor (combined with password), which nowadays usually means 6 or 8 digit code that expires after 30 seconds, called OTC (one time code). Sites you\u2019re using the most will likely have an option to add a second factor, however, only a small number will enforce it. It is very likely that your favorite site already has 2FA support, you just have to activate it. Feel free to check on the site of your choice or use the following link<\/a>.<\/p>\n\n\n\n

Due to the architecture of OTC, it is worth noting that it is not an unbeatable system. Feel free to read more about it here<\/a>. Regardless, using one most certainly increases the security of your account.<\/p>\n\n\n\n

Recommendation:<\/strong> Authy<\/a> – it will allow you to encrypt your secrets with a phrase of your choosing and it has a very useful option of keeping sync between devices, meaning changing devices will be easy without needing to set up your accounts again.<\/p>\n\n\n\n

Notable mentions:<\/strong> Google Authenticator<\/a>, Microsoft Authenticator<\/a><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Password management<\/h3>\n\n\n\n

There is no need to mention how troublesome keeping strong passwords for each account can be. People have a hard time to remember one strong password, let alone dozens. Fortunately, there are a number of solutions that offer password management and generation.<\/p>\n\n\n\n

In short, this is how it works: a password manager will generate a strong password for you and remember it. Depending on your software and subscription plan (if any), there should be an option to check if the suggested, generated password was in any known breaches. You can always check that manually here<\/a>.<\/p>\n\n\n\n

You will have to set up a master password to unlock all others. Adding 2FA to the password manager is mandatory.<\/p>\n\n\n\n

Recommendation:<\/strong> BitWarden<\/a> as it is a free and open source. It has a small yearly fee for extra tools that many won\u2019t need and it works both as a standalone software and browser extension. It has 2FA support.<\/p>\n\n\n\n

Notable mentions:<\/strong> LastPass<\/a>, 1Password<\/a>, Dashlane<\/a><\/p>\n\n\n\n

Followup steps<\/h3>\n\n\n\n

Setting up 2FA and password manager is a great step in increasing your security. However, as a saying goes, don\u2019t put all your eggs in the same basket. Whatever solutions you choose in the end, make sure they are not from the same vendor. That way, should the unthinkable happen and the security company has a security breach, only half of your information will be compromised leaving you with enough time to react and change the information.<\/p>\n\n\n\n

In setting up all of this, you will be asked to save backup codes for 2FA and there will be an option to export all your passwords from password manager. Now, let’s not undo all the good work, by keeping those exported information insecure. A suggestion would be to use an encrypted USB drive. There are numerous solutions, most are OS specific, but one that stands out is VeraCrypt<\/a>, as it is free and open source, and multiplatform, meaning you can unlock your USB on any system.<\/p>\n\n\n\n

It is recommended to update your passwords and keys on your usb periodically, so your backup won\u2019t be outdated.<\/p>\n\n\n\n\n\n\n\n

Internet security<\/h2>\n\n\n\n

If we were to make a guess on which browser you are reading this article, we\u2019d be 66% sure that it is Google Chrome. How did we know? Well, simply that is a market share for Google Chrome and it is not undeserved. It is most certainly one of the best browsers currently in the market and it excels in almost everything, except privacy. While Google is offering so many of its products and services for free, they make up in revenue by selling ads. Targeted, personalized and well placed ads all over the web. They manage to do so by collecting all sorts of information on its users, their behaviors, searching patterns, phone usage etc.<\/p>\n\n\n\n

This is not paranoid thinking nor conspiracy theory, it is written in their Privacy Policy. Here\u2019s an excerpt, but we encourage you to read the whole document [3].<\/p>\n\n\n\n

\"\"
An excerpt from Google’s Privacy Policy taken on May 15th, 2020.<\/figcaption><\/figure><\/div>\n\n\n\n

If you aren\u2019t comfortable with it, there are ways of distancing yourself from Google\u2019s tracking without sacrificing much of your daily routines.<\/p>\n\n\n\n

Web Browsers<\/h3>\n\n\n\n

First and foremost, replacing Google Chrome, should you not agree with Google\u2019s Privacy Policy [3]. Fortunately, Google Chrome is built on Chromium, a free and open source project. It is sponsored by Google and it does not have some of Google’s proprietary features, read more about it here<\/a>.<\/p>\n\n\n\n

This is important to mention because a lot of browsers in the market (and some of our recommended browsers) are built on Chromium and enhanced. This will also make a possible transition to a new browser a lot easier.<\/p>\n\n\n\n

\"\"
Firefox Privacy Settings<\/figcaption><\/figure><\/div>\n\n\n\n

Recommendation 1: <\/strong>Firefox<\/a> browser – it is free and open source and the only major browser on the market that is not built on Chromium (if we exclude Safari which is Mac-only nowadays). It works on any system and it has a healthy ecosystem of extensions. Almost every popular extension for Chrome exists for Firefox as well. Firefox and Chrome are similar in performance and in visual design. Firefox is a bit more customizable, but the reason we are recommending it is the privacy settings and built-in blockers. It is possible to completely turn off history and cookies and browse the web without any fear of leaving any data behind. It would take a few minutes to set up everything properly and after that if you turn on cloud sync, all your settings will be saved in case of using multiple computers or reinstalling the system.<\/p>\n\n\n\n

Recommendation 2: <\/strong>Chromium<\/a> browser – if you cannot leave Chrome that easily, then Chromium is the solution for you. It looks and feels almost the same as Chrome. Sync is available, although it will use Google service for that. Linux users can install it directly from their respective software managers. Windows users will have a bit of trouble in installing it, as it is not as simple as clicking an .exe file. If you are on Windows, following browsers might be more suitable for you.<\/p>\n\n\n\n

Notable mentions:<\/strong> Brave<\/a> browser, Opera<\/a> browser, Vivaldi<\/a> browser<\/p>\n\n\n\n

Sidenote:<\/strong> If you are using Internet Explorer, you might want to consider switching to Edge<\/a> or use some of the recommended browsers above.<\/p>\n\n\n\n

Final thoughts: <\/strong>Considering everything that is mentioned in this article, changing a browser should be, by far, the most challenging step. While it is not mandatory to do so, it is recommended. The very least anyone can do is install another browser alongside Chrome and try it out. Finally, the next chapter can be applied to Chrome as well.<\/p>\n\n\n\n\n\n\n\n

Browser Extensions<\/h3>\n\n\n\n

Browsers alone can protect you from most harmful situations on the web, but with browser extensions the experience can be enhanced.<\/p>\n\n\n\n

Before reading the rest, please do yourself a favor and test your browser for privacy on the following link<\/a>. We expect that you will be negatively surprised by the result.<\/p>\n\n\n\n

We will recommend a series of extensions that will increase your privacy. They can work with one another, so feel free to experiment and combine them. <\/p>\n\n\n\n

A word of caution: <\/strong>too many of these extensions can lead to some sites breaking or displaying badly. It can mean either of two things – settings on extensions are too extreme and\/or the site is tracking you way more than it is reasonable.<\/p>\n\n\n\n