Hello, Lemmy!

It may be difficult to spend time actively improving some of the services you use to have a more privacy conscious presence, and so this thread is dedicated to help people learn and grow in their privacy journeys! Start by stating which services you currently use, and which ones you may be looking for/want to improve. This thread is entirely optional to participate in, because a lot of people understandably feel uncomfortable listing which services they use. Writing those out can be a lot of work, but the payoff is huge!

Remember these rules:

  • Be respectful! Some people are early on in their privacy journey, or have a lax threat model. Just because it doesn’t align with yours, or uses some anti-privacy software, doesn’t mean you can downvote them! Help them improve by giving suggestions on alternatives.

  • Don’t promote proprietary software! Proprietary software, no matter how good it may seem, is against the community rules, and generally frowned upon. If you aren’t sure, you can always ask! This is a place to learn. Don’t downvote people just because they don’t know!

  • Don’t focus solely on me! Since this happened in another one of my posts, I want to mention that this thread is not designed to pick apart only my setup. The point is to contribute your own and help others. That doesn’t mean you can’t still give suggestions for mine, but don’t prioritize mine over another.

  • Be polite! This falls under “Be respectful”, but be kind to everyone! Say please, thank you, and sorry. Lemmy is really good about this, but there will always be someone.

Here is my setup:

Web browsing

  • I use Tor for using online accounts (such as Lemmy, etc.)

  • I use Mullvad Browser for general browsing

  • I use Librewolf for functionality that Mullvad Browser doesn’t have (security keys, etc.)

  • I use Firefox + uBlock Origin for streaming videos that break on Librewolf and Mullvad Browser.

  • I always use a SearXNG instance for web searches. I always use ProtonVPN (free tier). I use a private DNS resolver.

Desktop

  • I use Secureblue (yes, I’m that guy from a post a couple weeks ago)

  • I sit behind a firewall.

  • I only use FOSS Flatpaks with Flatseal.

  • My BIOS is password locked but proprietary (due to compatibility issues).

  • I occasionally use Tails because I think it’s fun.

  • I use full disk encryption, multiple disks, and a second layer of encryption for specific important files (NSA style)

Mobile

  • I currently use hardened iOS until I can scrape together some money for a Pixel to use GrapheneOS

  • Again, I constantly use ProtonVPN (free tier)

  • I use a private DNS when ProtonVPN is turned off

  • I use AdGuard, but I browse the internet with the DuckDuckGo app (I can’t sideload)

  • I use a very strong passcode

  • Airplane mode is constantly enabled, I don’t have a SIM

  • I use a Faraday bag to store my device when I’m in public

  • I use a privacy screen protector

Messenger

  • I mainly use Signal with a borrowed phone number, because SimpleX is still buggy on iOS, and Signal is the easiest to switch friends to. I rarely use iMessage, but there are times when I have to.

Online accounts

  • Passwords are stored in Bitwarden for mobile accounts, and KeePassXC for desktop accounts.

  • Yubikey is placed on any account I can, otherwise 2FAS is used

  • I keep public accounts (Lemmy, etc.) as locked down as I can.

Video streaming

  • I use the native YouTube app on iOS, simply because any of the others I’ve tried either don’t actually work or require a Mac to install. I don’t have a Mac, obviously.

  • I use FreeTube on desktop, but as I was writing this I was informed that FreeTube has a few issues I may want to look into (Electron).

AI

  • I would love to know if there are any Flatpaks that run local LLMs well, but I currently use GPT4All (since that’s what I used a year ago).

  • On mobile, I use an app made by a friend that gives access to GPT-4 and Gemini. Because it’s running off of his own money, I’m not going to share the project until he has a stable source of income.

Social Media

  • I don’t use any social media besides Lemmy.

Email

  • I use ProtonMail

  • I have addy.io as an alias service

Shopping/Finance

  • I currently either proxy my online purchases through someone else (have them buy it for me and I pay them back), or use a gift card

  • For physical purchases I use cash

  • I only use my bank account for subscriptions (Spotify, etc.)

  • I am working on using Monero and privacy.com

Music streaming

  • I use Spotify on my phone

  • I use Spotube or locally downloaded files on my computer

  • I have multiple AM/FM receivers with some yard long antennas and direct metal connectors

TV shows

  • I stream from ethical services for some movies

  • I go to a theater or buy a DVD for other movies. I am the proud owner of a USB DVD player.

  • I also have an antenna hooked up to my TV

  • There are certain IPTV services I have used in the past

  • I do not use a smart TV.

Gaming

  • I download local games, plain and simple. Or I code my own game.

Programming

  • I code in Python using PyCharm. I’m looking for alternatives.

  • I will use GitLab when I decide to publish some of my work.

Productivity

  • LibreOffice, although the UI is iffy

Misc

  • I don’t use any location services

  • All my clocks are set to UTC

  • I don’t have a smart watch

  • I don’t have a smart car

  • I use Bluetooth earbuds

  • I cover my webcams with paper and tape. Reason: It’s worth taking a couple seconds to peel tape off when you use the webcam than to risk a massive breach.

Thanks for reading!

Note here: I found out the other day that a Google Streetview car passed by my house, and my blinds being shut were the only thing keeping my room away from prying eyes. Is there an easy way to blur/censor my house without giving up my soul?

Special thanks

Lots of people kindly contributed their personal setups in the comments, and some even made their own posts! I’m really glad I could spark inspiration and start a way for people to learn and grow in their privacy journeys. To think, just this morning, I was stressing on if people would even enjoy the post at all! Thank you all again, and please go forward to inspire others. I am not the person who made this happen, all of you are!

  • Shamot@jlai.lu
    3·
    8 months ago

    Glad to see you use cash. It’s often forgotten in privacy advice, despite being one of the most importants.

    • sugar_in_your_tea@sh.itjust.works
      0·
      8 months ago

      My main issue is with change. Sales tax means I get funky prices, like $2.37, so I get lots of small change. If prices were rounded to the nearest quarter, I’d use cash a lot more.

      • bloodfart@lemmy.ml
        0·
        8 months ago

        The old jar full of change at home is how most people handle this.

        It’s normal to have some change. Theres a famous movie, reservoir dogs maybe, where a cop has to blend in and scoops some change up off his nightstand and considers its weight before he stuffs it in his pocket.

        Part of privacy is anonymity and one aspect of security is obscurity. Look normal, carry change.

        • sugar_in_your_tea@sh.itjust.works
          0·
          8 months ago

          Carrying change isn’t normal these days, at least in the US. And it’s not something I want to do anyway.

          If we had a law that advertised prices must include sales tax, I’d probably use cash again because stores like to advertise simple prices. In the current situation, a $1 item would actually cost $1.08, so I would get $0.92 in change. I rarely go to multiple stores in a given day, and I’m not going to carry change just in case I happen to buy something that day. I do have a change jar, but I almost never use it because change is a hassle.

          I’ve considered using gift cards, but the reloadable ones still require your name and the non-reloadable ones are too much of a hassle and too expensive. I do have one reloadable store gift card for a grocery store, but that’s it. Unfortunately, the only options for in-person digital payments are Google Pay, Samsung Pay, and Apple Pay, and I think those are each worse than paying with a credit card (now Google, Samsung, or Apple have all my payment information).

          So, I just live with stores being able to track my purchases at their store. It’s not ideal, but at least there’s no one central institution with all of that data (and I use and rotate multiple cards).

          • bloodfart@lemmy.ml
            1·
            8 months ago

            That’s weird. I’m in the us and it’s normal to use change or cash. The vending machines all take it, stores all take it. You gotta prepay for gas but whatever. There’s special self checkout registers festooned with cameras that you can’t use but idk if you’d want to go through one of those anyway.

            No worries if you don’t want to, but I haven’t seen any weirdness around it.

            What are you worried about with the existing cashless payment options?

  • Lemmy@lemm.ee
    1·
    8 months ago

    “My BIOS is password locked but proprietary (due to compatibility issues).”

    “I use full disk encryption, multiple disks, and a second layer of encryption for specific important files (NSA style)”

    I recommend switching to Libreboot, I’ve recently helped add support for the Dell Optiplex 9020 MT, and will soon add support for the Dell Precision T1700 MT. Libreboot allows for full disk encryption, including the automatically encrypting the /boot partition during installation of an OS. I use RAID 0 with 3 disks (LUKS and LVM) on my desktop, with my /boot unencrypted stored on a SD card so I can easily toss it whenever.

    For gaming, I’ve had success using Proxmox to play games like GTA V and Rainbow Six Siege through a VM, even passing through NVIDIA drivers (though I plan to switch to AMD). Although, currently the Haswell boards (9020MT and T1700MT) can’t use IOMMU correctly so I recommend using the T1650 for passing through your GPU to a VM. Beware though, the T1650 board can’t be freed entirely in the BIOS I believe.

    Also, updating your CPU microcode can help avoid potential performance issues. If you’re concerned about security, consider GPG signing your kernel with Libreboot GRUB for an additional layer of verification at boot.

  • Mikina@programming.dev
    1·
    8 months ago

    My own setup from the top of my head would be:

    • Browser: Mullvad with Mullvad VPN, LibreWolf for stuff that breaks. Brave if I really have no other choice.
    • Phone: Pixel with Graphene, main profile is Google-less, second profile with Sandboxed GServices for apps that don’t work without it but I need them, downloaded through fresh gmail profile. Third profile linked to my old gmail with credit card for the two apps I bought and sometimes need to use.
    • Mail: I use Protonmail, with my own domain that sounds vaguely corporate. I have a catch-all address, and generate random name.surename@mycorpdomain.com addresses for each service.
    • File storage: I have a NAS, that I use for most file sharing I need.
    • Music: Jellyfin server with Headphones and redacted.ch account, and I also make sure to support artists every month by spending what would be my Spotify subscription price on Bandcamp albums
    • Desktop: I run Nobara, too lazy to run QubesOS - plus I game a lot, so it would be infeasible. I mostly try to get stuff on GoG and back it up on my own NAS. I have a ZeroTier network set up for streaming through Sunshine/Moonlight when I need to game from a laptop.
    • VPN: I use Mullvad paid for with Monero, because it plays nicely with the Mullvad Browser fingerprint.
    • Home automation: I have a few basic stuff made for Home Assistant that is running on RockPI I have at home, everything local and without any cloud, mostly through ESP32s.
    • Messaging: This is the one I hate the most - most of the groups I’m working with or volunteering for use Messenger, so I have a Matrix server hosted that bridges it and Discord. It’s not ideal, but better than having anything Meta on my phone.
    • Payments: This one is the one I’m struggling with the most. I pay by card almost everywhere, because cash is so much effort. I’ve tried looking into crypto or prepaid cards, but it’s really hard to find anything without KYC in Europe, so I’ve given up. I’m looking for advice regarding this, but I’m afraid that aside from switching to cash I’m out of luck.
    • Passwords: I just use Bitwarden with YubiKey setup, same as using YubiKey for every important MFA I can. I have two backup keys stored at home, so I don’t need to use other recovery methods that would render it useless.
  • MigratingtoLemmy@lemmy.world
    11·
    8 months ago

    Very nice read, I look forward to posts with detailed explanations of realistic privacy setups!

    With that said, here we go:

    1. TOR has been compromised. It likely doesn’t matter if you’re not doing anything that nations would be interested in, but something to keep in mind.
    2. True nerds/privacy hobbyists always have multiple browsers for different use-cases. Bravo! I need to take a look at Mullvad myself, I really don’t like Brave anymore.
    3. Do you host your SearXNG instance? It should not be very hard to do on the cloud.
    4. Which DNS resolver? I’m assuming this is upstream to your Adguard setup, which means the latter acts as the recursive resolver in your setup, if I understand correctly.
    5. Didn’t hear about SecureBlue before this, good distro in theory. Thanks.
    6. Ever thought of getting a 10-year old Thinkpad yet to get rid of that pesky BIOS? \s
    7. Do you have DoT and DNSSEC set up for your “private” DNS? Also, is this something like Quad9?
    8. With the combination of flight mode and a Faraday bag along with not having a SIM, I’m assuming that people don’t reach you using traditional means (calling). How do you stay in contact with others?
    9. Define “locking down” of public accounts.
    10. I have been thinking of AI for a bit, and you can get a P40 with 24GB VRAM for about $100-$150 on Ebay. Put that in an old computer and fight with licensing for a bit (Craft Computing has a good video on getting VFIO working on Nvidia cards by tricking the software) and you’ll have a great setup for AI.
    11. I’d stop with the subscriptions and start sailing the high seas, personally, but I understand if the sentiment does not sit well with people here. Piracy simply gives you more control and privacy. Look at LocalMonero to try and get monero without leaving a trace (directly converting fiat to XMR and exchanging for gift cards online after churning).
    12. You must be using an old TV, but if you really need to purchase a new TV at some point (and it’s very likely to be “smart”), you can simply disconnect the WiFi antenna from the back of the device. If you’re really good at embedded systems, you could find the flash chip that holds the BIOS/OS of the TV and remove it (and edit the boot sequence) or flash it with something else. This is true for everyone who has a smart TV.
    13. Holy shit this guy programs games to play them what a chad.
    14. Please switch to Codeberg, Gitlab is annoying.
    15. How do you coordinate local time with other people if your clocks are set to UTC?

    That was a lot. Thanks for reading!

    • sugar_in_your_tea@sh.itjust.works
      1·
      8 months ago
      1. Yup, here’s a good article about it - TL;DR - it can be useful, but you need to be careful
      2. I use Brave for testing my work stuff on Chrome; Firefox w/ Container Tabs for pretty much everything else

      Piracy simply gives you more control and privacy

      True, but I’m also morally against it. I’m not too worried about a game platform knowing what games I buy though, so I just stay away from cloud-based games and call it good.

      disconnect the WiFi antenna from the back of the device

      I’ve been thinking of putting mine on a DMZ. Do you think that’s sufficient, or is there documented evidence of TVs connecting to free Wi-Fi automatically? I suppose I could run a cable, but I will need some way to connect my streaming server to my TV (I suppose I could throw a Raspberry Pi behind it).

      Codeberg

      I’ve heard about it, good call-out.