See anything in here you'd disagree with Holla Forums?

privacytools.io/

See anything in here you'd disagree with Holla Forums?

Other urls found in this thread:

ranum.com/security/computer_security/editorials/dumb
8ch.net/tech/ddg.html
twitter.com/SFWRedditImages

Basic:
DuckDuckGo
Freenet (Compromised)
Reddit

Autism (Probably Missing A Few Here):
Ubuntu Touch
Debian
Arch
Tails
KNOPPIX
Puppy Linux
Whonix
Trisquel

the biggest search engine scam

Until you can provide ACTUAL EVIDENCE that it's doing something with your data, you're just talking out of your ass.

No, it isn't. You mean that one case where a local PD claimed they'd acquired a freent user's IP address? There was never any follow up to that and no evidence it actually happened, so >>>/out/

It's free

loving every laugh

I'm pleasantly surprised that this is mentioned. Not mentioned in the text is that the Do Not Track header is snake oil of a similar calibre and should be disabled.

I'm not really a fan of this because the most common profiles are very dynamic. I prefer to send as few things as possible in order to look like a bot instead. When I make a request, the server sees the following three lines:GET /request/here HTTP/1.1Host: host.name.hereConnection: keep-alivekeep-alive cannot be disabled in Firefox (Mozilla are faggots) but it is pretty useful and common anyway.

Great example of the default permit problem ( ranum.com/security/computer_security/editorials/dumb ).
Most cookies are completely unnecessary and don't impact the functionality of the site, so just use a whitelist instead. I allow nine domains to store cookies and five of those are login-related; curating the list by hand is perfectly doable. Cookie Manager+ works well for this, but I think Firefox has a similar native functionality by now.

I disagree that NoScript requires a lot of work. Disabling JS is probably the best thing you can do for privacy (see Default Permit above) and many sites degrade gracefully nowadays.

A lot of this is redundant because many options concern Javascript and cookie behaviour, but you may want to enable it anyway. Mozilla's tracking protection is basically a blacklist of tracking sites from what I can gather, so something like uMatrix or Policeman solves the problem better (again, see Default Permit)

Just encrypt your shit manually, jesus fucking christ.

This reads like an advert. How the fuck are Etherpad and Ethercalc privacy-related? Protected Text sounds like bullshit purely on the basis of Javascript crypto. How can somebody think this is acceptable?

Two linux distros where the only real difference is muh libre firmware, but OpenBSD is only in the honorable mentions, lel.

If you want privacy, don't use a goytoy with a hidden second OS. Period.

7/10 it's okay

You can say the same about 4chan

Enable it. Either a site is going to acknowledge it, or ignore it - you won't get some sort of extra tracking for enabling it, there's no loss.

"Hmm, why is this bot at this IP looking at so many pages about bombs? Let's investigate jim, boot up xkey"

If the cookies are deleted there's no problem with default permit, it's completely different to having the majority of ports left open.
(Also noscript sucks, use umatrix for much more granular control)

It doesn't matter if it's encrypted by JS, the language doesn't affect how the encryption scheme and related algorithms work. That's a criticism by a moron.


I can and will continue to, thanks mate

8ch.net/tech/ddg.html

Says who, your assumption about the server? If you are going for the minimal fingerprint elsewhere, enabling DNT just makes you stand out.

Because random user agents will protect against direct eavesdropping by the NSA when they already have your IP, right? Fucking idiot.

"Yeah, I touch shit and dirt every day, but don't worry about my cooking — I always wash my hands before I go to bed!"

Different languages have different engineering properties and a language that emulates integers with floating point numbers is not suited to cryptography. Please never touch cryptographic code in your life.

Random Agent Spoofers are just as good for privacy as anything else, when use judiciously. The problem usually comes up when your user agent changes each request. Pretty obviously standing out at that point.

You're really just heaping work onto yourself by using any other method. Unless you don't use Firefox and thus don't have access to it's addons. In that case it's probably worth it.

about:config
network.tcp.keepalive.enabled

umatrix gave me more control but it had so many options I was confused. I went back to noscript

You can use TOR on DuckDuckGo.

How am I heaping work onto myself? If anything, refusing to send any extra information is less work than the creation of plausible fake profiles. The most common user agents change over time. Since user agent spoofing doesn't fool a state-level attacker, we are talking about defence against single sites, and these sites can't tell you apart from some command-line tool. Unless they use behaviour analysis that is, but then fake agents won't help you either.


This option is ignored by Firefox (since around version 18 i think). Try it out, open a "web server" with socat on your computer and connect to it. It still sends the keep-alive header even if you tell it not to.

One last addition: The list doesn't talk about referrers, which should be disabled across different domains. RefControl works pretty nicely for it, but maybe uMatrix has a feature for that, too.

...

that site is just a bunch of hype like warrant canaries and which VPN to be cucked by to get neckbeards to focus on such useless bullshit

there's no fucking such thing as a privacy tool. there are just broken products that spy on you for no reason and leak data because they're made by incompetent morons (including most "privacy tools")

that site is just a bunch of hype like warrant canaries and which VPN to be cucked by to get neckbeards to focus on such useless bullshit

there's no fucking such thing as a privacy tool. there are just broken products that spy on you for no reason and leak data because they're made by incompetent morons (including most "privacy tools")

User agents are literally strings. Even if you were to create an addon all by yourself you're still creating more work than is necessary by going through the commandline.

And if you have addons well it's literally one click vs any amount of work.

Nigger, what are you even talking about? Changing the user agent takes about as long as searching for an addon. Not to mention that you are talking about a recommendation list that already includes about:config fiddling.

Why do people believe warrant canaries? With the US IC gone rogue, what's to stop the FBI from threatening people to retain warrant canaries, or else... ?

That's not "ACTUAL EVIDENCE".

I use both

Here's an example image.

The black bar is set to * so all choices are global, e.g. if I'm on 8ch and I allow youtube.com then it's allowed everywhere I go to and not just on 8ch. You'll probably not need to change this setting.

CSS and images are dark green. They're allowed everywhere unless otherwise specified.

Scripts are dark red (for demonstration purposes). They're not allowed anywhere, period. Javascript is disabled.

The rest are light red. They're not allowed anywhere unless otherwise specified.

8ch.net has been set to dark green, so everything is allowed here except for scripts since they've been globally disabled. banners.8ch.net has images set to dark red, so the global rule to allow images has been overruled for that.

softserve.8ch.net has been designated by uMatrix' filters as advertising or something, so nothing from that subdomain is allowed regardless of what the global rules say.

There's also settings for 1st-party. If I set 1st-party scripts to dark green then scripts would always be allowed but only on the site I'm connected to. If I'm on google.com then scripts from google.com (first party) are allowed but google-analytics.com is not allowed since it's a third party site.

uMatrix accepts all cookies, but it won't allow sites to read them unless they have permission. This lets uMatrix know how many cookies a site has set, without allowing the cookies to be used.

(Or that's what I remember the reason being.)

I hope it is clearer to you by now what evidence means.

manually? Just use transparent full drive encryption.

wouldn't it be nice if they got rid of nonfree software? Sometimes it could be a security burden.
But really, despite being the most secure practical operating system in the world I don't think OpenBSD is or even tries to be secure by default. To me it looks like the team prioritizes code maintainability over security. They are not after security by design, they are after a traditional design and some security through minimalism.

Why would they have forked NetBSD in this case? NetBSD is good enough to have been used on the fucking ISS.

What, is it compromised? Is it because systemd?

Same reason people believe in privacy policies: Wishful thinking.


I honestly prefer it that way. Minimalism and maintainability are the most effective ways to achieve security, and the shit that is published while Designed With Security In Mind™ is incredible.

also see nologz VPNs.