diff --git a/guide_english.md b/guide_english.md index 25bf80e9b9419778c0591805471e43b952e7a1e2..b6c78c45308dc74b76d3a77ddff32e5e04e2f193 100644 --- a/guide_english.md +++ b/guide_english.md @@ -184,31 +184,39 @@ If necessary, our advice is to best use a tablet (because it can't be controlled ### Laptops and Desktop Computers Running as much *Free and Open Source Software* as possible on your laptop or desktop computer gives you a good deal of control back. + With proprietary software like Microsoft Windows or Apple's Mac OS, chances are they will support law enforcement in their effort to "fight crime" and break into your computer. + With *Linux* or any other open alternative, the program code is exposed to a whole community, making it much harder to mess with. -As a side node, the best protection against computer viruses is simply to not download software from random websites and to not open potentially dangerous email attachments from untrusted people. + +As a side node, the best protection against computer viruses is simply to not download software from random websites, to not open potentially dangerous email attachments from untrusted people and not click on random links in emails from strangers. + This includes Microsoft Office documents that can be abused for various attacks ([source](https://www.thedailybeast.com/this-is-how-cops-trick-dark-web-drug-dealers-into-unmasking-themselves)). Antivirus software only offers patchy protection but is itself vulnerable to attacks ([source](https://theintercept.com/2015/06/22/nsa-gchq-targeted-kaspersky/). There are many different bundles of the Linux core with various open source software called *distributions*, of which we recommend two specifically: -- *[Linux Mint](http://www.linuxmint.com/)* offers one of the most painless ways to get an open system with many probably familiar software like Firefox, VLC player, LibreOffice etc. -They offer different *Editions* of which *XFCE* is a simple, fast desktop that still runs well on old computers and *Cinnamon* is a bit more fancy. -- *[Ubuntu Linux](http://www.ubuntu.com/desktop)* is the base for Linux Mint and a company effort to build a user friendly version of Linux. -It is itself based on one of the oldest community distributions, *[Debian](http://www.debian.org)*. -While the company behind it decides its direction, it still has a very strong community around it. +- *[Ubuntu Linux](http://www.ubuntu.com/desktop)* is the base for Linux Mint and a company effort to build a user friendly version of Linux. While the company behind it decides its direction, it still has a very strong community around it. Ubuntu has a lot of different flavors that can be installed on older machines. +- *[Debian](http://www.debian.org)* is the base for Ubuntu. It doesn't contain the freshest soft you can get, but focuses on stability and security of your distribution. + +- *Installation:* Make sure to save all your important data on some ***external*** medium (hard drive or stick) and get support from a computer geek if you can. Ideally use the help of install parties. -- *Installation:* Make sure to save all your important data on some ***external*** medium (hard drive or stick) and get support from a computer geek if you can. It is usually possible to install Linux next to Windows (*dual boot*), but **expect the installation to overwrite everything**. -To get you started [here is a guide to install Ubuntu from a USB drive](https://help.ubuntu.com/community/Installation/FromUSBStickQuick) that should also work with Linux Mint if you just download their files, [and here is a video how to to install Linux Mint](https://www.youtube.com/watch?v=XKI024wUTUw). + +To get you started [here is a guide to install Ubuntu from a USB drive](https://help.ubuntu.com/community/Installation/FromUSBStickQuick) + But first read the next paragraph... Storage Encryption (Confidentiality) ------------------------------------ Encrypt your computer! + All further advices for software and communication means are not safe if your computer is not safe. + **The encryption is intended against offline attacks only, if the police captures your computer unlocked, they will just copy your data.** -A screen lock or suspend mode with a decent password is better than nothing, but the device should be powered down whenever possible. + +A screen lock or suspend mode with a decent password is better than nothing, but the device should be powered down whenever possible as there are ways to extract data from turned on computer. + **If the police knocks your door, first run to your computer and press the power button until it switches off.** There are three major ways to encrypt your data: @@ -216,52 +224,60 @@ There are three major ways to encrypt your data: ### Encrypt Your Home Folder ***Use this if unsure***: only your personal data gets encrypted (including Firefox Bookmarks etc.), but the rest is not. -- Advantages: +Advantages: - The computer pretty much works as normal and your personal files are still very safe. -- Disadvantages: + +Disadvantages: - You should use a long user password, which you will need to type each time the screen is locked. - It is possible to manipulate your programs (e.g. Firefox, GPG) so they reveal your passwords etc. - How to: during Linux installation, select "Encrypt my home folder" when creating your user. -### Encrypt The Whole System +### Encrypt Partition This means that only a tiny part of your hard drive remains unencrypted and everything else - your programs, etc. - is. -- Advantages: +Advantages: - It makes it harder e.g. to put a bad version of Firefox or GPG on your computer. - You can use a long strong password just for starting the computer and a shorter one for your screen lock. -- Disadvantages: + +Disadvantages: - You need to start the computer, put in the disk encryption password and then wait for it to come up. -- You need to remember two passwords, and the disk encryption password is harder to change. -- How to: during Linux installation, at *Installation type* select "Encrypt the new (Linux Mint/Ubuntu) installation for security". +- How to: during Linux installation, at *Installation type* select "Encrypt the new installation for security". ### Use an Encrypted Container -An external drive or a very big file ("container") is encrypted and you need to unlock / put files in and out / lock the encryption separately. +An external drive or a very big file ("container") is encrypted and you need to unlock / put files in and out / lock the encryption separately. Ideally should be used with encrypted systems. -- Advantages: +Advantages: - Can be used to transfer files between encrypted computers. - Can be used on external hard drives. - Can be used on Windows and Mac OS. - Can be used as an additional secure place that is normally closed on an already encrypted Linux. - Has special features to so that a fake password can show fake files, if you are forced to reveal a password. -- Disadvantages: + +Disadvantages: - All kinds of temporary files from LibreOffice, Thunderbird email, Firefox surfing profiles etc. are not encrypted. - Needs to be opened and closed separately. +- Broken if mounted on compromised system. +- Doesn't protect from any tempering with your computer - How to: get [Veracrypt](https://veracrypt.codeplex.com/releases) and follow the [howto](https://veracrypt.codeplex.com/wikipage?title=Beginner%27s%20Tutorial). -### Android and iOS +### Android +In newer devices encryption in Android is enabled by default. However check this in your configurations. If you are not sure have a look at the guide: - [Howto for Android](http://www.howtogeek.com/141953/how-to-encrypt-your-android-phone-and-why-you-might-want-to/) ### Limitations Your password prompt must come from somewhere and so there's always unencrypted data on your device, data that can be messed with (e.g. replacing your Linux' password prompt with one that sends the password to the police). + This can be made harder with some tricks[^3], but remember that the most realistic scenario is a simple police raid. [^3]: The only way to prevent this attack is to sign the unencrypted data and let some trusted part check the signature. This can either be done using a TPM, or more readily by using SecureBoot and trusting your manufacturer's firmware (which is what modern Linux distributions do). + Some pointers: [1](http://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform/), [2](http://kroah.com/log/blog/2013/09/02/booting-a-self-signed-linux-kernel/) Backup your Data (Availability) ------------------------------- If it comes to a police raid (or a simple break-in), an oh-so-amazingly encrypted device will still be taken by the police. + To take some of the pressure off yourself, **regularly** stash encrypted copies of your data outside your home, ideally with people that are not close relatives nor active in the same groups. While we are at it, even public data should not be trusted to IT corporations, as they might just [delete](http://fusion.net/story/325231/google-deletes-dennis-cooper-blog/) or accidentally lose it. @@ -271,8 +287,11 @@ Internet Services So by now we can use a well-secured Laptop behind our locked door to write lengthy security guides, but how do we actually talk to people in a secure way? Besides the technical aspects below, using alternative service providers offers an additional degree of protection, such as storing data encrypted and refusing to cooperate with the police. + A list of alternative tech collectives can be found [here](https://www.systemli.org/en/friends.html) and even more [here](https://help.riseup.net/en/security/resources/radical-servers) and a list of email providers [here](https://prxbx.com/email/). + We recommend finding alternatives to Riseup.net, because their prominent position and the legal situation in the US puts a lot of pressure on a single tech collective, and in early 2017, they have cooperated with the police in two non-emancipatory criminal cases ([source](https://riseup.net/en/about-us/press/canary-statement)). + We do not think that there is an urgent need to move existing infrastructure away from Riseup. A Word about Web Browsers @@ -283,46 +302,62 @@ The Riseup Collective has a compact [guide](https://riseup.net/en/better-web-bro Anonymity --------- The whole point of the Internet is to connect two computers, like yours with... say *Youtube*. + Now for the cat videos to find their way back to you, obviously the computers on the way (*routers*) need to know the Internet address of your connection. + The trouble is that if any computer on the way is surveyed by the state, or you access an evil web site like e.g. that of the police, they could track that Internet address back to your physical location, or connect it with other online activity you were doing (like accessing your web mail). There are two ways to avoid this, which for additional security should ideally be combined with each other: The first method is to use a software called *[TOR](https://www.torproject.org/)*, or *The Onion Router*. + In a nutshell, it works by sending your data in 3 layers of encryption (hence the "onion") over three computers (*TOR nodes*), where the first knows your Internet address and the second node to contact (but not the destination), the second knows nothing (only which the third node will be), and the third node knows the destination, but not the origin. -For maximum security, it is best to install [Tails](https://tails.boum.org/) on a USB thumb drive and boot Tails on computer instead of the Linux / Windows or whatever operating system you're using normally. + +For maximum security, it is best to install [Tails](https://tails.boum.org/) on a USB thumb drive and boot Tails on computer instead of the Linux / Windows or whatever operating system you're using normally. Tails resets itself everytime you reboot, making it hard to compromise your working OS. Tails routes all the internet traffic through TOR network by default. + This way you have the best chance of having no connection between your anonymous activity and your normal use of the Internet. + Second best is to follow the guides ([Linux](https://ssd.eff.org/en/module/how-use-tor-linux), [Windows](https://ssd.eff.org/en/module/how-use-tor-windows), [Mac OS X](https://ssd.eff.org/en/module/how-use-tor-mac-os-x)) and strictly only use the TOR Browser when doing anything sensitive. If you must use a mobile device, there is a software called [Orbot](https://guardianproject.info/apps/orbot/) for Android devices. -On Apple devices, [Onion browser](https://mike.tig.as/onionbrowser/) offers a at least a minimal TOR-enabled browser. -The second method is simply to use public wifi in places where there are no surveillance cameras. +The second method is simply to use public wifi in places where there are no surveillance cameras. However this potentionally can disclose the city where you are active. + Unfortunately, your computer's wifi has a unique *MAC* address. It can be changed with software in case the wifi stores them (some corporate portals will, to tell if you already acknowledge the Terms of Service, or used up your hour of free Internet), but it is advisable to use this method only for extra security when using TOR. Email ----- Email is like postcards, assume it is read by transport providers and state agencies. + PGP is a way to encrypt (wrap your postcard) email contents, but be aware that the email subject and the fact who is communicating when, with whom and from which computer, are not concealed. Immerda.ch has is a nice German introduction into how PGP works [here](https://wiki.immerda.ch/index.php/immerda:GnuPGIntroduction). PGP depends on *keys* (special files of which the private key is protected with a password) that, like physical lock and keys, should restrict access to information. + Therefore PGP's security depends on a safe key exchange; so make sure you got the right key, e.g. by getting it in person from the recipient. The Electronic Frontier Foundation's Surveillance Self-Defence guide has a pretty good howto for using PGP ([Linux](https://ssd.eff.org/en/module/how-use-pgp-linux), [Windows](https://ssd.eff.org/en/module/how-use-pgp-windows), [Mac OS X](https://ssd.eff.org/en/module/how-use-pgp-mac-os-x)). -You shouldn't use your activist email address on mobile devices at all, but if you must, use [K9-Mail](https://k9mail.github.io/) with [OpenKeychain](https://www.openkeychain.org/) on Android. +You shouldn't use your activist email address on mobile devices at all. Mailing Lists ------------- Now if PGP encrypts messages between two people, what about mailing lists? + If there is just a small group, people can exchange PGP *public* keys and then everybody can encrypt their message so that every recipient can read it. -Unfornately, this gets messy quickly if new people join the list. + +The group can also create one *secret* key for the mailing list and pass it to every new person joining the mailing list. + +Unfornately, this gets messy quickly if lots of new people join the list. + Therefore, people came up with a solution that is not as secure, but better than nothing: *[Schleuder](http://schleuder2.nadir.org/)* is a mailing list software that gets its own PGP pair. + Everybody then encrypts email to Schleuder's mailing list key and Schleuder decrypts the message, and encrypts and sends it to each list member separately. + Of course the downside is that whoever is running Schleuder could get hold of Schleuder's PGP private key and read the encrypted messages. + Yet, as Schleuder is a complex beast, it is recommended to use it from a tech collective you trust, like for example [Immerda.ch](https://wiki.immerda.ch/index.php/immerda:NewSchleuderList). Messengers / Chat @@ -330,35 +365,48 @@ Messengers / Chat **TL;DR:** don't use the rest and skip down to **Jabber** below, and use **Signal** for outside people (e.g. Journalists) that you can't get to use Jabber. **Skype** has a reputation for being encrypted, however they have publicly stated their ability and willingness to hand out information to law enforcement, which they do in required cases. + All your written text are stored on the servers of Skype and can be accessed by the police ([source](https://en.wikipedia.org/wiki/Skype_security#Eavesdropping_by_design)). Since some time, mobile messenger apps based on phone numbers have gained popularity. + If you consider using any "secure" messengers on a mobile device, be [reminded](http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-and-telegram-encryption-useless-503894.shtml) that communication through the mobile network is vulnerable to eavesdropping and manipulation. In order to figure out who of your contacts uses the same application, the apps generally require uploading information on ***all*** of them to their servers ([source](https://whispersystems.org/blog/contact-discovery/)), but they do so in various degrees from grabbing the whole address book to just uploading an obscured form of the phone numbers. **The privacy implications of this for activist are huge, because one person uploading an anonymous number with the person's real name will ruin their effort.** **Whatsapp** is by far the most successful mobile messenger to date, and recently they too claim to support "end to end" encryption (everything is encrypted between you and the people you talk to). + However, the source code to their programs is not open. There are issues with their end-to-end encryption, though they appear non-intentional (source [1](https://www.theguardian.com/technology/2017/jan/13/whatsapp-backdoor-allows-snooping-on-encrypted-messages), [2](https://whispersystems.org/blog/there-is-no-whatsapp-backdoor/), [3](http://technosociology.org/?page_id=1687)). + In the past it has been possible for anyone to get profile details for any phone number ([source](https://www.lorankloeze.nl/2017/05/07/collecting-huge-amounts-of-data-with-whatsapp/)) and people can still snoop on any Whatsapp user's online status ([source](https://robertheaton.com/2017/10/09/tracking-friends-and-strangers-using-whatsapp/)). Basically the same holds for **Threema**, as their software is not Open Source either. **Telegram** has convinced many boasting with their altruism. -They *do* provide the source code of their client, but their encryption is outdated techniques from the 70ies ([source](https://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/)), needs to be enabled manually and does not work for group chats. +They *do* provide the source code of their client, but their encryption is outdated techniques from the 70ies. + On the other hand, they *do* go all inclusive when they just grab your address book, unlike others not just number but with names ([source](https://news.ycombinator.com/item?id=6915194)). + Consequently, the German federal police has managed to hack into Group chats ([German source](https://motherboard.vice.com/de/article/pgk7gv/exklusiv-wie-das-bka-telegram-accounts-von-terrorverdaechtigen-knackt)). +Telegram is not anonymous. If the person has your number in their contact list, they will have connection between nickname and phone number (the latest known example of this used is Hong Kong protest) + Now, **[Signal](https://signal.org/)**. The folks behind Signal are *a lot* more privacy minded than the rest of the phone number based messenger crowd and they were first to make end-to-end encrypted group chats feasible. Our take is that [claims](https://www.theregister.co.uk/2017/07/14/uk_spookhas_gchq_can_crack_endtoend_encryption_says_australian_ag/?mt=1500021512347) of broken end-to-end encryption are inaccurate and actually based on cracking the individual mobile device, not Signal's encryption itself. Whilst they still technically get to see all the patterns of communication (but not the content) ([source](https://en.wikipedia.org/wiki/Signal_(software)#Metadata)), at least their founder comes from a more trustworthy background ([source](https://moxie.org/blog/we-should-all-have-something-to-hide/); and he has some pretty funny [stories](https://moxie.org/stories.html), too). + Still, the system is centralized and while the software is Open Source, they maintain tight control over their network. Signal is available for iOS and Android. -Once one of these apps is registered, a Desktop software can be linked to the app, after which Signal can be used on a laptop or desktop computer without a mobile device. + +Once one of these apps is registered, a Desktop software can be linked to the app, after which Signal can be used on a laptop or desktop computer without a mobile device. However desktop functionality is limited in comparison to it's mobile version. + On Android, Signal is also available outside Google Play via [https://signal.org/android/apk/](https://signal.org/android/apk/), but Signal's inventor actively asks alternative software to leave the network ([source](https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165)). -People find elaborate ways to get around the need for a phone number ([guide](https://yawnbox.com/index.php/2015/03/14/create-an-anonymous-textsecure-and-redphone-phone-number/)). + +Usage of phone numbers for registration of your account and lack of support for multiple identities makes Signal hard to use in case where you have to balance between several identities. In countries where phone registration is connected with your ID, passing your signal phone number might disclose your personality to people your don't want. + Altogether this makes Signal a good choice for people who use Android or Apple smartphones anyway, but better tools exist for people who need more security than mobile platforms provide. Jabber / XMPP @@ -366,42 +414,61 @@ Jabber / XMPP Enter **Jabber** / XMPP. *Finally, you made it! **This is what we currently recommend for sensitive real-time communication.*** Similarly to email, people from many different service providers (see the alternative tech collectives above) can talk to each other. + Also similarly to email, per default Jabber offers only very weak encryption. -For actual messages, *OTR* exists as a pretty okay encryption method for synchronous (both people online at the same time) communication. + +For actual messages, *OTR* exists as a pretty good encryption method for synchronous (both people online at the same time) communication. + However, some caveats apply: 1. The fact that two people are communicating is still not concealed, therefore use pseudonyms not linked to other activities. + 2. OTR commonly uses an authentication system based on things only the other person knows. It is important to make use of it to be sure you're actually talking to the right person. Otherwise if the dark side manages to intimidate your Jabber provider they could pose as your friend/comrade. + 3. Files sent via Jabber are not encrypted with OTR. + 4. Audio and video chats in Jabber clients are not encrypted by default. Some clients support *OMEMO* as a newer alternative to OTR, which can also encrypt group chats and supports asynchronous communication, similar to the popular mobile messengers. With [Conversations](https://conversations.im) for Android and [ChatSecure](https://chatsecure.org/) for iOS, Jabber can be an alternative to these messengers that evades central control. + Unfortunately, not all Jabber servers support stashing your messages when you're offline (see [here](https://gultsch.de/compliance_ranked.html) for an overview). + Also, chat software for laptops or desktop computers has been a bit slow to pick up OMEMO. -As an OMEMO-capable alternative to Pidgin (which is usually featured in the Jabber guides), we recommend installing [Gajim](https://gajim.org/). + +As an OMEMO-capable alternative to Pidgin (which is usually featured in the Jabber guides), we recommend installing [Gajim](https://gajim.org/). Be aware that Gajim doesn't support OTR, so you might be pushed to install Pidgin to talk to people via OTR. [einfachJabber.de](http://www.einfachjabber.de/) has an elaborate German introduction and guides for all kinds of devices and operating systems. + English language tutorials can be found at the EFF's Surveillance Self-Defence guide ([Linux](https://ssd.eff.org/en/module/how-use-otr-linux), [Mac OS](https://ssd.eff.org/en/module/how-use-tor-mac-os-x), [Windows](https://ssd.eff.org/en/module/how-use-tor-windows)). Voice / Video Chat ------------------ There are several solutions that are Open Source software, available for multiple computing platforms and offer end to end encryption of audio and video ([overview](https://en.wikipedia.org/wiki/Comparison_of_VoIP_software)). -If you can live with the disadvantages, Signal (see above) seems to be the most practical solution for mobile platforms. + +If you can live with the disadvantages, Signal (see above) seems to be the most practical solution for mobile platforms for non anonymous communication. On laptop / desktop computers, if you can get it to work, **[Tox](https://tox.chat)** is a pretty amazing, high security and low effort alternative. + More traditionally, **[Jitsi](https://jitsi.org/)** enables encrypted calls via either a *SIP* or better yet, a Jabber/XMPP (see above) account. -**[Ring](https://ring.cx/en)** seems to be another promising alternative (that we haven't tried yet), and **[Wire](https://wire.com/)**, while also centralized, seems to offer an alternative to Signal that does not need phone numbers and makes some bold [privacy claims](https://wire.com/privacy/). -Fellow activists use **[Mumble](https://mumble.info)**, which seems a good solution if you can run your own server, but we haven't used it ourselves yet. + +**[Jami](https://jami.net/)** seems to be another promising alternative in development, and **[Wire](https://wire.com/)**, while also centralized, seems to offer an alternative to Signal that does not need phone numbers and makes some bold [privacy claims](https://wire.com/privacy/). + +Fellow activists use **[Mumble](https://mumble.info)**, which seems a good solution if you can run your own server (it encrypts traffic to the server only), but we haven't used it ourselves yet. A more ad-hoc method involves a technology called *WebRTC* just requires a modern web browser like Firefox or Chrome, with the caveat of trusting some central web site to not be malicous (and the connection to that network not to be manipulated). -**[pavala.tv](https://palava.tv/)** and **[meet.jit.si](https://meet.jit.si/)** are two open source based web services for that. + +**[meet.jit.si](https://meet.jit.si/)** is an open source based web service for that. + +However due to some problems with WebRTC implementation it is disabled by default in Tor Browser making it quite hard to use with tor network. We recommend using WebRTC at least with VPN. Blogs, Websites and Social Media -------------------------------- Unless you have a computer security person in your group, you probably shouldn't run your own website, as the forces of evil frequently censor websites or - potentially worse - gather data about who operates them ([source](https://www.washingtonpost.com/local/public-safety/judge-lets-internet-firm-redact-user-identifying-data-in-information-provided-to-prosecutors-in-rioting-case/2017/10/10/dacf710a-adf2-11e7-9e58-e6288544af98_story.html)). + On the other hand, social media corporations will happily hand over data or mess with emancipatory content in a multiple ways ([German source](https://netzpolitik.org/2017/ziemlich-schnell-entfreundet-tuerkei-kritiker-verlieren-raetselhaft-viele-follower-auf-facebook/)). -The best alternative is to open a blog at one of the tech collectives, or let a trusted collective operate your website, if you really need a custom one. + +The best alternative is to open a blog at one of the tech collectives, or let a trusted collective operate your website, if you really need a custom one. Noblogs.org provides an easy way to get one. Wrapping it Up ============== @@ -420,4 +487,4 @@ TL;DR: Example Setups -------------- * **Laptop / Desktop:** Tails for serious anonymity, encrypted Linux Mint with TOR Browser, Thunderbird+Enigmail for encrypted email, Veracrypt to encrypt external media, Gaijim for Jabber with OMEMO encryption, Signal Desktop if needed. -* **Smartphone:** Lineage OS on a supported Android smartphone with data encryption, Orbot for TOR, Conversations for Jabber with OMEMO if necessary and Signal as a messenger app. +* **Smartphone:** Lineage OS on a supported Android smartphone not older than 2 years with data encryption, Orbot for TOR, Conversations for Jabber with OMEMO if necessary and Signal as a messenger app.