A Guide to a Secure Life Online

For better or for worse, software is eating the world. As our lives and secrets are being transferred from our minds onto digital media with increasing frequency, we become more vulnerable to pirates, terrorist organizations, governments, and other malicious parties. Encryption matters, and it is not just for spies and philanderers.

This article outlines a few ways you can act today to protect your privacy, your digital life, and your freedom.

Use HTTPS Everywhere

The HTTPS protocol provides bidirectional encryption between your server and your users. This protects your users against man-in-the-middle attacks, and stops other people from eavesdropping on the content your users consume. Buying SSL certificates used to be costly, and even cost-prohibitive in some cases. If you follow Hintjens' Law, it was inevitable and predictable that this would change.

“The cost of any technology falls to zero by 50% every 18 months, always has, always will, and this drives history.” — Pieter Hintjens

There is currently no reason not to use HTTP over TLS/SSL. You can start using HTTPS for free using a couple of services — CloudFlare and Let's Encrypt — but Hintjens' Law asserts that the cost will only be driven down further, meaning more services will also offer certificates for free. There is also this bonus: Google awards a better Page Rank to websites served over HTTPS.

Use A Secure Browser

Ad-blocker browser extensions have turned the advertising industry on its head. No longer are we bombarded with flashing images urging us to install the latest cartoony platform scrolling game for the smartphone of your choice. No longer must we wait 30 seconds before watching a cat video on YouTube.

Much like the Firebug browser extension changed the game of web development and subsequently inspired native implementations of element inspectors and development consoles, it was inevitable that browser vendors would natively integrate privacy tools. We've seen that with ‘Incognito Mode’, but Brendan Eich — creator of the JavaScript programming language — is running the extra mile by creating a new web browser called Brave, which is entirely based around the virtues of privacy, safety, and speed.

It's still relatively early days for Brave, and is still in beta testing. That said, it is multi-platform and completely open source so anyone is free to validate at any time that the browser contains no malicious code. Brave promises significantly improved page load times as it strips away most ads and tracking scripts. Brave also allows users to pay publishers directly, so they can maintain their service without relying on "the advertising machine."

If you need to go one step further, you can browse the internet anonymously using The Onion Router, or simply Tor. This software creates a network of relay nodes across the Internet. When you visit a website through Tor, the data passing between your machine and the server you're making requests to is bounced around between the relay nodes which effectively masks your origin. A downside to this approach is that because your data visits a number of intermediary relay nodes, websites will load less quickly.

Sign And Encrypt Your Email

When Edward Snowden — initially known only by the handle Cincinnatus — first wrote to lawyer/journalist/author Glen Greenwald in 2012, he insisted their communication be encrypted with PGP (Pretty Good Privacy) so that government intelligence organizations such as the NSA could not intercept their messages. Cincinnatus revealed that the NSA has the capacity to crack passwords at one billion guesses per second. Although PGP was devised in 1991, its cryptographic strength ensures it would take even the NSA many years to crack a code.

Your personal email is unlikely to be as decadent as that of Cincinnatus’, but the adage “If you have nothing to hide, you have nothing to fear” does not ring true for most people. All humans have something to hide; all humans have a fundamental right to privacy. In fact, the right to privacy is part of the constitution for 150 different nations. Ironically, the US happens to be one of them and we now know that the US have been spying on its citizens since at least 2001.

If you're not already securing your email, it's never to soon to start. If you are more technically inclined and want to get your hands dirty, the article PGP and You by Caleb Thompson is an excellent primer on GPG (GNU Privacy Guard, an implementation of the OpenPGP standard). Most email clients support secure email, even old terminal-based clients like Mutt. Wikipedia maintains a table of email clients so you can compare their features.

If you would rather choose a solution that just works out of the box, there are businesses springing up around this problem. One of the most recent and most interesting is ProtonMail, which hosts your data in Switzerland — a country famous for strict privacy laws and political neutrality since time immemorial.

Host Your Own Email

The Web is a peculiar state of affairs. What once was decentralized and resilient with no obvious points of control is now largely a series of monopolies. We have one search engine. We have one social network. We have one online store. Maciej Cegłowski covers this topic thoroughly and eloquently in his talk "The Internet With A Human Face".

If you use an ad-blocker, then you hold an opinion on whether or not private corporations should be taking record of where you are, what you're reading about, and the contents of your personal email. This places your values fundamentally at odds with those of Google — the world's largest advertising company — who's business model relies on scanning the contents of your email messages to work out how best to sell advertising.

Depending on at what lengths you're willing to go to isolate your concerns from those of a private corporation, it may be worth hosting your own email server. It's more hands-on than simply signing up with a service provider, but you needn't start from scratch. There are turnkey systems available such as iRedMail. It's free and open source, so you can fire up a VPS, install the mail server, configure the DNS, and you're done.

Use An Email Alias Service

If you sign up for a service, what's to stop that service from selling your email address to a malicious organization? Or how about some spam farm? What happens if the service is hacked? What if associating your name with a particular service is potentially damaging, e.g., the love affair dating site Ashley Madison? It's often a good idea to share an alias instead of your own email address with a service you don't trust.

There are many email alias services available. The one I use is 33mail. When I joined a gym recently, instead of giving them my normal email address, I gave them <gymname>@<mysubdomain>.33mail.com. I usually use the name of the company or service as the first part of the email address so that if I start receiving spam from somewhere else, I'll know which company divulged my information. When the gym started spamming me, I simply disabled the alias.

Sign Your Git Commits

Although Git is cryptographically secure, it's not foolproof. When collaborating with other developers over a network, e.g., the Internet, it may be worthwhile to sign and verify Git commits with PGP. This would prevent a malicious third party from running a sort of man-in-the-middle attack on your codebase.

Signing Git commits is a straightforward process. First you configure Git to use your GPG key, and then you add the -S flag when committing to tell Git to sign the commit.

When you want to see and verify signatures, you can use the --show-signature flag with the git log command.

# Configure Git for signing
git config --global user.signingkey 0A65239B

# Sign individual commit
git commit -S

# Verify signatures
git log --show-signature

You can read more about signing and verifying Git commits in the official documentation.

Encrypt Sensitive Data In Git Repositories With Git-crypt

Sharing secrets in an organization is not a difficult problem because of the technology involved, but because conventions around secure communication are prone to human-error. If you want to store business secrets digitally, there must be some foolproof workflow in place to protect against simple mistakes.

Git-crypt is a tool for automatically encrypting and decrypting sensitive files as part of a typical Git workflow. Files which you choose to protect are encrypted when committed, and decrypted when checked out. For a typical development team, this would be an easy way to only allow a select few developers to deploy a system into production, for example. Alternatively, you might run a technical blog and you would want to encrypt all of your draft articles before they're ready for publishing.

Be warned though - although Git-crypt will protect the contents of a sensitive file, it does not encrypt commit messages.

If nothing else, you could use Git-crypt to effectively allow you to publish private repositories on GitHub, which normally is only allowed by premium accounts. However, the author of Git-crypt advises that the tool is not designed to do this, and you may be better off using something like git-remote-gcrypt instead.

Use A Password Manager

A couple of the more notorious and nefarious security breaches in the past five years have been enabled by the fact that almost everyone uses the same password for every service they use. If you sign up for a service that is either insecure or run by a malicious party, and you use the same login credentials for your email inbox, consider both of those accounts compromised.

The solution then is to use a unique password for every service you use, but if you sign up for a couple hundred services, then you somehow need to remember a couple hundred strong passwords. A password manager mitigates this problem by generating strong passwords for you and remembering which password is associated with which service. All you need to remember is one master password.

There are a few vendors for this type of product. If you'd like a ready-made solution where it all works out of the box, you can go with 1password. They provide smart phone apps too, so you can sign in to services on the go. If you'd rather a more hands-on approach, there is a Unix password manager called simply Pass. It uses GPG for encryption, and changes to passwords can be stored in Git.

Thoughts

It's easy to chalk the privacy tips outlined above up to paranoia and over-cautiousness, but as the roots of internet connectivity grow deeper into our lives and social infrastructure: spying, identity theft, financial theft, and other forms of malice will only become more frequent.

The best offense against the malicious parties online is a good defense, and encryption is our shield. Tell your friends.

Header image courtesy of Henri Bergius