Going dark: online privacy and anonymity for normal people

I have found that normal people are those that care most about it, once they experience that the social contract that governs private space has being violated.

How many people become victims to identity theft per year? How many people end up in a bad breakup where their ex uses private information in some action of revenge? How many people get falsely accused each year by the police?

Ask them if they care about privacy and anonymity, or as it is more commonly phrased, personal security.

I appreciate the intention of this article. Written for people only starting to change their surfing habits in light of Snowden. But the example of the tools they should use are not thought out very well.

First: Freedome by F-Secure is closed source and there is no OpenVPN alternative. Always choose a VPN that has OpenVPN so that users can configure the connection to their needs. No need for this bloated mess.

Second: Whilst disposable Google accounts might seem like a good idea, there are any number of ways for Google to cross-correlate a disposable identity with your actual identity using fingerprinting captchas or even your screen resolution. Google does this to spot serial re-registrations and to stop people gaming Google Plus voting rings and spammers in general.

Third: Be careful of online websites offering fake-name services. Most of this data is generated server-side and logged for the purposes of cross-correlation with your IP address and useragent string. Quite possibly the vast majority of fake-identity sites are run by LEA

- I like to write some quick and dirty ruby gems to generate fake identities because then it can't be correlated. (The names are pulled in from disparate sources and I always ensure true-randomness).

- In terms of email, use things like Riseup which use TLS at every hop so that passive dragnets cant sniff the password. 99% of all IMAP and SMTP services can be passively sniffed because they use weak STARTTLS.

- Use 'honeywords' in an email to correlate different emails with different activities. For example:

    john.doe+shopping@riseup.net
    john.doe+gaming@riseup.net
    john.doe+correspondant@riseup.net

This way you can whitelist those addresses for the purposes of filtering out spam and phishing attempts.

People's browsing histories are regularly used in court....

I do a lecture at local hackerspaces about basic security for the common person and anonymity is far down on the list.

Much higher on the list are basic protection from dangers on the internet, like browser based exploits. So Noscript is one major selling point for Firefox due to most browser based exploits using Javascript. Even if you whitelist all the sites you're still more secure with noscript than without simply because it blacklists the unknown sites you don't know about, the ones that e-mail links open or pop-ups force your browser to load through various tricks.

The SMS receiving sites don't work so well IME. They tend to use a single number for everyone, and the demand by spammers etc is so much higher than the free supply that for any given service, your number will probably already be blocked. Or the receiving will be unreliable, etc. I've gotten it to work sometimes, but usually not. Definitely too hard and time consuming for "normal people".

Is there a site that sells phone numbers for viop and sms for bitcoin without requiring identity?