learn.equalit.ie - User contributions [en]

Signal

2015-12-03T15:45:26Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=An iOS and Android app and Chrome extension that offers end-to-end encryption for text, pictures and video messages, as well as encrypted phone conversations.

Website: https://whispersystems.org/

OS: iOS, Android; Linux, Windows, Mac (testing version)

Requirements: none for mobile; Chrome and a Google account for Linux, Windows and Mac

UI language: 31 languages

License: GNU General Public License
}}

I want to know about options for private chat

2015-12-03T15:41:48Z

Floriana: added Signal desktop version

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Online Conversations
|Scenario Task Type=Surveillance
|Scenario Tools and Services=Pidgin Adium, Jitsi, Cryptocat, Mega, Peerio, Telegram, Signal
|Scenario Task Description=If you want to have a private chat conversation with someone, you need to make sure that no one else but you and the person/s you are chatting with can read your messages (confidentiality), that the person/s you are chatting with are really who they say they are (authenticity) and that what you and the other people in the chat are writing is not tampered with by third parties (integrity).

In order to obtain all this, you need to use a tool offering end-to-end encryption and key verification. As most service providers (e.g. Google, Microsoft, Yahoo, Facebook) don't offer this service and can therefore read your chat record, it is a good idea to either switch to an alternative chat service that provides encryption by default, or to use software for encryption if you need to stick to those services. Take a look at the EFF's [https://www.eff.org/secure-messaging-scorecard Secure Messaging Scorecard] to see how they rate various chat clients that claim security properties.
 
The standard for a secure two-party conversation is called [https://en.wikipedia.org/wiki/Off-the-Record_Messaging OTR - Off the record messaging], and several popular chat clients support it, including Pidgin with OTR for [https://securityinabox.org/en/guide/pidgin/windows Windows] and [https://ssd.eff.org/en/module/how-use-otr-linux Linux], [https://ssd.eff.org/en/module/how-use-otr-mac Adium] for Mac, and [https://securityinabox.org/en/guide/jitsi/windows Jitsi] for all common desktop operating systems. The latter also includes secure audio and video conferencing. These clients can work with your existing accounts on Google, Facebook, Yahoo, etc. and encrypt the conversation over their respective networks.
 
Several chat clients are available as an add-on to your web browser, including [https://crypto.cat Cryptocat], [https://mega.nz Mega] and [https://whispersystems.org/blog/signal-desktop/ Signal]. Aside from that, several free messaging services offer similar encryption properties for messaging including [https://peerio.com/ Peerio] and [https://telegram.org/ Telegram]. All of the mentioned tools are available as open source software and publicly disclose the encryption methods they employ in their software.
 
If you are interested in creating a secure and an anonymous conversation, please refer to [[I'd like to have an anonymous conversation]]
}}

Signal

2015-12-03T15:39:03Z

Floriana: added desktop version

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=An iOS and Android app and Chrome extension that offers end-to-end encryption for text, pictures and video messages, as well as encrypted phone conversations.

Website: https://whispersystems.org/

OS: iOS, Android; Linux, Windows, Mac (testing version)

Requirements: none for mobile; Chrome for Linux, Windows and Mac

UI language: 31 languages

License: GNU General Public License
}}

Thread:Talk:Find a reliable hosting provider/Proposal for other providers

2015-12-02T16:33:48Z

Floriana: New thread: Proposal for other providers

Greenhost and https://tachanka.org/ are also worth mentioning.

Talk:Find a reliable hosting provider

2015-12-02T16:33:48Z

Floriana: Talk page autocreated when first thread was posted

Find a reliable hosting provider

2015-12-02T16:30:36Z

Floriana:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=My Website
|Scenario Task Type=Unauthorised Access, Surveillance, Censorship
|Scenario Tools and Services=A/I
|Scenario Task Description=If you are setting up your own website for the first time, or want to find a more secure solution for the website you already have, you will have to look into the complicated market of hosting providers, where making the right choice can be hard. To understand what you need to look for, consider the following points:

* Larger companies will be more reliant on existing control panels and automated processes to solve your problems and less willing to go out of their way specifically for you. On the other hand, their infrastructure could be better suited to mitigate [https://en.wikipedia.org/wiki/Denial-of-service_attack an attack]
* Research company reviews from past customers
* Read the terms of service, in particular their mitigation options during an attack
* Look for details on their data centre location, internal systems security, client privacy, customer support agreements

In any case, keep your own backup of the site and make sure you are in control of the [https://en.wikipedia.org/wiki/Domain_Name_System DNS records] so as to switch providers when necessary. A more [https://learn.equalit.ie/wiki/Choose_a_hosting_provider detailed guide] is available for those considering their hosting options.

'''Commercial Hosting'''
* [https://aws.amazon.com/ec2/ Amazon EC2] - huge amount of features and resources, a bit overwhelming for non-technical users at first
* [https://www.dreamhost.com/ Dreamhost] - Many hosting options with a control panel, DNS registration included
* [http://wpengine.com/ WpEngine] - popular option for Wordpress site hosting

'''Non-commercial Hosting'''
* [http://www.autistici.org/ Autistici/Inventati, or A/I] - free hosting for activists on servers run by people who care about users' privacy and security
* [https://help.riseup.net/ca/security/resources/radical-servers A list of non-profit] hosting and Internet service providers, catering to activist causes

 
}}

Talk:RiseUp email

2015-12-02T16:12:01Z

Floriana: Talk page autocreated when first thread was posted

Thread:Talk:RiseUp email/process for getting an account

2015-12-02T16:12:00Z

Floriana: New thread: process for getting an account

I would add some explanations on what is needed to get a Riseup mail account.

Talk:To find a reliable email provider

2015-12-02T16:11:00Z

Floriana: Talk page autocreated when first thread was posted

Thread:Talk:To find a reliable email provider/Autistici

2015-12-02T16:11:00Z

Floriana: New thread: Autistici

I would add Autistici/Inventati to the list.

2 factor authentication

2015-12-02T16:00:45Z

Floriana:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to protect my email account from unauthorised access
|Scenario Task Type=Unauthorised Access
|Scenario Task Description=[https://en.wikipedia.org/wiki/Two-factor_authentication 2-factor authentication] also known as 2-step and 2fa is a method of authenticating yourself with a combination of two components: something you know (a password) and something you have (e.g. a mobile phone). The idea behind this method is that it's incredibly difficult for the hacker to have access to both components. The service must be offered by your email provider and many of them do now. Please have a look at this excellent report by Citizen Lab on [https://citizenlab.org/2015/08/iran_two_factor_phishing/ 2fa phishing attacks], in particular the conclusions and recommendations within.

*[https://www.google.ca/landing/2step/ Google 2-step verification] and the [https://support.google.com/accounts/answer/1066447?hl=en Authenticator] application for your smartphone that allows you to generate codes without Internet access
*[http://windows.microsoft.com/en-ca/windows/two-step-verification-faq Hotmail 2-step verification]
*[https://help.yahoo.com/kb/SLN5013.html Yahoo 2-step verification]
*[https://www.facebook.com/help/148233965247823 Facebook Login Approval]
*[https://support.twitter.com/articles/20170388# Twitter Login Verification]
 
[https://help.yahoo.com/kb/SLN5013.html Here's a list] of other popular online services that provide 2fa.

 
}}

Recuva

2015-12-02T15:44:24Z

Floriana: added Recuva

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A tool to recover deleted files on Windows.

Website: https://www.piriform.com/recuva

OS: Windows

Requirements: none

UI language: 38 languages

License: proprietary software
}}

I want to recover data

2015-12-02T15:40:01Z

Floriana: added one tool, removed another

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Data
|Scenario Task Type=Data Loss
|Scenario Tools and Services=Recuva
|Scenario Task Description=Information previously deleted from your computer or removable memory card can [https://securityinabox.org/en/guide/recuva/windows sometimes be recovered].

If your computer is broken and the operating system refuses to load, it may still be possible to recover data from the hard drive by booting it from a [http://www.ubuntu.com/download/desktop/create-a-usb-stick-on-windows live operating system]
}}

I want to prevent unauthorised access to my data

2015-12-02T15:38:20Z

Floriana:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Data
|Scenario Task Type=Unauthorised Access
|Scenario Tools and Services=Veracrypt, LibreCrypt, DiskCryptor, Symantec Endpoint, Truecrypt, Peerio, Mega, GPG4USB
|Scenario Task Description=If you want to avoid that your documents are accessed by someone without your permission, you need to either encrypt them one by one (file encryption) or to store them in a secure space, which may be your computer, a storage device or just a part of them (disk encryption).

In order to create a secure space on your hard disk or storage device or encrypt the entire computer, you can use several tools:

* [https://securityinabox.org/en/guide/truecrypt/windows Truecrypt] can encrypt your entire hard disk or just a part of it, but is no longer actively maintained.
* Truecrypt is being replaced by [https://www.idrix.fr/Root/content/category/7/32/46/ Veracrypt], which has been developed starting from Truecrypt's code, but this project is very recent and doesn't have a very large user base.
* [https://ssd.eff.org/en/module/how-encrypt-your-windows-device DiskCryptor] and [https://github.com/t-d-k/LibreCrypt LibreCrypt] are two other free and open source tools for disk encryption that are gaining prominence as replacements of Truecrypt.
* [https://en.wikipedia.org/wiki/BitLocker BitLocker] is a Windows solution (Vista and 7 Ultimate+ editions and Windows 8+) with several options for full disk or folder encryption.
* Another popular commercial disk encryption tool is [https://www.symantec.com/endpoint-encryption/ Symantec Endpoint Encryption].
* Mac users can encrypt their disk using the built-in [https://support.apple.com/en-ca/HT204837 FileVault] feature.

You can also use an encrypted file storage service like [https://peerio.com Peerio] or [https://mega.nz Mega] as explained in the [[I want to ensure that my data is never lost]] section. Individual files can be protected with [https://securityinabox.org/en/guide/gpg4usb/windows GPG4USB].
}}

I want to protect my computer from virus infection

2015-12-02T15:31:01Z

Floriana: added tool

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Computer
|Scenario Task Type=Unauthorised Access
|Scenario Tools and Services=Tails OS, Qubes OS, NoScript, ScriptBlock, FlashBlock, FlashControl, Comodo, Avast
|Scenario Task Description=Like its biological predecessor, a computer virus can be caught in a lot of different circumstances. It may be impossible to prevent your computer from exposure but a series of defensive mechanisms should be able to stop the infection. They include:

* Automatic updates installation for the operating system (Windows, Mac, etc) and all software
* A registered and functioning [https://securityinabox.org/en/guide/avast/windows anti-virus]
* Use either the native [https://support.apple.com/en-us/HT201642 Mac] or [http://windows.microsoft.com/en-us/windows-8/windows-firewall-from-start-to-finish Windows] firewall or a third-party [https://securityinabox.org/en/guide/comodo/windows firewall] on your computer
* Use the [https://securityinabox.org/en/guide/firefox/windows NoScript] and [https://addons.mozilla.org/en-us/firefox/addon/flashblock/ FlashBlock] extensions for Firefox or [https://chrome.google.com/webstore/detail/flashcontrol/mfidmkgnfgnkihnjeklbekckimkipmoe?hl=en FlashControl] and [https://chrome.google.com/webstore/detail/scriptblock/hcdjknjpbnhdoabbngpmfekaecnpajba?hl=en ScriptBlock] for Chrome
* Switch to [https://en.wikipedia.org/wiki/Linux_distribution#Popular_distributions Linux] or use the security-oriented [https://tails.boum.org/ Tails] or [https://www.qubes-os.org/ QubesOS] operating systems

Furthermore, detailed guides are available in the [https://ssd.eff.org/en/module/how-do-i-protect-myself-against-malware Surveillance Self Defense] project and the [https://securityinabox.org/en/guide/malware Security in-a-box] toolkit.
}}

I would like to connect to a website securely

2015-12-02T15:29:30Z

Floriana: added tool

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Access to the Web
|Scenario Task Type=Surveillance, Profiling your identity and actions
|Scenario Tools and Services=HTTPS Everywhere, Avast
|Scenario Task Description=Connecting to a website securely means several things, all of which contribute to secure your access to the websites you visit:

* the connection between your computer and the website's server is [https://learn.equalit.ie/wiki/Encrypted_connections '''encrypted'''];
* there are '''no [https://trackography.org/ leaks of information]''' about the current session to third parties;
* you do not expose yourself to '''[https://support.google.com/websearch/answer/8091?hl=en malware infection]''' by visiting a compromised website.

Read the [https://help.riseup.net/en/better-web-browsing Better Browsing] guide by RiseUp for details on how to browse with greater security in Firefox or Chrome (in general, these are the recommended browsers when discussing security).
 

The [https://www.eff.org/HTTPS-EVERYWHERE HTTPS Everywhere] browser add-on by the Electronic Frontier Foundation ensures that you connect securely and with trusted credentials to thousands of websites.
 

In all cases, make sure that your computer's operating system is up-to-date, that you are using the latest version of your browser and that you are running [https://securityinabox.org/en/guide/avast/windows anti-malware] protection. Install the recommended extensions from the RiseUp guide and review the [https://ssd.eff.org/en/module/how-do-i-protect-myself-against-malware How Do I Protect Myself Against Malware?] guide from the EFF.
 

You may also wish to use an anonymity network or a VPN to reach the desired website as explained in the [[I want to be anonymous when browsing the web]] section.
 
}}

Peerio

2015-12-02T14:12:08Z

Floriana: added link to brand new Linux standalone sw

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=An end-to-end encryption tool to share private messages and files and access them from any computer.

Website: https://peerio.com https://linux.peerio.com/

OS: Windows, Mac, Linux

Requirements: Chrome (none for Linux)

UI language: 12 languages

License: GNU General Public License
}}

Panicbutton

2015-12-02T14:02:09Z

Floriana: added Panicbutton

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=An app that turns an activist's mobile phone into a secret alarm that can help them get help in an emergency.

Website: https://panicbutton.io

OS: Android

Requirements: none

UI language: English, French, Spanish, Portuguese

License: GNU General Public License
}}

BittorrentSync

2015-12-02T13:47:57Z

Floriana: added BittorrentSync

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A multiplatform tool to sync files between devices either on a local network or over the Internet via a modified version of the BitTorrent protocol.

Website: http://help.getsync.com/

OS: Windows, Mac, Linux, iOS, Android, FreeBSD, Windows Phone, Kindle Fire

Requirements: none

UI language: 14 languages

License: proprietary software
}}

Useful apps for my phone

2015-12-02T12:02:06Z

Floriana: added tools

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Phone
|Scenario Tools and Services=BittorrentSync, Panicbutton
|Scenario Task Description=* Any app from the [https://guardianproject.info Guardian Project] is recommended for Android users
* [https://www.getsync.com/platforms/mobile BittorrentSync] allows for secure file or folder synchronisation
* The [https://panicbutton.io/ Panicbutton] app will send out a number of SMS messages and your GPS location to pre-configured contacts

 
}}

SMSSecure

2015-12-02T12:00:47Z

Floriana: added SMSSecure

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=An Android app to send and receive encrypted SMS messages.

Website: https://smssecure.org/

OS: Android

Requirements: none

UI language: 38 languages (8 complete)

License: GNU General Public License
}}

I want to send a secure SMS (text message)

2015-12-02T11:55:15Z

Floriana: added tool

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to send & receive secure messages from my phone
|Scenario Task Type=Surveillance
|Scenario Tools and Services=SMSSecure
|Scenario Task Description=There really are not many options for sending private SMS/MMS without a data plan or access to the Internet from your smartphone. Android users have [http://smssecure.org/ SMSSecure] which was a fork of the original TextSecure application after they decided to [https://whispersystems.org/blog/goodbye-encrypted-sms/ remove support for SMS/MMS]. There are no known iPhone applications for end-to-end SMS encryption.
}}

SureSpot

2015-12-02T11:54:18Z

Floriana: added SureSpot

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A mobile messaging app that uses end-to-end encryption for text, image and voice messages.

Website: https://www.surespot.me/

OS: iOS, Android

Requirements: none

UI language: English, French, German, Italian, Spanish

License: GNU General Public License
}}

I want to send & receive secure messages from my phone

2015-12-02T11:50:00Z

Floriana: added tools

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to communicate securely
|Scenario Task Type=Surveillance, Profiling your identity and actions
|Scenario Tools and Services=Signal, Telegram, SureSpot, SilentPhone, Bleep
|Scenario Task Description=Messaging is the most popular method for communicating on smartphones today. [https://www.whatsapp.com/ WhatsApp], [https://www.snapchat.com/ SnapChat], [https://slack.com/ Slack], just to name a few, and of course the behemoths that are [https://www.facebook.com/mobile/messenger Facebook messenger] and [http://www.google.com/+/learnmore/hangouts/ Google Hangouts] all offer messaging services. It's interesting to note that they are all working in silos - your friends and contacts need to use the same provider as there is no inter-service communication. In general, they are not considered private since the provider has access to your messages.

Messaging apps that perform [https://en.wikipedia.org/wiki/End-to-end_encryption end-to-end encryption] and publish their methods and source code in the public domain are considered here as private messaging tools. You can see a review of multiple apps on the [https://www.eff.org/secure-messaging-scorecard EFF's secure messaging scorecard].

*Signal for [https://ssd.eff.org/en/module/how-use-signal-android Android] and [https://ssd.eff.org/en/module/how-use-signal-ios iPhone] from [https://whispersystems.org/ WhisperSystem]
*[https://telegram.org Telegram] for all smartphone and desktop platforms
*[https://www.surespot.me SureSpot] for Android and iPhone
*[https://www.silentcircle.com/products-and-solutions/software/ SilentPhone], a commercial solution from Silent Circle
*[http://www.bleep.pm/ Bleep], an encrypted peer-to-peer chat infrastructure using BitTorrent

 
}}

SilentPhone

2015-12-01T17:42:08Z

Floriana: added SilentPhone

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A mobile app that offers end-to-end encryption for text and pictures, as well as video chat and conference calling.

Website: https://www.silentcircle.com/products-and-solutions/software/

OS: iOS, Android, Silent OS

Requirements: none

UI language: 11 languages

License: encryption software: free and open software; the rest of the source code is available, but under proprietary software licences
}}

Firechat

2015-12-01T15:57:08Z

Floriana: added Firechat

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A mobile app for iOS and Android to chat with other people in close vicinity even when no Internet connection or cellular networks are available.

Website: https://opengarden.com/about-firechat

OS: iOS, Android

Requirements: none

UI language: 11 languages

License: proprietary software
}}

I want to have a private phone conversation

2015-12-01T15:50:25Z

Floriana: added tools

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to communicate securely
|Scenario Task Type=Surveillance
|Scenario Tools and Services=Linphone, Signal, Bleep, SilentPhone
|Scenario Task Description=There is not much choice for having a private (encrypted) conversation using the cellular network. The [http://www.cryptophone.de/ CryptoPhone] might be one of the few commercially available solutions, but both parties will need to have one for secure calls.

Android and iPhone users can rely on various tools that use a secure Voice over IP protocol or a VPN approach to encrypting your calls. You will need a steady data (Internet) connection and the same application for all conversing parties. Note that by "private" we mean conversations which are not accessible to anyone but the conversing parties.

Android:
* [https://www.linphone.org/ LinPhone]
* [https://ostel.co Ostel], using the CSIP simple client - ''no updates since November 2014''

 

Multi-platform
* Signal for [https://ssd.eff.org/en/module/how-use-signal-%E2%80%93-private-messenger iPhone] and [https://ssd.eff.org/en/module/how-use-signal-android Android]
*[http://www.bleep.pm Bleep] messenger enables encrypted calls over the peer-to-peer Bittorrent protocol
*[https://www.silentcircle.com/products-and-solutions/software/ SilentPhone] commercial solution from SilentCircle

 
}}

I want to communicate securely

2015-12-01T15:38:40Z

Floriana: added tool

{{Scenario Task
|Scenario Task Format=Scenario
|Scenario Task Parent=Phone
|Scenario Task Type=Surveillance, Profiling your identity and actions
|Scenario Tools and Services=Firechat
|Scenario Task Description=There are two primary channels for communicating with others from your smartphone - using the [https://en.wikipedia.org/wiki/Cellular_network mobile network] (GSM, CDMA, etc) for voice and SMS messages, or using a data connection (e.g. to the Internet) over the cellular network. Different solutions for secure communications exist for each of the two channels, and each scenario below assumes both circumstances.

Generally speaking, privacy advocates and security researchers [https://ssd.eff.org/en/module/problem-mobile-phones do not recommend] using mobile phones or smartphones for (very) secure communication.

There is a third way, however, to communicate 'off the grid' for smartphone users. [http://opengarden.com/ Firechat] uses the phone's wifi or bluetooth device to establish conversations with other users in the geographic vicinity. You do not need to connect to the cellular or data network. Messages between users in these temporal messaging rooms are, however, not encrypted.
}}

Comodo

2015-12-01T15:32:45Z

Floriana: added Comodo

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A firewall that protects your computer from unauthorised connections.

Website: https://personalfirewall.comodo.com

OS: Windows

Requirements: Administrator rights required for installation

UI language: 17 languages

License: proprietary software
}}

I want to protect my computer from virus infection

2015-12-01T15:27:01Z

Floriana: added tool

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Computer
|Scenario Task Type=Unauthorised Access
|Scenario Tools and Services=Tails OS, Qubes OS, NoScript, ScriptBlock, FlashBlock, FlashControl, Comodo
|Scenario Task Description=Like its biological predecessor, a computer virus can be caught in a lot of different circumstances. It may be impossible to prevent your computer from exposure but a series of defensive mechanisms should be able to stop the infection. They include:

* Automatic updates installation for the operating system (Windows, Mac, etc) and all software
* A registered and functioning [https://securityinabox.org/en/guide/avast/windows anti-virus]
* Use either the native [https://support.apple.com/en-us/HT201642 Mac] or [http://windows.microsoft.com/en-us/windows-8/windows-firewall-from-start-to-finish Windows] firewall or a third-party [https://securityinabox.org/en/guide/comodo/windows firewall] on your computer
* Use the [https://securityinabox.org/en/guide/firefox/windows NoScript] and [https://addons.mozilla.org/en-us/firefox/addon/flashblock/ FlashBlock] extensions for Firefox or [https://chrome.google.com/webstore/detail/flashcontrol/mfidmkgnfgnkihnjeklbekckimkipmoe?hl=en FlashControl] and [https://chrome.google.com/webstore/detail/scriptblock/hcdjknjpbnhdoabbngpmfekaecnpajba?hl=en ScriptBlock] for Chrome
* Switch to [https://en.wikipedia.org/wiki/Linux_distribution#Popular_distributions Linux] or use the security-oriented [https://tails.boum.org/ Tails] or [https://www.qubes-os.org/ QubesOS] operating systems

Furthermore, detailed guides are available in the [https://ssd.eff.org/en/module/how-do-i-protect-myself-against-malware Surveillance Self Defense] project and the [https://securityinabox.org/en/guide/malware Security in-a-box] toolkit.
}}

Tor Browser

2015-11-27T17:18:53Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=Tool for browsing the Internet anonymously. Also includes hidden services and Tor bridges.

Website: https://www.torproject.org

OS: Windows, MacOS, Linux

Requirements: none

UI language: 15

License: free and open source software
}}

Ricochet IM

2015-11-27T17:03:11Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=Chat client operating over Tor Hidden Services.

Website: https://ricochet.im

OS: Windows, MacOS, Linux

Requirements: none

UI language: 16 languages

License: free and open source software
}}

Pidgin Adium

2015-11-27T16:59:52Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=Pidgin - Chat client supporting all popular social media accounts and end-to-end encryption with OTR

Adium - its equivalent for MacOS

Website: http://pidgin.im - https://adium.im/

OS: Windows, Linux - MacOS

Requirements: OTR for Pidgin - none for Adium

UI language: 83 languages

License: GNU General Public License
}}

Nmap

2015-11-27T16:57:46Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A scanner to analyse computer systems that is used for vulnerability tests.

Website: https://nmap.org

OS: Linux, Windows, Mac

Requirements: Administrator privileges are required

UI language: 16 languages

License: free and open source software
}}

Mailvelope

2015-11-27T16:56:18Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A browser add-on for using public key encryption with your webmail. It uses the OpenPGP standard for encrypting and signing email messages. It operates as an overlay to your Gmail Yahoo or any other web accessible email client.

Website: https://www.mailvelope.com/

OS: Windows, MacOS, Linux

Requirements: Firefox, Chrome

UI language: English, Chinese

License: GNU Affero General Public License
}}

Mailpile

2015-11-27T16:55:43Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=Email client. Operates with existing accounts. Acts like a proxy on your computer to encrypt messages to the recipient.

Website: https://www.mailpile.is/

OS: Windows, MacOS, Linux

Requirements: Web browser

UI language: 4 languages

License: Affero General Public License
}}

Linphone

2015-11-27T16:54:59Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A tool for secure, encrypted voice, video and text communication.

Website: http://www.linphone.org/

OS: Windows, Linux, Mac, iOS, Android, Blackberry, Windows Phone

Requirements: none

UI language: 6 languages

License: GNU General Public License
}}

HTTPS Everywhere

2015-11-27T16:50:52Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A browser plugin for Chrome and Firefox that automatically establishes a verified encrypted connection to many [https://www.eff.org/https-everywhere/atlas/ major and important websites].

Website: https://www.eff.org/Https-everywhere

OS: Windows, Mac, Linux, Android

Requirements: Firefox, Chrome or Opera

UI language: 17 languages

License: GNU General Public License
}}

GPG4USB

2015-11-27T16:49:55Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A portable tool for encrypting email messages and files in a USB stick.

Website: http://www.gpg4usb.org/

OS: Windows, Linux

Requirements: none

UI language: 13

License: GNU General Public License
}}

FlashBlock

2015-11-27T16:49:02Z

Floriana:

{{Scenario Tool
|Scenario Tool Type=Tool
|Scenario Tool Description=A browser extension that blocks all Flash content from loading.

Website: http://flashblock.mozdev.org

OS: Windows, Mac, Linux

Requirements: Firefox, Netscape

UI language: 34 languages

License: MPL 1.1/GPL 2.0/LGPL 2.1
}}

Thread:Talk:DigsecResources/replacing the link to the whole gender&tech resources

2015-11-27T16:44:01Z

Floriana: New thread: replacing the link to the whole gender&tech resources

I'd replace the link to the general Gender&Tech wiki with a link to the digital security manual: https://gendersec.tacticaltech.org/wiki/index.php/Complete_manual -- This is because the wiki is not very easy to navigate and the manual is difficult to find from the home page.

Talk:DigsecResources

2015-11-27T16:44:01Z

Floriana: Talk page autocreated when first thread was posted

Protect files and messages on my phone

2015-11-27T16:38:22Z

Floriana: added threat

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Phone
|Scenario Task Type=Unauthorised Access
|Scenario Tools and Services=Signal
|Scenario Task Description=Both the Android and Apple smartphones offer full handset (disk) encryption, which ensures all files and messages on your handset cannot be accessed without knowing the handset's password. On the Android phone this needs to be [http://www.howtogeek.com/141953/how-to-encrypt-your-android-phone-and-why-you-might-want-to/ enabled manually] and on the iPhone you are simply required to set up [https://support.apple.com/en-us/HT202064 a security Passcode] to enable disk encryption automatically.

If you forget the phone's password, you will need to ''restore the phone'' back to its original setting. Your phone would need to be synced with your Google or iTunes account so as not to lose any data. On the other hand, syncing your phone with these providers means that there is a duplicate of all your data in the cloud.

If you just want to encrypt your messages on the phone, you can use Signal on [https://ssd.eff.org/en/module/how-use-signal-android Android] and [https://ssd.eff.org/en/module/how-use-signal-ios iPhone].
}}

I want to send a secure SMS (text message)

2015-11-27T16:37:43Z

Floriana: added threat

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to send & receive secure messages from my phone
|Scenario Task Type=Surveillance
|Scenario Task Description=There really are not many options for sending private SMS/MMS without a data plan or access to the Internet from your smartphone. Android users have [http://smssecure.org/ SMSSecure] which was a fork of the original TextSecure application after they decided to [https://whispersystems.org/blog/goodbye-encrypted-sms/ remove support for SMS/MMS]. There are no known iPhone applications for end-to-end SMS encryption.
}}

How to protect your phone from virus infection

2015-11-27T16:35:01Z

Floriana: added threat

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Phone
|Scenario Task Type=Unauthorised Access
|Scenario Tools and Services=Avast, NoRoot Firewall, Ghostery, uBlock, Purify
|Scenario Task Description=The best way to keep your phone free from malicious software is to:
* keep the operating system and all apps up-to-date
* not install ANY applications outside of the GooglePlay or AppStore

Even these methods may not protect you completely, as attackers have been known to sneak malicious software into the official repositories run by Google and Apple. You can also try to install an [https://www.avast.com/free-mobile-security anti-virus] and are advised to enable the firewall [https://support.apple.com/en-us/HT201642 on your iPhone] or something akin to the [https://play.google.com/store/apps/details?id=app.greyshirts.firewall NoRoot Firewall] on Android.

To secure yourself from malicious code built (or injected) into various websites, install a script blocker such as [https://www.ghostery.com/en/try-us/download-add-on/ Ghostery]; [https://www.ublock.org/ uBlock] for Android; or the [https://www.purify-app.com/ Purify app] for iPhone.
}}

How can I access censored websites from my phone

2015-11-27T16:34:29Z

Floriana: added threat

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Phone
|Scenario Task Type=Censorship
|Scenario Tools and Services=Tor Browser, Orbot, Orweb, Psiphon, BitMask
|Scenario Task Description=Bypassing website censorship on your phone is very similar to [[I_want_to_learn_about_circumventing_Internet_censorship|doing it from your computer]] albeit with slightly different tools. You can use the [https://www.torproject.org/docs/android.html.en Tor Browser for Android] or the unofficial [https://mike.tig.as/onionbrowser/ Onion Browser] for iPhone.

Android users can also install [https://psiphon.ca/en/download.html Psiphon], that works with "VPN, SSH, and HTTP proxy technologies to keep users connected at all times". [https://bitmask.net/ BitMask] is a new project encrypting online communications for Android users.

iPhone users should establish a [https://support.apple.com/en-ca/HT201550 VPN connection] to a trusted provider for circumventing censorship. [https://torrentfreak.com/anonymous-vpn-service-provider-review-2015-150228/ Torrent Freak] has a list you can choose from.
}}

Can I be anonymous whilst using my phone

2015-11-27T16:34:01Z

Floriana: added threats

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Phone
|Scenario Task Type=Profiling your identity and actions, Surveillance
|Scenario Tools and Services=Orbot, Orweb, Onion Browser
|Scenario Task Description=The short answer is you can't, and there are [https://ssd.eff.org/en/module/problem-mobile-phones several reasons why]. Your [https://en.wikipedia.org/wiki/Subscriber_identity_module SIM card] can be directly linked to your identity, account or point of purchase. The [https://en.wikipedia.org/wiki/International_Mobile_Station_Equipment_Identity IMEI] and the [https://en.wikipedia.org/wiki/International_mobile_subscriber_identity IMSI] numbers in your phone are unique and can also be linked directly to your location and/or identity. In general, [https://en.wikipedia.org/wiki/Mobile_phone_tracking Mobile phone tracking] is a well established technology and the only way to prevent this type of location tracking is to remove the battery, carry a [https://en.wikipedia.org/wiki/Faraday_cage Faraday cage-like] accessory or not bring your phone at all.

If you want, however, you can browse the Internet anonymously from your phone:
* Android users can install [https://securityinabox.org/en/guide/orbot/android Orbot] and the [https://securityinabox.org/en/guide/orweb/android Orweb browser]
* iPhone users can install the [https://itunes.apple.com/us/app/onion-browser/id519296448?mt=8 Onion Browser]
 
}}

Phone

2015-11-27T16:33:15Z

Floriana: added threats

{{Scenario Task
|Scenario Task Format=Scenario
|Scenario Task Type=Profiling your identity and actions, Surveillance
|Scenario Task Description=A smartphone is a small computer in your pocket, and all of the vulnerabilities mentioned throughout other sections of this guide apply. The solutions are more or less the same as those for a computer, only with different software. In most cases your smartphone will be running a version of the [https://www.android.com/ Android] or [http://www.apple.com/ios/ iOS] operating system. The Security in-a-box toolkit has excellent recommendations on secure [https://securityinabox.org/en/guide/mobile-phones mobile] and [https://securityinabox.org/en/guide/smartphones smartphone] usage

One major difference between a computer and a phone is that the latter always gives away its location to the cellular network. You can read more about this in [[Can I be anonymous whilst using my phone]]. Wikipedia has a useful description of various [https://en.wikipedia.org/wiki/Mobile_security Mobile security] issues. Smartphones in general require just as much attention security-wise as your computer.
}}

Find a reliable hosting provider

2015-11-27T16:30:47Z

Floriana: added threat

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=My Website
|Scenario Task Type=Unauthorised Access, Surveillance, Censorship
|Scenario Tools and Services=A/I
|Scenario Task Description=If you are setting up your own website for the first time, or want to find a more secure solution for the website you already have, you will have to look into the complicated market of hosting providers, where making the right choice can be hard. To understand what you need to look for, consider the following points:

* Larger companies will be more reliant on existing control panels and automated processes to solve your problems and less willing to go out of their way specifically for you. On the other hand, their infrastructure could be better suited to mitigate [https://en.wikipedia.org/wiki/Denial-of-service_attack an attack]
* Research company reviews from past customers
* Read the terms of service, in particular their mitigation options during an attack
* Look for details on their data centre location, internal systems security, client privacy, customer support agreements

In any case, keep your own backup of the site and make sure you are in control of the [https://en.wikipedia.org/wiki/Domain_Name_System DNS records] so as to switch providers when necessary. A more [https://learn.equalit.ie/wiki/Choose_a_hosting_provider detailed guide] is available for those considering their hosting options.

'''Commercial Hosting'''
* [https://aws.amazon.com/ec2/ Amazon EC2] - huge amount of features and resources, a bit overwhelming for non-technical users at fiprst
* [https://www.dreamhost.com/ Dreamhost] - Many hosting options with a control panel, DNS registration included
* [http://wpengine.com/ WpEngine] - popular option for Wordpress site hosting

'''Non-commercial Hosting'''
* [http://www.autistici.org/ Autistici/Inventati, or A/I] - free hosting for activists on servers run by people who care about users' privacy and security
* [https://help.riseup.net/ca/security/resources/radical-servers A list of non-profit] hosting and Internet service providers, catering to activist causes

 
}}

Find a reliable hosting provider

2015-11-27T16:29:51Z

Floriana: corrected Autistici's name

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=My Website
|Scenario Task Type=Unauthorised Access, Surveillance
|Scenario Tools and Services=A/I
|Scenario Task Description=If you are setting up your own website for the first time, or want to find a more secure solution for the website you already have, you will have to look into the complicated market of hosting providers, where making the right choice can be hard. To understand what you need to look for, consider the following points:

* Larger companies will be more reliant on existing control panels and automated processes to solve your problems and less willing to go out of their way specifically for you. On the other hand, their infrastructure could be better suited to mitigate [https://en.wikipedia.org/wiki/Denial-of-service_attack an attack]
* Research company reviews from past customers
* Read the terms of service, in particular their mitigation options during an attack
* Look for details on their data centre location, internal systems security, client privacy, customer support agreements

In any case, keep your own backup of the site and make sure you are in control of the [https://en.wikipedia.org/wiki/Domain_Name_System DNS records] so as to switch providers when necessary. A more [https://learn.equalit.ie/wiki/Choose_a_hosting_provider detailed guide] is available for those considering their hosting options.

'''Commercial Hosting'''
* [https://aws.amazon.com/ec2/ Amazon EC2] - huge amount of features and resources, a bit overwhelming for non-technical users at fiprst
* [https://www.dreamhost.com/ Dreamhost] - Many hosting options with a control panel, DNS registration included
* [http://wpengine.com/ WpEngine] - popular option for Wordpress site hosting

'''Non-commercial Hosting'''
* [http://www.autistici.org/ Autistici/Inventati, or A/I] - free hosting for activists on servers run by people who care about users' privacy and security
* [https://help.riseup.net/ca/security/resources/radical-servers A list of non-profit] hosting and Internet service providers, catering to activist causes

 
}}