learn.equalit.ie - User contributions [en]

FAQ

2015-12-01T18:27:37Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Description=This is an introductory guide for those looking for an answer to their digital security concerns. It assumes common threat scenarios and asks a series of iterative questions to direct you to a solution, whether that's a tool, a technique or a link to one of the excellent resources listed herein. Treat every recommendation as one piece of the security puzzle you need to solve.

__TOC__

===Guides and reference manuals===
*[https://prism-break.org Prism Break] - a directory of Internet services and software for protecting oneself from online surveillance
*[https://www.privacytools.io Privacy Tools] - a huge collection of privacy-oriented tools, services and guides
*[https://emailselfdefense.fsf.org/ Email Self Defense] - Free Software Foundation
*[https://digitaldefenders.org/digitalfirstaid/ Digital First Aid Kit] - Digital Defenders
*[https://securityinabox.org Digital Security Toolkit] - Tactical Technology Collective & Front Line Defenders
*[https://help.riseup.net/en/security Security Guides] - Riseup
*[https://ssd.eff.org Surveillance Self Defense guide] - Electronic Frontier Foundation
*[https://www.accessnow.org/pages/protecting-your-security-online Protecting Your Security Online] - AccessNow
*[https://myshadow.org My Shadow] - Tactical Technology Collective
*[https://gendersec.tacticaltech.org/wiki/index.php/Main_Page Gender and Tech Resources] - Tactical Technology Collective
*[http://equalit.ie//esecman/index.html Digital Security Manual for Human Rights Defenders] - Front Line Defenders
*[https://github.com/OpenInternet/MyWebsiteIsDown/blob/dev/MyWebsiteIsDown.md What to do when your website goes down] - Jon Camfield
*[https://flossmanuals.net/basic-internet-security Basic Internet Security] - FLOSS manuals Greenhost, Free Press Unlimited
*[https://github.com/freedomofpress/encryption-works/blob/master/encryption_works.md Encryption Works] - Freedom of the Press Foundation
*[https://gist.github.com/atcuno/ Privacy and security conscious browsing] - Andrew Case

===Software and services index===
{{#ask: [[Category:Scenario Tool]]|format=ul|limit=100 }}

===Contacts===
If you have a suggestion for a threat scenario or new resource to link to, a recommendation or simply want to help or find something out, please write https://encrypt.to/info@equalit.ie
}}

I want to be anonymous when browsing the web

2015-10-30T19:58:26Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Identity or Location
|Scenario Task Type=Profiling your identity and actions
|Scenario Task Description=There are multiple guides to help you stay anonymous when browsing the Internet. Anonymity is not [https://learn.equalit.ie/wiki/What_is_Internet_surveillance%3F inherent on the Internet] and useful when you want to hide your destination address from the local Internet Service Provider or your identity from the visited website. It can also help protect your [https://en.wikipedia.org/wiki/Social_graph social graph]. If you need anonymity to send an email, please refer to the [[I want to send an anonymous email]] section. Herein the two most popular methods to achieve a degree of anonymity on the Internet:
*Anonymity networks - The [https://www.torproject.org/about/overview.html.en#whyweneedtor Tor Browser] hides your destination address and shields your identity from the visited website. It is completely open source and free with an active developer and volunteer community. Guides from the [https://securityinabox.org/en/guide/torbrowser/windows Security in-a-box] project for Windows users and from the [https://ssd.eff.org/en/module/how-use-tor-mac-os-x Surveillance Self Defense] guide for Mac users, as well as some [https://github.com/freedomofpress/encryption-works/blob/master/encryption_works.md#browsing-habits tips for using Tor]
*VPN - a Virtual Private Network allows you to connect to the Internet via an encrypted tunnel to the VPN provider. Your ISP can only see your connection to the VPN service, to the website you are visiting your origin appears as coming directly the VPN servers. The [https://black.riseup.net/ RiseUp VPN] service is a popular choice among activists and functions from all computers and Android smartphones. [https://www.surfeasy.com/ Surfeasy] is one of the many commercial VPN services offering free accounts as well.
<br />
Deciding whether to use anonymity networks or a VPN provider depends on your circumstance and is best explained in the [https://ssd.eff.org/en/module/choosing-vpn-thats-right-you Surveillance Self Defense] guide as well as [https://gist.github.com/atcuno/3425484ac5cce5298932#vpn-vs-tor- here]. Be aware of [https://github.com/freedomofpress/encryption-works/blob/master/encryption_works.md#what-tor-doesnt-protect-you-from Tor limitations] as well
<br />
}}

I want to be anonymous when browsing the web

2015-10-30T19:56:58Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=Identity or Location
|Scenario Task Type=Profiling your identity and actions
|Scenario Task Description=There are multiple guides to help you stay anonymous when browsing the Internet. Anonymity is not [[What_is_Internet_surveillance%3F|inherent on the Internet]] and useful when you want to hide your destination address from the local Internet Service Provider or your identity from the visited website. It can also help protect your [https://en.wikipedia.org/wiki/Social_graph social graph]. If you need anonymity to send an email, please refer to the [[I want to send an anonymous email]] section. Herein the two most popular methods to achieve a degree of anonymity on the Internet:
*Anonymity networks - The [https://www.torproject.org/about/overview.html.en#whyweneedtor Tor Browser] hides your destination address and shields your identity from the visited website. It is completely open source and free with an active developer and volunteer community. Guides from the [https://securityinabox.org/en/guide/torbrowser/windows Security in-a-box] project for Windows users and from the [https://ssd.eff.org/en/module/how-use-tor-mac-os-x Surveillance Self Defense] guide for Mac users, as well as some [https://github.com/freedomofpress/encryption-works/blob/master/encryption_works.md#browsing-habits tips for using Tor]
*VPN - a Virtual Private Network allows you to connect to the Internet via an encrypted tunnel to the VPN provider. Your ISP can only see your connection to the VPN service, to the website you are visiting your origin appears as coming directly the VPN servers. The [https://black.riseup.net/ RiseUp VPN] service is a popular choice among activists and functions from all computers and Android smartphones. [https://www.surfeasy.com/ Surfeasy] is one of the many commercial VPN services offering free accounts as well.
<br />
Deciding whether to use anonymity networks or a VPN provider depends on your circumstance and is best explained in the [https://ssd.eff.org/en/module/choosing-vpn-thats-right-you Surveillance Self Defense] guide as well as [https://gist.github.com/atcuno/3425484ac5cce5298932#vpn-vs-tor- here]. Be aware of [https://github.com/freedomofpress/encryption-works/blob/master/encryption_works.md#what-tor-doesnt-protect-you-from Tor limitations] as well
<br />
}}

I want to learn about digital signatures

2015-10-30T17:17:03Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to be certain of the recipient's identity (and vice versa)
|Scenario Task Type=Impersonation
|Scenario Task Description=You've come to the right place! (un)Fortunately, in order to learn how to cryptographically sign your message, you firsts need to read [[I want to learn about encrypting email]]. Using the same key pair, you can digitally sign your message to prove its authenticity and integrity to the recipient. For more information please start by reading the [http://www.bitcoinnotbombs.com/beginners-guide-to-pgp/ Digital Signatures] section on the Bitcoinbombs website and then a [https://securityinabox.org/en/guide/thunderbird/windows practical guide for your email client] from the Security in-a-box resource.
}}

I want to find out about existing options for authenticating email

2015-10-30T17:16:57Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to be certain of the recipient's identity (and vice versa)
|Scenario Task Type=Impersonation
|Scenario Task Description=Several systems have been developed in recent years to help authenticate the sender of an email message. The most popular of which are [https://en.wikipedia.org/wiki/Email_authentication DKIM and SPF]. These are network level protocols that either confirm the domain name (e.g. @equalit.ie) that the message was sent from or check the sender's [https://learn.equalit.ie/wiki/How_does_the_Internet_actually_work%3F#Internet_Protocol_.28IP.29_Address IP address] against a list of known malicious addresses. Gmail users should read the [https://support.google.com/mail/answer/180707?hl=en Email authentication] guide. In general, you must rely on your email provider to perform sender authentication. Users who wish to inspect received messages manually, need to [https://www.arclab.com/en/kb/email/how-to-read-and-analyze-the-email-header-fields-spf-dkim.html view the message header] (or message source as its sometimes referred to) and authenticate it themselves.

* [http://dkimcore.org/tools/dkimrecordcheck.html DKIM authentication ]
* [http://mxtoolbox.com/spf.aspx SPF record lookup]

Users who would like to see if their email provider runs provides DKIM and SPF authentication (for emails that you send to others) can try the [http://dkimvalidator.com/ DKIM Validator] website. Simply send an email to the address on that page and then click to view the results.

}}

How can I see who the email is really from?

2015-10-30T17:16:44Z

Premise:

{{Scenario Task
|Scenario Task Format=Solution
|Scenario Task Parent=I want to be certain of the recipient's identity (and vice versa)
|Scenario Task Type=Impersonation
|Scenario Task Description=The short answer is, you can't. You can only be certain of the sender's identity and for that you need to read [[I want to learn about digital signatures]]. There are however some tips to help you better understand where the email '''may''' have come from.

Every email you receive is made up of several components. There is the content itself, address details, as well as technical data about the message - also known as the message header. It contains detailed information generated by your email server about where the message came from and how it was processed before arriving in your inbox. This may be your only forensic clue to investigate the message's origin. Please read this guide on [https://learn.equalit.ie/wiki/Email_spoofing email spoofing] and [https://support.google.com/mail/answer/29436?hl=en Gmail's guide] on understanding their message headers.

You can also copy and paste the message header into the [http://mxtoolbox.com/EmailHeaders.aspx MXToolbox] to get a humanly readable context of where this email has been.
}}