class: center, middle ## CryptoParty: Surveillance Self-Defense Workshop for Activists & Other Non-geeks! #### Noisebridge #### Steve Phillips / 2019.08.23 --- ## Event Outline - Motivation: Our Surveillance Landscape - Why privacy is so important - Big Picture: how I think about security and privacy - Advice and techniques - How to use various tools to protect yourself against various threats - Individual help for each tool + at end - Thank you --- ## Make the most of this event! I encourage you to participate and immediately use what we cover -- today! These slides: **see top of https://tryingtobeawesome.com** --- ## Our Mass Surveillance Situation - Your **cell carrier** (e.g., AT&T) and some apps know where you are - **Facebook** knows who your friends are, who you message - **Gmail/Yahoo/Microsoft** knows who you email and what you say - **Google** knows what you search for/think about - **Dropbox** has your personal files and data - **Skype** knows what you look and sound like --- ## Good thing all that information is separate! Or is it? (Facebook tracks _and buys_ info) --- ## What the NSA knows <img src="https://upload.wikimedia.org/wikipedia/commons/f/f3/PRISM_Collection_Details.jpg"> --- ## What does all this add up to? Snowden, in an interview: - "**You could read anyone's email in the world**, anybody you've got an email address for. Any website: You can watch traffic to and from it. Any computer that an individual sits at: You can watch it." --- ## MLK <img src="https://tryingtobeawesome.com/files/screenshot-surveillance-mlk2.png"> --- ## "But why worry about privacy if I'm not an activist?" - Maybe your friend is an effective activist - A WikiLeaks' associates phone was confiscated, now some of his contacts get stopped at the border - http://www.cnet.com/news/security-researcher-i-keep-getting-detained-by-feds/ --- ## WikiLeaks, Twitter, and Me - The US gov't has requested _my_ data from Twitter in 2011 - ...and the data of every other WikiLeaks follower - Because **our government considers following WikiLeaks on Twitter to be a suspicious act** --- ## Stingrays - Fake cell phone tower - Used by LAPD, others - See https://www.latimes.com/politics/la-pol-sac-cell-phone-surveillance-transparency-law-20170827-htmlstory.html - Can view **text messages, phone calls, and data** - ...unless you use encryption --- ## "But I'm not doing anything wrong" - Freeing slaves - Teaching black people how to read - Interracial sex (used to be illegal) - LGBTQIA+ relationships --- ## "But I'm not doing anything wrong" (2) - What about Bernie Sanders-type figures in 30 years? - During WWII, an LA church housed Japanese --- ## Surveillance and Terrorism - Mass surveillance have never prevented any terrorist action - 9/11 - Boston Bombing - etc - For more of my comments on the (in)effectiveness of mass surveillance, listen to Episode 1 of "The Populist Papers" - <https://soundcloud.com/user-497344499/populistpaperse1> --- ## And _that_ is why surveillance is so dangerous - Questions? / brief discussion - (Remember: good news is coming!) --- ## How I think about security and privacy - Common sense - Shoulder surfing - Listening through the door - Public v. private info --- class: center, middle # Privacy Tools and Advice --- ## Tools and Techniques - Advice and techniques - Browser extensions, search engine - ProtonVPN - 2FA (2-factor authentication) --- ## Tools and Techniques (2) - Wire: encrypted texts, calls - Mobile and desktop - Tor: anonymous web browsing - ProtonMail: signup + enabling 2FA - Effective: want in early? --- ## Ideas and techniques - Run the latest software - Accept software updates - Don't reuse passwords - Use a password manager! --- ## Tip: Use a passcode to unlock your phone - ...not a fingerprint - 2014: http://time.com/3558936/fingerprint-password-fifth-amendment/ - 2016: https://www.techdirt.com/articles/20160504/06112434342/when-fingerprint-is-password-where-does-fifth-amendment-come-into-play.shtml --- ## Browser Extensions, Search Engine - HTTPS Everywhere - Installed on Tor by default - Extensions exist for Chrome and Firefox - ...I use Incognito/Private mode a lot - Search Engines - StartPage.com - DuckDuckGo.com - <https://tryingtobeawesome.com/files/tools.pdf> --- ## ProtonVPN 1. VPN service - Has free and paid tiers - Pay for faster speeds 2. Simple (and free) to get started 3. **DEMO** --- class: center, middle ## Tor Basics  --- ## What Tor does Encrypts your web traffic and bounces it between 3 servers before "exiting" the Tor network --- ## What Tor doesn't do Magic; see https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor **DEMO** --- ## Messaging - Signal - Wire - Trade-offs --- ## Effective - End-to-end encrypted task management for activists - Mostly built at noisebridge - Helps securely coordinate people to achieve shared goals - Fossil fuel divestment campaigns - Helping Hong Kong protestors - Anti-Palantir OSINT - Anti-Trump activism - Sign up to try it out when it's ready - See signup sheet - Or visit https://effective.af --- ## 2FA Snowden mentions the importance of 2FA at https://boingboing.net/2015/11/12/edward-snowdens-operational.html > Much of Snowden's advice takes the form of simple self-help measures > (use Tor Browser for sensitive lookups: think about where you take > your phone; encrypt your calls and messages with the easy-to-use > Signal; turn on two-factor authentication where it's available). --- ## 2FA (2) Let's protect our accounts! ### ACTION: Visit this link for ideas for accounts to protect: https://www.lifewire.com/accounts-types-that-should-have-2fa-4150469 ### ACTION: Figure out how to enable 2FA on your accounts here: https://twofactorauth.org/ --- ## Snowden's Security Recommendations <blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">.<a href="https://twitter.com/Snowden">@snowden</a> OPSEC guide:<br>- use Signal<br>- use Tor<br>- use full disk encryption<br>- use a password manager<br>- use two factor auth<br><br>Solid basics.</p>— the grugq (@thegrugq) <a href="https://twitter.com/thegrugq/status/668767879299399682">November 23, 2015</a></blockquote> <script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script> --- ## My Contact Info Name: Steve Phillips ProtonMail: **elimisteve@protonmail.com** Wire: **@elimisteve** Other ways to contact me: [tryingtobeawesome.com/contact](https://tryingtobeawesome.com/contact) --- ## Thank you Noisebridge! Donate to Noisebridge: https://donate.noisebridge.net/ My Patreon: [patreon.com/cryptag](https://patreon.com/cryptag) --- ## Other Event Ideas 1. Anti-doxxing workshop - Make yourself harder to doxx, and limit the negative impact if you _are_ doxxed 2. Advanced Security - Exchange security/privacy/anonymity tips and tricks with other tech-savvy people 3. How to painlessly switch from Chrome to Firefox Feel free to let me know what you want to see!