COVERING YOUR INTERNET TRACKS

These suggestions are primarily aimed at people that find themselves in need of greater security, privacy, and anonymity for their electronic communications. They assume that your computer is running a version of MS Windows, but again the suggestions can apply to other operating systems or platforms that have similar software.

There is no such thing as a 100% secure communication over an electronic medium such as the global internet or telephony network. Many of the suggestions here do provide varying levels of security, privacy, and anonymity (SPA). When these tools are implemented properly and used in conjunction with each other, your personal SPA will be greatly improved. By covering your tracks, you can reduce your chances of being on the receiving end of any unpleasantness. Needless to say, great care must be taken with your communications. Even with all the security in place, your SPA can still be compromised by the use of weak passphrases, the opening of attachments from unknown senders, inserting USB drives of dubious origins into your computer systems or careless revelations of identifiable details. The user (ie. you) is often the weakest link. Do stay safe by practicing safe computing.

Although not covered here, you may wish to invest in a number of suitable Faraday pouches or bags to shield your mobile devices from surveillance or theft.

Before you can secure your mobile devices it behooves you to reconsider your approach to Contact Management, which can make things easier during subsequent steps. Although this step is optional, it’s highly recommended. The majority of mobile devices run versions of either the Apple iOS or Google Android operating systems. You need to start by updating your contacts. If they are linked/synchronised with an email address (eg. Gmail), then log in to your email account (on a PC) and update your contacts from there. All changes will then propagate to your linked devices, assuming you’ve selected Google in your Contact’s Display Preferences menu.

To update your contacts, change all telephone numbers to the proper international (E.164/ENUM) format. For example, consider the British phone number 07123 456789, you need to do the following to it:

1. Drop all leading zeros
2. Remove all non-numeric characters
3. Prepend the relevant country code

The British phone number 07123 456789 will become +447123456789. This is the preferred format so update all telephone numbers for as many of your contacts as you can. Get into the habit of storing numbers in this format. Make a note of your own number in this format, you’ll need it later.

Always apply all software or operating system updates as soon as they become available. These include much-needed security fixes. If you’re confident and are technically proficient, you may replace the device’s operating system with a custom one like:

• COPPERHEADOS
• LINEAGE OS
• REPLICANT
• RESURRECTION REMIX

For secure encrypted messaging and calling for Android and iOS devices, go to SIGNAL and follow the link to install the SIGNAL PRIVATE MESSENGER application. This is a free, open-source application that makes use of your smartphone’s mobile data connection or wifi calling features. Note that this application is meant to replace your existing default messaging application. You will need to complete a short activation process using your own mobile number (in the above international format), then you’ll be good to go. Remember to activate the WiFi Calling feature on your smartphone, as well as the WiFi Calling and Privacy settings in SIGNAL too.

Another application to note for your mobile device is ORBOT. This lets you route your internet browsing over the TOR network. There are other good privacy-oriented browsers such as TENTA and BRAVE. There are desktop versions of some of the encrypted instant messaging applications below.

Modify each of your wifi network connections (or better still your router, see below) to ensure that you use the IP addresses displayed in the TENTA DNS SETUP GUIDE as your DNS, unless you decide to use QUAD9 (see below).

Disable the wifi and location features if you’re in a public place and they’re not needed, this can easily be done by temporarily enabling the airplane or flight mode feature. Ensure that you encrypt your mobile device. This may take some time, you may want to ensure your device is charging during this crucial step and shouldn’t be interrupted. Afterward, enable PIN / Passcodes and even SIM PIN and Voicemail PIN to further secure your smartphone.

Before you sell or dispose of your mobile device:

1. Backup/export all your personal or important information (files, images, contacts, etc) to your encrypted cloud or any other external storage.
2. Delink your device from your Apple or Gmail account.
3. Delete all images or other personal files from your device.
4. Clear all messaging and call history, including any notifications and search or browsing history.
5. Clear all contacts and password keys from your mobile device, inc. SIM.
6. Uninstall as many applications as you can, inc. clearing SD storage.
7. Forget all networks or wireless access points.
8. Ensure that you then encrypt your mobile device again.
9. Perform a hard reset of your mobile device.
10. You may then remove the SIM card and battery (if possible), then physically destroy the mobile device if you wish to dispose of it.

For additional security, consider enabling two-factor authentication (2FA) for various online services using a suitably secure authenticator application (avoid 2FA via SMS). Online guides to securing your iPhone are also available here:

• SECURE YOUR IPHONE – LIFEHACKER
• SECURE YOUR IPHONE – LIFEWIRE
• SECURE YOUR IPHONE – MASHTIPS

If you have access to the router and can update its settings, log in to it using your computer’s web browser then note the existing DNS IP addresses in case you need to undo this step. These would be the addresses for your Internet Service Provider’s DNS. Consider changing the existing DNS IP addresses to ones provided by the following:

Save your updated configuration then restart your router.

When WPA3-certified routers and compatible devices become more readily available, do consider upgrading your hardware to make use of this new wireless standard for improved security. It is also recommended that you have separate MODEM and ROUTER hardware where possible.

A good free anti-malware and firewall will help keep out any intruders. On MS Windows, a good firewall is GLASSWIRE. On Linux, a good firewall is PFSENSE. There are also many others available.

If you’re truly concerned that your privacy may have been compromised, don’t use your own computer. Go to an internet cafe or other public services such as a library and use the computer there if you can. Otherwise, you should be reasonably safe by using your own computer with the following suggestions.

Avoid using versions of MS Windows; these are a relatively non-secure set of Operating Systems. Try to use secure distributions of Linux such as:

• QUBES OS
• SUBGRAPH OS
• KODACHI LINUX
• PUREOS
• TAILS
• SEPTOR
• UNKNOWN OS

The latter can be copied to a USB drive (or optical media such as CD, DVDs, etc) and run on any suitable computer. KALI LINUX is a very useful operating system, geared more towards penetration testing and security auditing. Many of these Linux (and BSD) distributions can be run directly from optical media or USB so you can use them before installing anything on your computer. Take the time to learn about open-source operating systems, start by bookmarking the DISTROWATCH site.

If you’re running a version of MS Windows, encrypt your hard drive (or at the very least the partition/drive that holds your personal files). You can use VERACRYPT.

If you don’t have access to your router or are unable to update your DNS configuration (as in the above section), then you should use the older SIMPLE DNSCRYPT software on your computer. Remember to modify your adapter settings (via your Control Panel > Network Connections or type ncpa.cpl from the command line, then from the popup, update IPv4) to ensure that the preferred DNS is set to 127.0.0.1. Once this is configured and the DNS cache has been flushed, your computer will then use the new DNS.

You may also test whether your computer is leaking your DNS queries, with instructions on how to resolve them here: DNS LEAK TEST.

If you want to make use of the Cloud to store your personal files, then opt for secure zero-knowledge services like TRESORIT.

To make use of the various anonymisation networks, you can install either:

• TOR BROWSER BUNDLE
• I2P

They may need some configuration but they are recommended if you wish to conduct your online communications anonymously. Take great care to configure them as a Relay, not as an Exit Node. Many well-known social media and other hidden services, including illicit services, are accessible via these anonymisation networks which provide improved end-to-end security.

A very useful application is BATCHPURIFIER. This tool can help remove your hidden information or metadata from multiple files (eg. photos or images). The metadata can be used to trace when, where and how the file was created (among other things). Removing all this information from files before you store or share them will greatly aid your security, privacy, and anonymity (SPA).

To hide your messages in other files, you can use free steganography software like:

• OPENSTEGO
• DEEPSOUND

Share these modified files by first uploading them to an anonymous service (see below).

Another great application is KEEPASS PASSWORD SAFE. This is a free, open-source password manager that lets you store your many passwords securely. There are versions for Android and iOS for use on mobile devices.

Email is a very important service for many reasons. Presently there are many email service providers that offer varying levels of security. However, most suffer from one significant flaw: their metadata is sent with the message in clear text. This does not bode well for your SPA. As a result of recent events, efforts are underway to completely redesign email for the modern era with intrinsic security known as Email 3.0.

The DARK MAIL TECHNICAL ALLIANCE is leading the effort, the protocols have a name: DIME. To date, the following providers offer DIME emails: LAVABIT and ONIONBIT.

But what if you’re unable to use the new DIME email services? There is a simple process that you can use to communicate using any email service. Here’s how it works:

1. Person A registers with a new email account and notes the login credentials (ie. username and password).
2. Person A logs in and drafts a message, but does not send it. The message is saved in the drafts folder.
3. Person A logs out.
4. Person A gives the login credentials to their trusted contact Person B, in person.
5. Person B then logs in to the same email account.
6. Person B can then read the saved message from Person A in the drafts folder, then deletes it.
7. Person B replies by creating a new message and saving that into the drafts folder.
8. Person B logs out.
9. Person A can then log back in and read the saved message from Person B before composing a reply as above.

This communication can take place without a single message being emailed through any server or domain, which makes surveillance very difficult. This requires the participants to access the same email account and some degree of coordination between them. Also, remember to change your email settings to disallow tracking and other so-called features. There are many helpful tips available online, specifically how to improve your email’s SPA.

Your browsers are important too:

• GOOGLE CHROME
• MOZILLA FIREFOX
• TENTA
• VIVALDI
• BRAVE

If your Operating System is a 64-bit OS, use 64-bit versions of these browsers. Firefox is recommended for security. Be sure to keep them updated and configured properly at all times. Do remember to disable any tracking or DNS prefetching before use.

There are many useful applications, settings and browser tests detailed in:

• PRIVACY TOOLS
• RESTORE PRIVACY
• HOW’S MY SSL?

You may also test whether your browser is protected against online tracking techniques, instructions on how to resolve them here: PANOPTICLICK.

Set your home pages in all browsers to either:

• DUCKDUCKGO
• STARTPAGE
• QWANT

Also, bookmark and use the following sites:

• FIREFOX SEND
• OTR
• JUMPCHAT
• UPLOADFILES

The OTR site lets you send self-destructing messages and files to your contacts, anonymously. A facility for encrypted chat is also available. This is purely browser-based, no installation of any software is necessary. In each browser you should search for and install the following extensions/add-ons/plugins:

• DISCONNECT
• HTTPS EVERYWHERE
• PRIVACY BADGER
• PRIVACY PASS
• DECENTRALEYES
• UBLOCK ORIGIN
• FIRST PARTY ISOLATION

There are also free applications that can be downloaded and installed for secure instant messaging:

• SIGNAL DESKTOP
• TOX CHAT
• RICOCHET

You should also consider using services or extensions that function as secure VPNs such as:

• WINDSCRIBE
• OPENVPN
• PUREVPN
• MULLVAD
• PRIVATE INTERNET ACCESS
• PERFECT PRIVACY
• ZORROVPN
• EXPRESSVPN
• PRIVATEVPN
• NORDVPN
• TORGUARD
• STRONGVPN
• ANCHORFREE

These let you route your browsing activities through virtual private networks or remote proxies located in different jurisdictions. Do not access your email, financial or other personal sites through them, unless they have sufficient security in place, nor should you use any untrusted proxy with handling your personal business (ie. those that require login credentials or financial information). Multi-hop / cascading VPN providers like PERFECT PRIVACY provide some advantages over other services. Ensure that whichever browser you use, you’re familiar with its Incognito or Private Browsing Mode and that it’s configured to clear its cache automatically when it’s closed.

Further information and reviews are contained in these excellent articles:

• THE ULTIMATE PRIVACY GUIDE
• THE WIRED GUIDE TO DIGITAL SECURITY
• THAT ONE PRIVACY SITE

After emptying your computer’s Recycle Bin, you may use some useful MS Windows commands, eg. CIPHER ensures that no deleted file in a directory can be recovered.

Other useful software:

• JAMI – Alternative to Skype.
• MASTODON – Alternative to Twitter.
• MINDS – Alternative to Facebook.
• DISCORD – Alternative to Skype and TeamSpeak.
• STREMIO – Alternative to Kodi and Plex.
• TURTL – Alternative to Evernote.
• JOPLIN – Alternative to Evernote.
• LIBREOFFICE – Alternative to Microsoft Office.
• ETCHER – Burn images to SD Cards and USB drives.
• ZULU – Alternative to Oracle Java SDK.

There is a great deal of information available regarding counter-surveillance that couldn’t be included because it’s outside the scope of this article.

On mobile devices, secure communication is of the utmost importance. Install the free open-source application SIGNAL on your smartphone. There is also a version of Signal available for desktop computers. Phone encryption and periodic clearance of search and location histories are advised. Set a strong passphrase and the remote lock, locate and erase feature.

On computers, many tools can be installed but some websites can be accessed by any modern browser. Check your browser’s privacy and security settings and schedule it to clear your entire cache and history (especially when your browser is closed) periodically. Limit your cached web content to 0MB and enable tracking protection. Ensure you sign up to a DIME-compliant email service. Updating your DNS / Router settings is highly recommended. Harden your social media privacy settings (SECURE FACEBOOK or FACEBOOK PRIVACY) by placing your associates in distinct groups and setting their permissions accordingly, or better yet, try to keep your presence on social media to a minimum. Remember to log out of every site that you had logged into when you are done. Be aware that an increasing quantity of your personal information, contacts, views, habits, and locations can be scraped from your online presence and sold to third parties. If this point is of particular concern, consider using MINDS and MASTODON.

Hopefully, the information detailed here will help you cover your internet tracks more effectively and assure your personal safety.