# Privacy Questions and Answers **URL:** https://discuss.privacyguides.net/t/privacy-questions-and-answers/16272 **Category:** Questions **Tags:** guide **Created:** 2024-01-16T14:22:30Z **Posts:** 50 ## Post 1 by @Sprout3425 — 2024-01-16T14:22:30Z ~~After reading the `knowledge base` and `recommended tools` sections, these were the questions I was unable to answer, I think answering them could help a lot of people:~~ - `When is it advisable to use **Tor**? Having three browsers (Firefox, Mullvad and Tor) seems redundant.` A: **To be answered.** - `When should a VPN be used, exactly? PG says: it is useful when anonymity is needed, but when is anonymity needed in the first place?` A (the following are my assumptions): A VPN is used to prevent websites from learning your IP address, which can approximate your location. A VPN provides security and privacy by encrypting your internet connection, which shields your activities from external observers like hackers and ISPs (though these parties may indirectly be able to obtain this data anyway. E.g., if the website you were visiting knew your real IP, it could potentially sell it to other parties), and to a smaller degree the websites you visit. The reason that security and especially privacy are harder to achieve from the websites themselves are because (1) you may willingly or obligatorily provide these websites with your information, (2) they may obtain data from your device using technologies only available to them, and not outside parties, e.g., cookies, (3) assuming they have the ability to do so, they may use other information that you may have provided them, and check for this information across other external sites, which could have your real IP tied to this information, or (4) lastly and most importantly, they will in most cases still be able to obtain your real IP address, even if you used a VPN on such sites, because this encryption is only effective if you’ve consistently used the VPN on those sites and have enabled a kill switch—a feature that cuts off your internet if the VPN disconnects, preventing data leak. Otherwise, websites that log multiple IP addresses could potentially identify your real IP by recognising and excluding common VPN server IPs. However, I assume that a paid VPN with servers within your geographic region (e.g., America) can make it harder for websites to differentiate your real IP from the VPN-assigned ones, since your IP address could be any of those within America for example. However, these website can also log how often each IP is used and when they are used to notice obvious patterns. Although a VPN’s usefulness is reduced if a website already knows your IP, it still offers protection against cross-site tracking. This is because if entities can track your IP across sites, they can link your activities and information, and create a profile on you. A VPN prevents future websites from obtaining your IP. The verdict is **use a VPN wherever you can, except for where doing so is impractical** (e.g., in circumstances when performance is needed, such as an online academic test) **or if having your information available to your ISP, hackers (only applicable to public networks), and websites you do and don’t visit is not a worry**, i.e., not apart of your threat model, **or unsafe (illegal)**. @PrivacyAintReal was the one to highlight the caveats of using a VPN. - `How should people handle their personal information for online orders? Is it recommended to use their real name or a fake name or initials?` A: Use fake names where legal, I give online shopping websites my real first name and then provide an initial as my last name for online orders. You may be able to get away with faking your name entirely. I might start giving them my name using characters from other countires, although I am not sure this is allowed. - `How can people avoid receiving unencrypted order confirmation emails that contain their personal data?` A: Don’t give them your personal info in the first place, or reduce the amount of personal info you give them, or opt out of email and allow them to message you in other ways. - `Is it recommended to use a VPN when purchasing online, even when using a real-life identity? PG says: ‘Using a VPN in cases where you’re using your real-life or well-known identity online is unlikely be useful,’ and ‘When purchasing online, ideally you should do so over Tor.’ However, PG also suggests using a VPN before connecting to Tor. This seems contradictory, and may require further clarification.` A: Yes to prevent cross-site tracking (I think), even if the site now knows your address. Use Tor when purchasing items online! - `What are some good Firefox extensions to enhance privacy and security?` A: Just use uBlock Origin, it does a lot. - `Is it better to use Bitwarden’s extension or web vault? The trade off here seems to be between fingerprintability and convenience + phishing protection. Is addy.io more effective as a website or a browser extension?` A: Just use Duck Duck Go email aliases (or the other aliasing services Bitwarden supports) and [link them to Bitwarden](https://bitwarden.com/help/generator/#username-types), which will generate aliases for you, you are knocking out two birds with one stone. - `Is it a good practice to register all online accounts to a single Proton Mail account using aliases, or should different email addresses be used?` A: Compartmentalising your activities with different email address is pointless due to the existence of email aliases (I think)! - `What are some ways that people can deanonymize themselves online? PG says: 'We know people can quite easily deanonymise themselves in a number of ways, e.g.: Reusing personal information (e.g., email accounts, unique pseudonyms, etc.) that they accessed without anonymity software (Tor, VPN , etc.).' What does this mean, and how can it be prevented?` A: It means that if someone has access to your info across sites, and you use this same email on two or more these sites, even with anonymity software, they will know who you are, by tying info about you from another site that you may have accessed without anonymity. @wojciechxtx also provided this example: By mistakenly attaching `EXIF` data for example. - `Is **Orbot** recommended as a VPN on iOS, the problem is it is unusably slow, so shouldProtonVPN be used?` A: I and others think you can use either, except for when you are connecting to the iOS Tor Browser, which itself suggests you use Orbot. - `What is the best alternative for multi-factor authentication (MFA) if physical keys are not convenient? Is TOTP the next best option?` A: Pretty sure its TOTP (time-based one-time passwords are generated securely and expire after 30 seconds). - `Is Thunderbird hardening recommended? Is this a one-time process or does it require regular updates?` A: It’s a pain to do ([instruction are here](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki)), but I haven’t had to update it since. - `Which iOS email client is more suitable for a non-Proton email account: Apple Mail or Canary? Is Canary’s encryption worth paying for?` - `What is the purpose and benefit of OpenPGP and how can it be used?` A: its purpose is email encryption, it is built into Thunderbird. For all other cases [these are used](https://www.privacyguides.org/en/encryption/#openpgp). - `What is Mailvelope (still not entirely sure) and why is it listed in the email clients section?` A: a browser extension for email encryption using OpenPGP. No idea why it is not in the encryption software section. - `What is the *best* way emails can be encrypted from sender to receiver, even if one or both parties don’t use a privacy-oriented email service provider or OpenPGP encryption software?` A: Don’t think this is possible, just use Signal. - `Can Thunderbird (an email client) enhance the privacy of email addresses that don’t support encryption by default?` A: > [@overdrawn98901](#): > > Outlook sends a lot of information about what you do to their servers, Thunderbird does not. - `Should sending emails and registering accounts be limited to personal computers, or can this be done equally safely on mobile devices? E.g., is it safer to use Proton mail + SimpleLogin on a PC rather than on an iPhone?` A: Does not matter, in fact mobile phones tend to have better sandboxing (security) and privacy (allegedly). Use Duck Duck Go email aliases on Bitwarden app! - `Are Picocrypt and VeraCrypt redundant if BitLocker is already used on Windows 11?` A: From my understanding, Picocrypt (used for encrypting single files) is not redundant, since full-disk encryption slows down some actions in the computer, such as file organisation. From @overdrawn98901: the benefit of single file encryption is that it can be used as essentially an extra layer of protection. For example, even if a hacker stole your full encrypted computer, by knowing your computer password, the single file encryption is used with a different password, so that is a whole separate issue to crack it. You can also pass around the encrypted file anywhere, e.g., email, copy it on an unencrypted drive - the works, and it’ll be secure so long as your password is secure. - `What is the use case for Cryptomator?` A: designed for privately saving files to any cloud provider. It allows you to create vaults that are stored on a virtual drive, the contents of which are encrypted and synced with your cloud storage provider. - `Is it possible to encrypt files using any other method and then upload them to Proton Drive? Doesn't this make Cryptomator redundant?` A: **To be answered.** - `How can passwords in Bitwarden be backed up securely? Is it better to export, encrypt, and save them on Proton Drive using Cryptomator, or on a separate encrypted hard drive using BitLocker?` A: either encyrpt the backup and save it to the cloud using Cryptomator or encrypt the backup and save it to a hard drive (Picocrypt can be used here). - `Can changing settings within a search engine like DuckDuckGo affect fingerprintability?` A: Yes apparently. - `What is self-hosting, and what are its pros and cons?` A: From my understanding, web servers are used to provide people with services when people make requests for them, self-hosting is the act of using a private web server. This means you don’t risk others taking your information from your requests. - `What is the role of the “Router Firmware” page? Is it necessary to install such firmware? What does this software do? Does it allow changing the DNS settings on a wireless router?` A: Changes how the hardware works, potentially improving privacy, security and performance (I think). ISP firmware could be up to no good. - I have moved my questions regarding DNS [here](https://discuss.privacyguides.net/t/questions-regarding-dns/16281). - **In general** , some PG tool recommendations are vague or incomplete, e.g., the function of the tools and whether they are essential or optional for most users, needs to be explained more clearly. --- ## Post 2 by @Sprout3425 — 2024-01-16T14:24:52Z @aspirin6993 feel free to chime in, if you want. --- ## Post 3 by @Satoshi — 2024-01-17T02:05:13Z A lot of these questions can be answered by doing a simple search in the forum or via any search engine, or reading the docs of any of the mentioned tools. For example “What is self-hosting, and is it worth it?” can easily be searched. I recommend doing your homework before asking questions that have been already answered here and in other places. Alternatively, looking at your previous post, consider hiring a consultant or doing your homework first and then ask when you hit a dead end. I don’t believe that we should be spoon-feeding people, it’s a bad habit. --- ## Post 4 by @Sprout3425 — 2024-01-17T11:04:08Z > [@Sprout3425](#): > > - From what I understand DNS is used to obtain the IP addresses of websites. I’ve learned that setting up DNS at the router level eliminates the need for device-level or browser-level configurations. If a DNS is set at the browser level, it overrides the device-level DNS, and similarly, a device-level DNS overrides a network-level DNS. From what I gathered, AdGuard was recommended for use. Thus, I assume the best course of action would be to setup AdGuard DNS at the router-level. I know this has to be done manually, but I’m unsure how to do it on my Huawei Optus router E5186s-61a as these options are unavailable. To add to my confusion, AdGuard says Adguard Home is the most comprehensive solution, how is it different to AdGuard DNS at the router-level? Do I need the AdGuard app for Windows? I agree whole heartedly, however, I would like to point out that I have done my research, and read through the entire website, most of these questions have led me to dead ends. This is exacerbated due to my lack of technical knowledge. However, you are right there are some questions that I can answer myself, thus, I have refined the post accordingly. **Most importantly** , I think most of these questions reflect what is missing in the Privacy Guides knowledge base and tool recommendations. I think addressing these questions would not only help me, but I think this could help many others in my position. I think what was especially problematic was my wording, my post was worded as if I needed personal advice for me and me only, I think the opposite is true, so I have amended the wording in my post. --- ## Post 5 by @wojciechxtx — 2024-01-17T11:48:57Z > [@Sprout3425](#): > > When should people use **Tor**? Having three browsers (Firefox, Mullvad and Tor) seems redundant. You can have as many browsers as you wish. It doesnt matter. What matters is how (what for) you use internet as each browser has (slightly) different characteristics (strenghts vs. weaknesses). When should you use Tor? Again, depends on your usage. Same with VPN. > [@Sprout3425](#): > > Is it recommended to use a real name when providing personal information for online orders, or should people fake their names or initials? Depends. For things like finances, e-commerce use real data; for everything else: use fake one. > [@Sprout3425](#): > > Can anything be done to prevent unencrypted order confirmation emails, containing personal data? Unless you are server admin, no, not much can be done. > [@Sprout3425](#): > > Should I use a VPN when purchasing online, even when my real-life identity is used? Definitely yes. > [@Sprout3425](#): > > What Firefox extensions should I use? Depends on your specific usage. > [@Sprout3425](#): > > Should I use Bitwarden’s extension or web vault? I’d use none of them TBH. Bitwarden is not very privacy-friendly. Although its very convenient. > [@Sprout3425](#): > > I am considering using Arkenfox. Highly recommend it. > [@Sprout3425](#): > > All of my online accounts are registered to a single Proton Mail account, is this ideal? Nothing wrong with it. > [@Sprout3425](#): > > How can people deanonymize themselves? By mistakenly attaching `EXIF` data for example. > [@Sprout3425](#): > > What VPN should I use on iOS as Orbot is unusably slow? Is ProtonVPN a good option? I use `ProtonVPN` everywhere and Im good. > [@Sprout3425](#): > > What is the best option for multi-factor authentication (MFA) if physical keys are not convenient? You pretty much answered your own question. Id go with `MFA`. > [@Sprout3425](#): > > Should I harden Thunderbird? Is hardening Thunderbird a one-time process or regular updates are necessary? Id not use Thunderbird in the first place. As of hardening: yes, updates are mandatory. > [@Sprout3425](#): > > Should I use Apple Mail or Canary for my non-Proton university email account? Is Canary’s encryption worth paying for? Again, depenmds on your usage. > [@Sprout3425](#): > > How can I end-to-end encrypt my emails with a university email address? Can using an email client like Thunderbird improve privacy for email addresses created with providers like Outlook? Encryption will give you nothing if mail server wasnt configured to support it. Regardless what client you will use. > [@Sprout3425](#): > > Are email aliasing services like [addy.io](http://addy.io) available on iOS No idea if there is an app in AppStore. > [@Sprout3425](#): > > What is OpenPGP used for, why do I need it, and how can I use it? What is Mailvelope for and why is it in the email clients section? Openpgp is for encryption. > [@Sprout3425](#): > > Are Picocrypt and VeraCrypt redundant if I’m using BitLocker on Windows 11? No idea. Never used Windows 11. > [@Sprout3425](#): > > How should I back up my passwords in Bitwarden? Should I export, encrypt, and save them on Proton Drive using Cryptomator, or on a separate encrypted hard drive using BitLocker? You need to do nothing as passwords are encrypted as soon as you save them/create them in webvault… > [@Sprout3425](#): > > Can changing settings within a search engine like DuckDuckGo make me more fingerprintable? Yes. > [@Sprout3425](#): > > What is self-hosting, and is it worth it? Self-hosting is state when you host app yourself. You need a VPS/physical server for this. As well as some tech knowlege. Is it worth hassle? Definitely yes. --- ## Post 6 by @Sprout3425 — 2024-01-17T12:33:32Z > [@wojciechxtx](#): > > Highly recommend it. Shame that the Arkenfox wiki is extremely tedious to read and follow for someone who is a lay person when it comes to technology, I wish the wiki was laid out more simply and using a straightfoward, clear approach. > [@wojciechxtx](#): > > Id not use Thunderbird in the first place. As of hardening: yes, updates are mandatory. It is recommended by PG, what do you use/what would you suggest? Thanks a lot for your effort, all the other answers make sense. --- ## Post 7 by @wojciechxtx — 2024-01-17T12:56:43Z > [@Sprout3425](#): > > I wish the wiki was laid out more simply and using a straightfoward, clear approach. Thats desirable, I agree :slight_smile: > [@Sprout3425](#): > > It is recommended by PG Not every recommendation on `PG` should be strictly followed. PG is not definitive source. There are instances where PG is simply wrong. > [@Sprout3425](#): > > what do you use/what would you suggest? Well, there are plenty mail clients available; you have to test one-by-one and see what suits your likes/needs. For personal use (on my private laptop) I use Proton Mail web interface (dann well architected both UI and UX wise). On business computer I have no other option but to use Apple Mail. > [@Sprout3425](#): > > Thanks a lot for your effort, all the other answers make sense. No problem at all :slight_smile: --- ## Post 8 by @Sprout3425 — 2024-01-17T12:59:10Z Ok, thanks a lot! My main question is, since I am using Proton Mail for my main account, I do not need an app client, I can use a web client, however, for my University email account the web client is outlook, would it be better to use thunderbird as a client? Hence, why I asked whether using a client that is not ‘native’ to the email address provider, could provide improved privacy compared to ‘native’ client. --- ## Post 9 by @wojciechxtx — 2024-01-17T13:04:53Z > [@Sprout3425](#): > > for my University email account the web client is outlook, would it be better to use thunderbird as a client? If your university provided you with pre-configured web-accessible Outlook, than you can also configure any client thats available out there. Either manually or by providing so called `mail profile file`; this way there is no need for you to fill all the data (smtp and so on) that Outlook (or any other client) uses to connect with mail-server. --- ## Post 10 by @wojciechxtx — 2024-01-17T13:07:56Z @Sprout3425 just out of curiosity, on what Proton plan are you? Free or paid one? --- ## Post 11 by @Sprout3425 — 2024-01-17T13:09:16Z Free one. Thanks for your previous response btw. --- ## Post 12 by @sha123 — 2024-01-17T15:30:53Z > [@Sprout3425](#): > > When is it advisable to use **Tor**? Having three browsers (Firefox, Mullvad and Tor) seems redundant. If you don’t live in a country where using Tor puts a target on you, as much as you can. > [@Sprout3425](#): > > When should a VPN be used, exactly? Always > [@Sprout3425](#): > > Is it recommended to use their real name or a fake name or initials? Depends on where you live. In some countries the orders will never arrive with a fake name. > [@Sprout3425](#): > > How can people avoid receiving unencrypted order confirmation emails that contain their personal data? You can’t. > [@Sprout3425](#): > > Is it better to use Bitwarden’s extension or web vault? The extension. > [@Sprout3425](#): > > The trade off here seems to be between fingerprintability It’s only fingerprintable on Chromium browsers. Simply use a separate browser profile for logins. > [@Sprout3425](#): > > Is it a good practice to register all online accounts to a single Proton Mail account using aliases, or should different email addresses be used? Aliases. Never give away your real email. > [@Sprout3425](#): > > What are some ways that people can deanonymize themselves online? There are a zillion ways. > [@Sprout3425](#): > > What is the best alternative for multi-factor authentication (MFA) if physical keys are not convenient? Is TOTP the next best option? TOTP is not great, because it doesn’t provide protection against phishing or evilginx. Security keys or passkeys are the way to go. > [@Sprout3425](#): > > Is Thunderbird hardening recommended? Yes > [@Sprout3425](#): > > Should sending emails and registering accounts be limited to personal computers, or can this be done equally safely on mobile devices? Android and iOS are much safer against malware than your personal computer. > [@Sprout3425](#): > > - Can changing settings within a search engine like DuckDuckGo affect fingerprintability? No. But it’s recommended to not have persistent data in your browser, so your settings are gone on next start anyway. --- ## Post 13 by @PrivacyAintReal — 2024-01-17T15:36:53Z I’d love for everyone who believe VPN should always be used to back up their claims. Lets say I have a Gmail, or Facebook account. The second I log on a VPN they still know who I am. For VPN to obscure your privacy you’d need to restart your entire online life.. The only reason to go all in VPN is if you live somewhere where your ISP is less trustworthy than the myriad of VPNs out there. --- ## Post 14 by @sha123 — 2024-01-17T15:58:11Z > [@PrivacyAintReal](#): > > I’d love for everyone who believe VPN should always be used to back up their claims. IP is an important data point and VPNs have barely any usability disadvantages. > [@PrivacyAintReal](#): > > Lets say I have a Gmail, or Facebook account. The second I log on a VPN they still know who I am. Sure, but they might not be able to track you cross-site with the help of your IP, because you share the VPN IP with many others --- ## Post 15 by @jonah — 2024-01-17T16:05:06Z > [@wojciechxtx](#): > > There are instances where PG is simply wrong. …such as? --- ## Post 16 by @overdrawn98901 — 2024-01-17T16:36:02Z Lots of good answers, so I’ll also throw in my two cents as well. I think what you are having difficulty with is assessing a [threat model](https://en.wikipedia.org/wiki/Threat_model) for yourself. In short, how much privacy is good enough for you? I don’t think there is such a thing as 100% privacy, even in the real world. With this, you’ll want to understand the implications of what choices to make or what not to make. This also comes with understanding the technology, which can be overwhelming to newcomers. With this, here is a great article to read on [MDN](https://developer.mozilla.org/en-US/docs/Web/Privacy) which should answer a lot of questions for you about the tech. And remember Security is not the same as Privacy, you can achieve both independently, sometimes together. Lastly, a lot of these questions are about not fully understanding the technologies. This is definitely hard for newcomers, and I don’t have a solution to this. > When is it advisable to use **Tor**? Having three browsers (Firefox, Mullvad and Tor) seems redundant. Different browsers for different purposes. Tor Browser is maximum privacy, but a lot of websites will block you. To get around that, you’ll need a backup browser if there are sites you wish to interact with (Firefox or Mullvad Browser generally). Firefox is less unique than Mullvad Browser (fingerprinting is slightly harder), but doesn’t have as good of privacy configurations out of the box. Honestly any option is better than chrome imo. > When should a VPN be used, exactly? PG says: it is useful when anonymity is needed, but when is anonymity needed in the first place? You’ll have to answer this yourself. In general, if you are accessing sites using HTTPS (HTTP Secure, or encrypted), then most of your web traffic is encrypted to and from the website. However, its decrypted on the website, and all of the metadata of the request can be read from the site. Even then, sites can give you JavaScript which can pull even more information about your device and location. The VPN’s paid for your use case (there are different use cases for VPNs) will route **all** of your traffic through a different computer essentially, obscuring your location. This doesn’t necessarily protect your from other tracking methods like cookies. Personally, VPNs don’t have to be your first step in privacy, and are slightly overhyped in my opinion. Great for security on unsecure networks like public WiFi, but there better first free options to anonymizing yourself. I’d say pay for a VPN once you understand the use case for it. > How should people handle their personal information for online orders? Is it recommended to use their real name or a fake name or initials? You’ll want to read up on data laws regarding how people can store their information. In general, the worst case in these scenarios (I believe) are the following: 1. Merchant sells your data. Bigger concern for big companies like Amazon, not as concerning for small business. They may use some sort of analytics, but its often just reporting. 2. [Data breaches](https://haveibeenpwned.com/PwnedWebsites). Largest concern in my opinion, and the worst is getting leaking metadata on your name, phones, e-mails, and password hashes. Definitely annoying, and I had to shut down one of my e-mails as too many websites have been associated with breaches. If your online threat model doesn’t allow then, then you should be going to stores and paying in cash. Keep in mind Credit Card companies probably sell every ounce of metadata you are worth, but its a price of convenience. > How can people avoid receiving unencrypted order confirmation emails that contain their personal data? Pretty much impossible. But again, whats your threat model? Are you worried someone has breached our e-mail secretly and is monitoring all of your e-mails? That some high class level attacks (if you’ve secured your accounts), you probably don’t need to worry about that. Worried that Gmail is analyzing your emails or something? Switch to a paid e-mail provider, there are suggestions in the guide. > Is it recommended to use a VPN when purchasing online, even when using a real-life identity? PG says: ‘Using a VPN in cases where you’re using your real-life or well-known identity online is unlikely be useful,’ and ‘When purchasing online, ideally you should do so over Tor.’ However, PG also suggests using a VPN before connecting to Tor. This seems contradictory, and may require further clarification. This is confusing and should be clarified. I think understanding how [Tor and VPN](https://www.comparitech.com/blog/vpn-privacy/tor-vs-vpn/) works will give you a better idea. In general, they recommend a VPN before Tor, so that if someone traces your entry Tor Node, its the VPN. This isn’t about identity, its about security. I think the “Using Tor when purchasing online” should be explained further. > What are some good Firefox extensions to enhance privacy and security? **uBlock Origin** on ‘medium mode’ and **Skip Redirect** are recommended by uBlock and Arkenfox, as extensions. Security \<\> Privacy. More extensions, the more unique your fingerprint, but the more likely you can block malicious content. uBlock Origin is the only one you need in my opinion as the best bang-for-buck for privacy + security. > Is it better to use Bitwarden’s extension or web vault? The trade off here seems to be between fingerprintability, and convenience + phishing protection. Is [addy.io](http://addy.io) more effective as a website or a browser extension? Its a tradeoff. I go for convenience, and have the web extension. > Is it a good practice to register all online accounts to a single Proton Mail account using aliases, or should different email addresses be used? Depends on your threat model. This usually goes back to if companies will sell your data, how much of that you want tied back to specific IP address if used, and so on so forth. Using aliases is likely the best bet. > What are some ways that people can deanonymize themselves online? PG says: ‘We know people can quite easily deanonymise themselves in a number of ways, e.g.: Reusing personal information (e.g., email accounts, unique pseudonyms, etc.) that they accessed without anonymity software (Tor, VPN , etc.).’ What does this mean, and how can it be prevented? Deanonymize means to no longer be anonymous. There are cases where even if you use all the privacy respecting tech, proclaiming your name is John Doe living at 123 Street is gonna ruin the purpose of that. > Is **Orbot** recommended as a VPN on iOS, the problem is it is unusably slow, so shouldProtonVPN be used? I haven’t used Orbot. I generally don’t like to trust free VPNs (whats in it for them?), so I pay for mine. Don’t use free VPNs. > What is the best alternative for multi-factor authentication (MFA) if physical keys are not convenient? Is TOTP the next best option? Depends on your threat model. I have a specific system and redundancy (backup options so I don’t get locked out). - I have Raivo TOTP on my phone. Only used for Bitwarden. - I have a backup physical key to unlock Bitwarden in case my phone explodes. - All other TOTP is in Bitwarden. > Is Thunderbird hardening recommended? Is this a one-time process or does it require regular updates? One time process, so I’d just recommend doing it. Feel free to double check its still configured after major updates though. > Which iOS email client is more suitable for a non-Proton email account: Apple Mail or Canary? Is Canary’s encryption worth paying for? I use Apple Mail, as I don’t use non-Proton email for anything I don’t want leaked. > What is the purpose and benefit of OpenPGP (answer: email encryption), and how can it be used? What is Mailvelope (still not entirely sure) and why is it listed in the email clients section? Email is sent in plaintext and is the “HTTP” of email. OpenPGP is like the HTTPS of e-mail. Problem is, most people don’t use it. This goes down to your threat model - is it a problem that your e-mails are unencrypted? What are you specifically worried about? > What is the _best_ way emails can be encrypted from sender to receiver, even if one or both parties don’t use a privacy-oriented email service provider? Can Thunderbird (an email client) enhance the privacy of email addresses that don’t support encryption by default? Encrypted e-mails using OpenPGP is the point - even the email service provider can’t read it. You can technically manually encrypt/decrypt emails, so the email provider isn’t the problem. Again, its the threat model - what are you specifically trying to prevent in this scenario? > Should sending emails and registering accounts be limited to personal computers, or can this be done equally safely on mobile devices? E.g., is it safer to use Proton mail + SimpleLogin on a PC rather than on an iPhone? Depends on your threat model. This is more a security question. If you are looking for privacy, then I’d say iPhone is probably better than Windows, but its still proprietary. > Are Picocrypt and VeraCrypt redundant if BitLocker is already used on Windows 11? From my understanding, Picocrypt (used for encrypting single files) is not redundant, since full-disk encryption slows down some actions in the computer, such as file organisation. What is the use case for Cryptomator? Is it possible to encrypt files using any other method and then upload them to Proton Drive? This is more-so a security issue. Single file encryption != full drive encryption. Single file encryption has different use cases than full drive encryption. Full drive encryption is useful is someone steals your computer, than cannot arbitrarily read everything you have stored (i’ve recovered data easily from computers that were unencrypted); however, if your computer is left unlocked or a hacker has the password, they can read everything. Single file encryption is just that - even if a hacker stole your computer, knows your computer password, the single file encryption is used with a different password, so that is a whole separate issue to crack it. You can also pass around the encrypted file anywhere - email, copy it on an enencrypted drive - the works, and it’ll be secure so long as your password is secure. > How can passwords in Bitwarden be backed up securely? Is it better to export, encrypt, and save them on Proton Drive using Cryptomator, or on a separate encrypted hard drive using BitLocker? This is more-so security. Bitwarden will export plaintext in some form. You definitely should encrypt the information in some manner. This depends on your threat model - if you upload to Proton Drive in plain text (which is encrypted on their server), how paranoid are you that someone is going to breach your Proton Drive? Encrypting the file then uploading to Proton Drive is extremely secure, just don’t lose the password to the backup file. - Can changing settings within a search engine like DuckDuckGo affect fingerprintability? This goes to understanding how Cookies work. I’d recommend reading up on then. Might not be an issue. If this is an issue, use a privacy respecting search engine like SearXNG. > What is self-hosting, and what are its pros and cons? From my understanding, web servers are used to provide people with services when people make requests for them, self-hosting is the act of using a private web server. In short, I have a computer (server) running in my closet with Linux installed that runs services through a VPN. I own the computer, I know exactly what it does (ignoring the rabbit hole of Intel ME or LibreBoot stuff). I own it. If I want to use the same service hosted by another entity, its running on **their** computers doing whatever it is they do. How do I know they aren’t tracking me? Again, this comes down to threat model - typically, most people are fine with renting out a VPS from someone else to do their hosting, and its perfectly acceptable. As the saying goes: `There is no cloud, just someone else's computer`. Is it worth the hassle? Depends… if you aren’t interested in setting up and maintaining a server, its going to become quite the side project. But its very rewarding once you get it working. > What is the role of the “Router Firmware” page? Is it necessary to install such firmware? What does this software do? Does it allow changing the DNS settings on a wireless router? Depends on your threat model. Do you trust the router firmware running is not doing anything malicious? In general, I’d recommend ditching whatever your ISP gives you, and buy your own router. Then, > In general\*\*, some PG tool recommendations are vague or incomplete, e.g., the function of the tools and whether they are essential or optional for most users, needs to be explained more clearly. This is a hard issue for newcomers, and I think privacy guides could improve in this - explaining the tech and pros/cons a bit more. Its a hard transition to wanting to gain privacy and also learning how basic networking works. As always, feel free to correct me. --- ## Post 17 by @jonah — 2024-01-17T17:06:49Z > [@Sprout3425](#): > > **In general** , some PG tool recommendations are vague or incomplete, e.g., the function of the tools and whether they are essential or optional for most users, needs to be explained more clearly. > [@overdrawn98901](#): > > This is a hard issue for newcomers, and I think privacy guides could improve in this - explaining the tech and pros/cons a bit more. Its a hard transition to wanting to gain privacy and also learning how basic networking works. This is true. Well to give you some context, the idea behind the recommendations specifically is that they’re for people who are _already_ looking for a specific tool, like “I know I really need a notebook, but I don’t know which one,” and then they can read [https://www.privacyguides.org/en/notebooks/](https://www.privacyguides.org/en/notebooks/). It’s not meant to be read like “Privacy Guides has a notebook section, so I guess I need to start using this notebook software now!” So with that in mind… really **none** of the tools are “essential.” Except perhaps tools that are recommended in the Knowledge Base section, but in that case we _do_ explain why we generally consider them to be essential, like when we say [you should almost certainly use a VPN](https://www.privacyguides.org/en/basics/vpn-overview/#should-i-use-a-vpn) and have a whole page about why. **TL;DR:** if a tool isn’t mentioned in the knowledge base it is not essential. * * * **All this being said…** we definitely can still improve on this problem anyways, probably something I’ll work on this year. --- ## Post 18 by @PrivacyAintReal — 2024-01-17T17:55:15Z > [@sha123](#): > > Sure, but they might not be able to track you cross-site with the help of your IP, because you share the VPN IP with many others Third party cookies won’t give a shit if you’re at your home address one day and VPN the other day. VPN is only effective if you wipe out your online existence and never accidentally connect without it again - on an account linked to your identity prior. I’m sorry youtubers have made everyone think VPN is a necessity. If you’re serious about privacy to the point of exclaiming VPN is a must have - connect to TOR and never leave. But we all have to find a middle ground right? Concealing your online identity is a full time job. Especially if you’re not already well versed about how everything works. Paying for services that claim to protect you often come with pitfalls. --- ## Post 19 by @sha123 — 2024-01-17T18:07:24Z > [@PrivacyAintReal](#): > > Third party cookies won’t give a shit if you’re at your home address one day and VPN the other day. Which private browser doesn’t block or partition third-party cookies? --- ## Post 20 by @overdrawn98901 — 2024-01-17T23:48:51Z I provided an MDN link that has some basic info on security and privacy. I’m thinking a beginners guide (single page with a link on the home page) to technology, like that MDN link, and explain what it does and impact would be great. As a power user, I prefer the quick recommendations as a jumping off point, but without pre requisite knowledge, it definitely feels like deep waters. I’d warn about suggesting the knowledge base being the single source of truth as the only essential tools - not that liability is a concern, but everyone should do additional research for their own use case, as technology, privacy, and security are a moving target. --- ## Post 21 by @Sprout3425 — 2024-01-18T00:27:09Z Thank you Jonah, understood. Some of the essential tools discussed in the knowledge base, happen to be in the recommended tools section and they are explained more in detail, as you go down to the bottom of the recommended tools section, the explanations become less present. So, this clarifies why. Thanks again. --- ## Post 22 by @Sprout3425 — 2024-01-18T00:28:35Z Well said, thanks @overdrawn98901! --- ## Post 23 by @Sprout3425 — 2024-01-18T00:36:31Z Thanks @sha123 as always, so I have learnt to, ideally: - Use a VPN always, except for when my internet connection is a critical factor, like doing an online exam or gaming. - Use Tor whenever I can, although Tor is really slow, so this would not be good for productivity. - For online shopping, perhaps I could truncate my last name as an initial, and spell put my first name, in Australia, I have had no issues with this, the post men never check your name they just leave the parcel at your front door without knocking. - I can’t avoid unencrypted order confirmation emails. Bummer. Seems like a huge hit to privacy. - Always use email aliases. - Use passkeys \> TOTP - Harden Thunderbird. However, I don’t know whether this will require updating like Arkenfox. - Feel free to send email and register for accounts on smart phones as they are safer than personal computer against malware. In regards, to using Bitwarden as an extension you say: > [@sha123](#): > > It’s only fingerprintable on Chromium browsers. Simply use a separate browser profile for logins. Could you expand on what you mean and how to accomplish this? --- ## Post 24 by @Sprout3425 — 2024-01-18T00:40:45Z > [@overdrawn98901](#): > > Different browsers for different purposes. Tor Browser is maximum privacy, but a lot of websites will block you. To get around that, you’ll need a backup browser if there are sites you wish to interact with (Firefox or Mullvad Browser generally). Firefox is less unique than Mullvad Browser (fingerprinting is slightly harder), but doesn’t have as good of privacy configurations out of the box. Honestly any option is better than chrome imo. Interesting, you seem to be implying that by configuring Firefox it becomes more private than Mullvad browser, making Mullvad redundant. _Cover Your Tracks_ seems to corroborate what you are saying. --- ## Post 25 by @overdrawn98901 — 2024-01-18T01:03:11Z Ironically, configuring Firefox to be more private can make it less private. If you change certain settings in a way that makes you unique, albeit stopping tracking, you may gain a more unique fingerprint. Others may have different recommendations, but I’d say Firefox with Ublock Origin, and that’s all, would be the best option. > - Feel free to send email and register for accounts on smart phones as they are safer than personal computer against malware. I wouldn’t use the term personal computer. I would start referring to specific Operating Systems. Using Linux on a computer is likely way more privacy respecting than iOS or default Android. Sorry to be pedantic, but **safer** isn’t the right word you are looking - all methods would be generally safe and secure. Its likely more **private** in your scenario. A smart phone is just a type of computer, what its running is generally what we worry about. > - I can’t avoid unencrypted order confirmation emails. Bummer. Seems like a huge hit to privacy. Meh, just opt out of e-mail of what you can. If your data is sent to a trusted email server, I don’t think you’d have a privacy loss (considering the business already has the info). > - For online shopping, perhaps I could truncate my last name as an initial, and spell put my first name, in Australia, I have had no issues with this, the post men never check your name they just leave the parcel at your front door without knocking. Definitely! This is a case where simple free things can lead to quick small privacy gains. --- ## Post 26 by @Sprout3425 — 2024-01-18T01:07:42Z # Key takeaway: It seems the optimal solution is for people to understand the technology better. This is why I think this should be a key focus for the developers of this site. Thanks to @overdrawn98901 I have got one resource to help me accomplish this, are there any other recommended resources? I have been recommended the _Hitchhiker’s Guide to Privacy_ as well, along with other resources in my post here: [Data Privacy and Security Educational Resources - #5 by Paranoia](https://discuss.privacyguides.net/t/data-privacy-and-security-educational-resources/16067/5). > [@overdrawn98901](#): > > Personally, VPNs don’t have to be your first step in privacy, and are slightly overhyped in my opinion. Great for security on unsecure networks like public WiFi, but there better first free options to anonymizing yourself. I’d say pay for a VPN once you understand the use case for it. I am using Proton VPN for free, it seems to work fine, would you suggest paying for it? Regardless, I already have access to a VPN and from what you said, it appears that I should be using one, especially on public networks. > [@overdrawn98901](#): > > Pretty much impossible. But again, whats your threat model? Are you worried someone has breached our e-mail secretly and is monitoring all of your e-mails? That some high class level attacks (if you’ve secured your accounts), you probably don’t need to worry about that. Worried that Gmail is analyzing your emails or something? Switch to a paid e-mail provider, there are suggestions in the guide. If these order confirmation details are not E2EE, doesn’t this mean that any of the infrastructure relaying the message in the middle of the pathway (sender to receiver), will be able to see the contents of this email, and if they are breached all my information could be stolen? > [@overdrawn98901](#): > > Security \<\> Privacy. More extensions, the more unique your fingerprint, but the more likely you can block malicious content. uBlock Origin is the only one you need in my opinion as the best bang-for-buck for privacy + security. So, you reckon I ditch skip redirect? I then I will probs use Bitwarden extension for convenience. > [@overdrawn98901](#): > > I haven’t used Orbot. I generally don’t like to trust free VPNs (whats in it for them?), so I pay for mine. Don’t use free VPNs. Afaik, the Tor project themselves recommend Orbot. I am using Proton VPN for free, as for what is in it for them, under their freemium model, potential subscribers is what is in it for them, plus I assume it’s like bait, they want to reel customers in. > [@overdrawn98901](#): > > - I have a backup physical key to unlock Bitwarden in case my phone explodes. How does this work? > [@overdrawn98901](#): > > One time process, so I’d just recommend doing it. Feel free to double check its still configured after major updates though. > [@overdrawn98901](#): > > This is more-so a security issue. Single file encryption != full drive encryption. Single file encryption has different use cases than full drive encryption. Full drive encryption is useful is someone steals your computer, than cannot arbitrarily read everything you have stored (i’ve recovered data easily from computers that were unencrypted); however, if your computer is left unlocked or a hacker has the password, they can read everything. Single file encryption is just that - even if a hacker stole your computer, knows your computer password, the single file encryption is used with a different password, so that is a whole separate issue to crack it. You can also pass around the encrypted file anywhere - email, copy it on an enencrypted drive - the works, and it’ll be secure so long as your password is secure. Interesting… Thanks for clarifying this!!! Key takeaways I got from your detailed reply which I truly appreciate: - Preferably, go to stores and pay with cash. - Use email aliases, for everything? Including important stuff like bank accounts … Wherever allowed. I noticed Apple would not allow me to use an [addy.io](http://addy.io) alias for my Apple ID. - Use Apple Mail over canary for non-proton mail accounts. - After reading up on OpenPGP it looks like you need two people to use it, and it is a hassle, so it seems I should forget about it for now. However, OpenPGP is the best way to encrypt emails. - Buy a new router. Sigh, this will likely be very beneficial (improving itnernet speeds + privacy), but expensive money and time wise. One question that remains unanswered is whether using a client like thunderbird or outlook is different privacy-wise, when using a non-proton mail email account. Again, thanks to you and sha123, for clarifying a lot of my questions!!! --- ## Post 27 by @Sprout3425 — 2024-01-18T01:08:51Z > [@overdrawn98901](#): > > Ironically, configuring Firefox to be more private can make it less private. If you change certain settings in a way that makes you unique, albeit stopping tracking, you may gain a more unique fingerprint. Others may have different recommendations, but I’d say Firefox with Ublock Origin, and that’s all, would be the best option. So, do you recommend settings up Firefox like PG recommends, minus using arkenfox, and use only ublock + bitwarden? --- ## Post 28 by @Sprout3425 — 2024-01-18T01:11:03Z > [@overdrawn98901](#): > > I don’t think you’d have a privacy loss (considering the business already has the info). Sorry, to clarify, wdym by they already have the info? > [@overdrawn98901](#): > > Meh, just opt out of e-mail of what you can. Doesn’t this mean they will text message me, which is equally not-private? --- ## Post 29 by @overdrawn98901 — 2024-01-18T01:20:29Z > [@Sprout3425](#): > > Sorry, to clarify, wdym by they already have the info? If you provide your first name, last initial, e-mail address, and shipping address, they already have plenty of data to expose your privacy technically. A confirmation e-mail isn’t going to pwn you, the business already has full power to do so if they choose. But we generally trust business not to do that, and we have laws to protect us from that (somewhat). > [@Sprout3425](#): > > Doesn’t this mean they will text message me, which is equally not-private? I’ll refer to what I’ve been saying - depends on your threat model. If a confirmation e-mail or SMS message is going to pwn you, then don’t do online shopping. Otherwise, mostly everyone agrees this isn’t a significant enough risk. I think there have been plenty of answers in this thread to help you along - I think you should start asking yourself not **is this 100% private** but rather **is this private enough for me**. So let me ask you, is a confirmation e-mail or text message not private enough for you? --- ## Post 30 by @overdrawn98901 — 2024-01-18T01:33:52Z Just saw there are more questions, I’ll answer a few more. > I am using Proton VPN for free, it seems to work fine, would you suggest paying for it? Regardless, I already have access to a VPN and from what you said, it appears that I should be using one, especially on public networks. Proton VPN is a rare case that I would trust, as Proton Mail is a generally trustworthy company imo. > If these order confirmation details are not E2EE, doesn’t this mean that any of the infrastructure relaying the message in the middle of the pathway (sender to receiver), will be able to see the contents of this email, and if they are breached all my information could be stolen? Someone would have to intercept the confirmation e-mail as its transmitting and snoop on it through some means. If you’ve got the NSA level ghosts hacking Gmail or requesting Google to to listen on your confirmation e-mails, you’ve already lost and you should probably leave the country. > Afaik, the Tor project themselves recommend Orbot. I am using Proton VPN for free, as for what is in it for them, under their freemium model, potential subscribers is what is in it for them, plus I assume it’s like bait, they want to reel customers in. In that case, I trust Tor and their recommendation, so go ahead with Orbot as well if you want. > How does (physical key) work? [Read Bitwarden Docs](https://bitwarden.com/blog/how-to-use-security-keys-with-bitwarden/) - PS. doing a quick google search before asking is generally polite. > - Buy a new router. Sigh, this will likely be very beneficial (improving itnernet speeds + privacy), but expensive money and time wise. Don’t have to do everything all in one go! To start, log into your current router and change the DNS to another one. Boom, you’ve gained some small experience in configuring routers. > One question that remains unanswered is whether using a client like thunderbird or outlook is different privacy-wise, when using a non-proton mail email account. Outlook sends a lot of information about what you do to their servers, Thunderbird does not. All in all, just don’t use Outlook unless your job makes you. --- ## Post 31 by @Sprout3425 — 2024-01-18T01:34:21Z > [@overdrawn98901](#): > > If you provide your first name, last initial, e-mail address, and shipping address, they already have plenty of data to expose your privacy technically. A confirmation e-mail isn’t going to pwn you, the business already has full power to do so if they choose. But we generally trust business not to do that, and we have laws to protect us from that (somewhat). Yeah, but don’t they have to relay that information to another server before it gets to me? --- ## Post 32 by @Sprout3425 — 2024-01-18T01:36:21Z > [@overdrawn98901](#): > > [Read Bitwarden Docs](https://bitwarden.com/blog/how-to-use-security-keys-with-bitwarden/) - PS. doing a quick google search before asking is generally polite. Fair enough. :rofl: I just found it fascinating how on Earth a physical key could do anything once your phone explodes. --- ## Post 33 by @Sprout3425 — 2024-01-18T01:37:50Z > [@overdrawn98901](#): > > Don’t have to do everything all in one go! To start, log into your current router and change the DNS to another one. Boom, you’ve gained some small experience in configuring routers. Already tried, my router does not allow me to do this, using the web UI. --- ## Post 34 by @Sprout3425 — 2024-01-18T01:38:50Z To stop bothering everyone with questions, I think people in my shoes, including myself should read the answers here, and the recommended resources provided within those answers. However, I am noting discrepancies between peoples’ feedback, which does make everything more confusing. Moreover, direct answers are always appreciated, and their value cannot be understated. --- ## Post 35 by @overdrawn98901 — 2024-01-18T01:42:08Z > [@Sprout3425](#): > > Yeah, but don’t they have to relay that information to another server before it gets to me? Business ↔ Gmail Business (server) ↔ Your Email Server ↔ You The above are areas of trust. If you want to play “Do I trust the entity” ask at each phase “if they can have some of this information, do I care?”. If the business decides they want to give all your information to fliers to everyone on the corner, e-mail doesn’t matter. Google engineers won’t access the confirmation e-mail, there are millions on millions, but at best they might pull metadata on it. Or a government entity could cease the e-mails. If that’s a concern for you, don’t shop online ever. If you don’t trust your e-mail server, then you can change them (or be crazy enough to host your own - seriously I don’t recommend that). You can only control your e-mail server, how you communicate to your e-mail server (Tor, VPN, etc), and whether or not you decide to do business in this scenario. If you are worried about someone intercepting the information between the business and the gmail server to your server, you are at a threat level where you should never have done business in the first place. --- ## Post 36 by @overdrawn98901 — 2024-01-18T01:46:50Z > [@Sprout3425](#): > > However, I am noting discrepancies between peoples’ feedback, which does make everything more confusing. I think the hard part is always going to be that the level of privacy matters differently for different people. I’m a bit more lax, and enjoy tinkering with self-hosting certain things, and I’m absolutely not doing everything I can. It will come down to understanding the technology, the implications of the choices you make, and what you are comfortable with. Once you understand how to navigate the waters, I think you’ll find that you’ll have different opinions on whats good enough as well. --- ## Post 37 by @anon21489307 — 2024-01-18T08:19:20Z > [@PrivacyAintReal](#): > > if you’re at your home address one day and VPN the other day. > > VPN is only effective if you wipe out your online existence and never accidentally connect without it again - on an account linked to your identity prior. Agreed, most people connect to VPN on demand (for media steaming services). And most do not carry around many devices, hence there’s no real kill switch, as their banks probably don’t happy with VPN. Therefore, they toggle VPN on and off as needed, and with all online accounts intact. I could be wrong, but VPN is most likely useless for any real threat other than to stream foreign movies/TV shows that’s not available in the residency country. It may also prevent a surveillance from ISP, though. > [@overdrawn98901](#): > > Ironically, configuring Firefox to be more private can make it less private. If you change certain settings in a way that makes you unique, albeit stopping tracking, you may gain a more unique fingerprint. Others may have different recommendations, but I’d say Firefox with Ublock Origin, and that’s all, would be the best option. I could be wrong, but regarding fingerprint issue, would it be better to use Brave instead of Firefox + uBlock Origin, since **[Brave has 50 million _monthly active users_ as of Jan 2022](https://brave.com/2021-recap/)**, while [uBlock Origin only has all time 7.5 millions users downloaded](https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/)? --- ## Post 38 by @PrivacyAintReal — 2024-01-18T11:10:05Z > [@anon21489307](#): > > It may also prevent a surveillance from ISP, though. This is the MAIN point of using a (paid) VPN for privacy reasons. Especially so if you happen to live under a facist regime or dicator ruled shite hole of a country. Somehow the people who say VPN is a must have and should always be used never really explain why. I’m using Mullvad myself for torrents and to visit pages that are blocked for europe. But to preserve your privacy online (assuming you’ve a decent ISP) it’s far down the list of actions to take. If you’re running android or windows with an online account you’ve given up your privacy long time ago and attempts to “fix” it without making yourself a new online presence is futile. --- ## Post 39 by @Sprout3425 — 2024-01-18T11:37:19Z I agree, except for the fact if you cease giving away your information, you haven’t “given up your privacy” they might know what you did in the past, but not what you are doing now. My two cents. --- ## Post 40 by @wojciechxtx — 2024-01-18T11:45:42Z > [@overdrawn98901](#): > > Proton VPN is a rare case that I would trust, as Proton Mail is a generally trustworthy company imo. There is no such company like ProtonMail anymore, they are now just Proton AG. > [@overdrawn98901](#): > > Orbot Orbot is developed by the same people as Tor itself. > [@overdrawn98901](#): > > doing a quick google search before asking is generally polite. While this is generally true, its not forbiden to ask. > [@overdrawn98901](#): > > All in all, just don’t use Outlook unless your job makes you. In this case, just change job. > [@Sprout3425](#): > > I just found it fascinating how on Earth a physical key could do anything once your phone explodes. Exactly :slight_smile: Thats what BitWarden is worth… Nothing. > [@Sprout3425](#): > > my router does not allow me to do this, using the web UI. Im more than sure that every decent router has the ability to change DNS somewhere. > [@overdrawn98901](#): > > I think the hard part is always going to be that the level of privacy matters differently for different people. Exactly. Second this :slight_smile: > [@anon21489307](#): > > Agreed, most people connect to VPN on demand Dont really know whats other way of connecting; you always have to perform some kind of action. > [@anon21489307](#): > > regarding fingerprint issue, would it be better to use Brave instead of Firefox Not true at all. Brave fingerprints user left&right without even hinting. > [@PrivacyAintReal](#): > > This is the MAIN point of using a (paid) VPN for privacy reasons +1 > [@PrivacyAintReal](#): > > Somehow the people who say VPN is a must have and should always be used never really explain why. Because not all of VPN users are IT guys with indepth technical knowlege how things run under-the-hood… > [@PrivacyAintReal](#): > > If you’re running android or windows with an online account you’ve given up your privacy long time ago and attempts to “fix” it without making yourself a new online presence is futile. Not necesarily… > [@Sprout3425](#): > > they might know what you did in the past, but not what you are doing now. Exactly this :slight_smile: --- ## Post 41 by @PrivacyAintReal — 2024-01-18T12:18:45Z > [@wojciechxtx](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/privacyaintreal/48/14_2.png) PrivacyAintReal: > > > If you’re running android or windows with an online account you’ve given up your privacy long time ago and attempts to “fix” it without making yourself a new online presence is futile. > > Not necesarily… > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/sprout3425/48/8_2.png) Sprout3425: > > > they might know what you did in the past, but not what you are doing now. > > Exactly this :slight_smile: Fair point. Atleast when it comes to Windows. --- ## Post 42 by @overdrawn98901 — 2024-01-18T13:36:17Z > [@wojciechxtx](#): > > In this case, just change job. That is a privilege not everyone can just do on a whim, or even care if it’s only on a work device. --- ## Post 43 by @wojciechxtx — 2024-01-18T14:12:12Z @overdrawn98901 Few things here: > [@overdrawn98901](#): > > privilege Why do you call privilege what should be right to work/do a job? Unless you are forced to do certain job you are free to choose whatever job you like/want/desire etc. Well, Im well aware that, especially these days, its not an easy task to switch jobs on-the-fly (during 1-2 days), but still, changing jobs is doable. > on a whim Nowhere did I say that changing jobs should/have to be done on a whim. --- ## Post 44 by @overdrawn98901 — 2024-01-18T14:43:21Z Hmmm, I wouldn’t say you are entirely wrong. I just there is sometimes nuance in that changing jobs is much higher effort and can’t be done today, and not always possible for some people in any short term. Sometimes life is using privacy countermeasures to handle shitty situations we can’t remedy today. --- ## Post 45 by @anon21489307 — 2024-01-18T16:18:18Z > [@PrivacyAintReal](#): > > This is the MAIN point of using a (paid) VPN for privacy reasons. Especially so if you happen to live under a facist regime or dicator ruled shite hole of a country. In those countries, the government can get access to all the users info very easily, sometimes even without court order (the law stipulates that a certain government organization has the power to access all the info all the time). My point is that you would need to hide from _both_ the ISP and every company registered in the country, which usually includes Facebook, Google, Apple, Microsoft, TikTok, etc. Otherwise, the use of VPN (on demand) is pretty much useless against the government threat. > [@wojciechxtx](#): > > Not true at all. Brave fingerprints user left&right without even hinting. The point is not about Brave alone, but whether it’s better when comparing to Firefox, which is much worse OOTB without uBlock Origin, etc. This is why Firefox has been critiqued for years that it’s not really a privacy browser. --- ## Post 46 by @overdrawn98901 — 2024-01-18T22:38:17Z I support Firefox for the sole purpose it’s the last remaining non chromium based browser. For the US, if usage falls below 5% or something, than the US government doesn’t require support for it (and many would follow suit). That would be a slice to the Achilles tendon for Firefox imo, and a sad day for everyone. --- ## Post 47 by @wojciechxtx — 2024-01-18T23:44:22Z > [@overdrawn98901](#): > > I support Firefox for the sole purpose it’s the last remaining non chromium based browser Exactly :slight_smile: --- ## Post 48 by @Sprout3425 — 2024-01-19T11:12:37Z I think the fact that Tor uses Firefox, gives FF credibility. --- ## Post 49 by @exaCORE — 2024-01-20T02:42:14Z Firefox has credibility even without tor. Mozilla is a reputable organization that has a long history of advocating for privacy and making privacy respecting products (as well as other software such as the Rust programming language) --- ## Post 50 by @Sprout3425 — 2024-04-08T05:32:55Z ~~I don’t mean to revive a dead topic, but @PrivacyAintReal is this not true:~~ > [@Sprout3425](#): > > ~~`When should a VPN be used, exactly? PG says: it is useful when anonymity is needed, but when is anonymity needed in the first place?` > A: When you don’t want a website to know your IP address (rough physical address). This is why this is basically always the ideal, but internet performance is reduced. Less useful if the website already knows your address, but still useful in this case to prevent cross-site tracking, because if someone has access to your request/device info across sites [IP addresses], and you use this same IP address across more than one of these sites, they will be able to piece together and tie the information across the sites to your IP [or other info, the more info, the more variables by which they can distinguish you by], based on info that you [defined by your IP] have provided on other sites, allowing them to build a profile on you).~~ ~~However (the following are all assumptions), it still prevents surveillance from your ISP, so it would still be good to have it on the majority of the time, with a kill-switch.~~ Furthermore, VPNs could provide protection from outsiders (e.g., hackers, outside of the website you are visiting, your ISP) trying to spy on your network traffic, assuming they haven’t hacked the website you are visiting themselves. ## My apologies for partly beating a dead horse and reviving this post, as you have already addressed all of this here: > [@PrivacyAintReal](#): > > This is the MAIN point of using a (paid) VPN for privacy reasons. Especially so if you happen to live under a facist regime or dicator ruled shite hole of a country. > > Somehow the people who say VPN is a must have and should always be used never really explain why. > > I’m using Mullvad myself for torrents and to visit pages that are blocked for europe. But to preserve your privacy online (assuming you’ve a decent ISP) it’s far down the list of actions to take. > > If you’re running android or windows with an online account you’ve given up your privacy long time ago and attempts to “fix” it without making yourself a new online presence is futile. and here: > [@PrivacyAintReal](#): > > I’d love for everyone who believe VPN should always be used to back up their claims. > > Lets say I have a Gmail, or Facebook account. The second I log on a VPN they still know who I am. > > For VPN to obscure your privacy you’d need to restart your entire online life… > > The only reason to go all in VPN is if you live somewhere where your ISP is less trustworthy than the myriad of VPNs out there. Reading this again in the future, and this is a huge point, if I accidentally connect to an account without a VPN, they will know my real IP no matter if I use the VPN or not again, so by wiping out my account, which I think you mean by deleting it and creating a new one, with different info from the previous one and with a VPN on 100% of the time when visiting the site, I can combat this. # Final verdict: A VPN actively/in real time, provides security and privacy against people outside of the websites you are visiting, i.e., a hacker or your ISP, and against the websites you are visiting, on the conditions that you have used it on these specific websites 100% of the time you have visited them, and you have used the VPN with a kill switch. However, this is only true, if the website is logging all of your different IP addresses over pretty short intervals, and is able to ascertain your real IP address amongst all the ‘fake’ ones, which should be easy to do by looking at a list of common VPN servers. Although, using a paid VPN with geographically closer servers, would make it a lot harder for a website to differentiate your real IP from your ‘fake’ one(S). A VPN can also prevent cross-site tracking (even if other websites know your IP, future ones you have not yet visited do not). So the final verdict is still: use a VPN as much as you can, except where doing so is inconvenient, and if not using it is safe to do so, i.e., in circumstances when performance is needed. * * * More info from my original post: Here are some assumptions I made: A VPN is used when you don’t want a website or server you are connected to, to know your IP address (rough physical address). A VPN is less useful if the website already knows your address. However, even in this case it can be useful to prevent cross-site tracking, because if someone has access to your request/device info across sites [IP addresses], and you use this same IP address across more than one of these sites, they will be able to piece together and tie the information across the sites to your IP [or other info, the more info, the more variables by which they can distinguish you by], based on info that you [defined by your IP] have provided on other sites, allowing them to build a profile on you). **Thus, even if other websites know your IP, future ones you have not yet visited do not.**