Privacy

36475 readers

241 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

What is your privacy and security setup? How lengthy will you go to protect your privacy and security? Share your setup. (programming.dev)

submitted 5 days ago by Timely_Jellyfish_2077@programming.dev to c/privacy@lemmy.ml

26 comments fedilink hide all child comments

Just wanted to share my setup and see if anyone has suggestions or feedback. Also share yours.

Phone : GrapheneOS(pixel 7a)

No google play service on my main profile. Rethink DNS (NextDNS DoH) blocks ads, trackers, and all Google & Facebook DNS (except WhatsApp).
Some FOSS apps like Aurora Store & NewPipe need Google servers, so I have excluded them in rethink dns.
Work Profile (with Island) with GrapheneOS’ sandboxed Play Services, but I use it maybe once or twice a month only for apps that absolutely need it. It stays turned off most of the time. If an app works on main profile without any issues, will use it. If not, will try to use it in firefox (as lack of play services doesn't matter). If only app is available (and not web version) and it doesn't work on main profile, will use it in work profile.
Hardened Firefox fork(Ironfox) for private browsing. Main Firefox for a few services where I have to stay logged in and don't have apps or want to use their apps.
Network & Sensor Restrictions: If an app works offline, I block its internet access. Also, disabled sensors for apps that don’t need them.
Mostly use foss apps from f-droid(droidify).
Email: moved from gmail to protonmail

PC/laptop: Arch linux kde on pc and fedora kde on laptop.

Not much to say. Most used apps are firefox and Zed. I allow data collection on kde as I want them to improve it.

Home Server: Raspberry Pi 4B

SSH hardening: Non standard ssh port(yes, I opened the port externally because I depend on my home server and need to access it remotely). SSH keys or password+totp, Fail2Ban, ufw.
Services running: Arr setup(jellyfin, prowlarr, radarr,sonarr, qbittorrent), pihole, Immich, Authelia(for now). All data sensitive services behind authelia with totp.
Nginx Geo-blocking: Only allows access from my country IPs
Weekly backups because data loss sucks.

Network & Router: OpenWRT (TP-Link)

Not much to say: Running default firewall rules with network-wide ad/tracker blocking via pihole and some ports opened.

you are viewing a single comment's thread
view the rest of the comments

[–] monovergent@lemmy.ml 3 points 4 days ago* (last edited 4 days ago)

Limitations

Debian with XFCE: I want all of my Linux machines, both older and newer, fast and slow, to be consistent, with the GUI customized to my taste. I accept that I will miss out on whatever security benefits Wayland or distros like secureblue may provide.
Networking: In the grand scheme of things, I know jack shit about networking. OPNsense, Pi-Hole, VPN, etc. would probably help my cause but I have yet to implement many network-based measures.
Corporate conveniences: There are colleagues I need to reach with Whatsapp or SMS and there is software for my job that requires Windows. I try to sequester all of this among my work devices.

All of my frequently-used computers on Linux have "hardened Debian"

hardened to the best of my ability according to Madaidan, with compromises to avoid obstructing day-to-day work
LUKS encryption
MAC randomization
Mullvad DNS
Hyper-threading disabled
Rootless Xorg
Firewall defaulting to deny
unattended-upgrades
LibreWolf
Passwords in KeePass

Personal devices

Desktop: The usual software. Non-FOSS components are mostly gaming-related.
Server: Jellyfin, NAS, Local LLM / Stable Diffusion, and secondary workstation, each hosted on LAN in their own VMs. SSH password authentication disabled. Would like to set up a VPN so I can access it away from home someday.
Backups: weekly to server, which is pulled to an offline encrypted 8TB disk about monthly. Repeat for the off-site disk that I store in a drawer at work.

Phone:

Pixel with GrapheneOS and FOSS apps only
Messaging primarily using Molly (Signal client)
Email from important work and family contacts forwarded to my inbox on PurelyMail
Looking to get a non-KYC eSIM once I learn how to pay in Monero
Mullvad DNS

The "DMZ"

Tablet: Samsung Tab A7 Lite received as a gift. Installed an AOSP GSI ROM (no Google Play services or GApps), mostly used as a NewPipe and travel device.
Laptop: ThinkPad X230 with Coreboot and soft-disabled Intel ME. Also hardened Debian with the usual software, nearly all FOSS components with the exception of intel-microcode and the VGA option BIOS. I say it's the DMZ since personal stuff resides here, but most of my work also ends up here. Logged in to work-related websites and email in a separate user profile for LibreWolf.

"Work" devices (for context, work has BYOD policy and does not provide devices for us to bring home)

Laptop: can't be bothered anymore to fuss with Windows VMs or debloating that go stale twice a year, so I just bring a separate lightweight ThinkPad with full-fat Windows for everything that requires it. While some proprietary software packages support Linux, I'll also just throw the Windows versions on this laptop.
Backup Phone (unused for now): Samsung XCover Pro with removable battery, waiting for the day I encounter apps that demand a stock version of Android. When not in use, the battery is removed.
Occasional check of social media also takes place on one of these devices, though through the browser rather than an app.

Phone:

Old Pixel with GrapheneOS
Nothing I use really needs Google Play services
One user profile for work apps, including proprietary 2FA and Slack
Another user profile for various proprietary apps that aren't necessarily work-related, but that I'm not entirely comfortable having on my personal phone.