GMAIL free life?

[Zucca]

I am not a youtubber (would love to become one), don't use Twitter, Instagram or Facebook (and I will never do, I hope). I use every day Whatsapp and dropbox only sporadically for not critical data.
I use GMAIL with Calendar and Contats.

Lately (don't ask me why), I got more interested to understand how my privacy and data in the internet are protected.
10sec later I realize that all my emails, contacts, calendar are in Google hands in some server on this planet. I don´t believe Google will cause damage to me, and it never did in the past (at least I did not notice that...).

What now what bothers me is the feeling there is someone (who could/can/is) always watching me and maybe keeping track of all my activities... I don't like it.

Please I don't want to start a political or ethical privacy discussion here (thread will be locked in hours, I believe), I just want a nice technical discussion what make sense to do in order to protect our privacy.

That says what I did so far....

1) At work only Chrome is allowed, so I have there 100% incognito on with uBlock Origin on. When I get home end December I will install Mozilla with noscript and auto cookie delete.
2) Use duckduckgo.com instead of google.com
3) On my Android Phone (yes I know... don't tell me) I installed the excellent Firefox Focus/Klar.
4) Pfsense with pfBlockerNG on (<-- This is very cool and stable! I love it)

Next on my list (with a very relaxed timeline/schedule) is to get rid of GMail.

I spotted this:

https://kolabnow.com/

which seems to be okay. (PS: Switzerland was famous to keep the bank info secret, now they want to keep the data secret?  )

Another attack plan (much more time and money cosuming) could be to buy a domain and have a nice server at home which runs IMAP email, ownCloud, Roundcube and Z-Push.
I am considering to buy a VPN service, but it is just shifting the problem I think. TOR is also on my radar, but I read it is slow.

I don't think I will ever be protected in the internet, but at least I want to try to rise the bar a little bit, right now I am just walking with my pants down and a smile on my face I think.

What you smart guys do? Do you have a private server at home? Thanks in advance for the suggestions.
Again please keep it technical, thanks.

TO MOD/ADMIN: IF YOU DON'T LIKE THIS POST FEEL FREE TO LOCK IT IMMEDIATELY. MY APOLOGIZES.

[bd139]

I subcontract it all out to FastMail, Apple, DuckDuckGo.

https://www.fastmail.com/about/privacy.html

https://www.apple.com/uk/privacy/

I do have a youtube channel but this sits in chrome. I don't use chrome for anything else.

Note I have run mail servers before (postfix/dovecot etc) and it's a ball ache. Don't even go there.

[brabus]

I understand your fear and worries.

What I do? Nothing. Google even has all the passwords of all the WiFi Networks I have ever connected to.
If someone reads my email, well, they can have access to many of the services I use, like social media, forums or similar, but... meh.

Passwords are preserved in my head, written nowhere, all different each other. I forget them often, to be honest, especially if seldom used, so it's a bit of a PITA, but I feel safer this way.

The only really important thing (i.e.: which could really cause concrete damage to me or my family) is my bank account, really. I never authorize any transaction without double-confirmation (via SMS Code for example, also with credit card).

To be honest I don't really see a problem here, since even banks share their information (any information, regardless of privacy agreements) with the world, and we have no control over it. I just accept it and move on.

[hammy]

Do you have a private server at home? Thanks in advance for the suggestions.
Again please keep it technical, thanks.

HP Microserver at home with several VMs:
- mail/calendar server: freebsd, postfix, dovecot, baikal (caldav/carddav), roundcube, let's encrypt (acme)
- NAS with dokuwiki, filestorage, video, music, etc
- pfsense separates dmz and internal lan (failover: ubiquity edgerouter)
- managed switch with vlan support
- piHole
- UPS for all core services
- automated backup for everything
- VPN (in and out)
- smartphones in use: "fairphone 2" without google services and open source os
- "cloud" for our smartphones on my own NAS
- threema / telegram messenger
- yacy search engine

If you don't want to spend time and money for this, get an account for a service provider with high privacy and security:
posteo.de
manitu.de
http://www.aikq.de/
https://www.mailfence.com/

The are some "privacy handbooks" (creative common) you can search with https://duckduckgo.com/

[MrMobodies]

For when 2 step recovery is required I have a pay as you go sim on an old phone with no credit waiting there.

I use Pfsense as well for to group two broadband lines four lans with spare network cards if I want try something and it has been going well for over 3 years now. Very good for viewing and managing traffic like VPN and blocking spammers who target what I port forward but most of them I forward are on different ports anyway. It is Quad core low power Xeon 2.5GHz, Gigabyte motherboard, 4GB of low latency ram, 4x Alteon Acenic PCI-X and 1x Quad port Intel MT server network card.

I also use a free beta copy of Dude 4 beta from Mikrotek for the managed switches you can see where the throughput is going as well on the map.

I do have a HP G5 DL380 running on my shelf but I wouldn't run an email server directly on it for anything important as that would depend on the broadband connection.

[Zucca]

HP Microserver at home with several VMs:
- mail/calendar server: freebsd, postfix, dovecot, baikal (caldav/carddav), roundcube, let's encrypt (acme)
- NAS with dokuwiki, filestorage, video, music, etc
- pfsense separates dmz and internal lan (failover: ubiquity edgerouter)
- managed switch with vlan support
- piHole
- UPS for all core services
- automated backup for everything
- VPN (in and out)
- smartphones in use: "fairphone 2" without google services and open source os
- "cloud" for our smartphones on my own NAS
- threema / telegram messenger
- yacy search engine

That's impressive, very cool and sexy. I can't do that it's too much for me, I am an EE and not an IT nerd. I can imagine how happy you were that day when everything worked as expected, did you get drunk and celebrated  ? Congrats anyway nice setup.

I will setup probably a (HP DL380 G6) FreeNAS server with USP and offsite backup at home with maybe owncloud as plugin nut I am terrified to move on in the rabbit hole with VMs. I never played with VM, xBDS too much and I am scared to burn my fingers and time. I will probably outsource everything like bd139 did.

[hammy]

That's impressive, very cool and sexy. I can't do that it's too much for me, I am an EE and not an IT nerd. I can imagine how happy you were that day when everything worked as expected, did you get drunk and celebrated  ? Congrats anyway nice setup.

This setup started ~10 years ago and is still ongoing. You never stop and sometimes it is necessary to modernize parts of it.

I will setup probably a (HP DL380 G6) FreeNAS server with USP and offsite backup at home with maybe owncloud as plugin nut I am terrified to move on in the rabbit hole with VMs. I never played with VM, xBDS too much and I am scared to burn my fingers and time. I will probably outsource everything like bd139 did.

Start small. FreeNAS, Zeroshell or pfsense/opnsense, pihole. Use some small Alix APU devices and RasPi. If possible keep your backup at home on usb-drives connected to your NAS for mirror/backup. Keep it simple. Owncloud/Nextcloud for your cloud/calendar/contacts.

A DL380G6 ist a huge and powerful machine, but also not cheap on your electric bill if you run it at home. If you use to much hardware it is cheaper to use a service provider.

[Zucca]

- yacy search engine

Very interesting.

[MrMobodies]

They sell some good quad port gigabit nics and Ebay and I got very cheap some time ago.

I think they are a HP 375T Netxen NX3031.
I get good throughput performance with them and I have a couple in LAGG for the file server.

On ebay I see 10 gigabit ethernet prices going all the way down about £100 for and fibre controllers are becoming even cheaper.
 
My HP G5 does use up a lot of power to run and gives out a lot of heat.
I had to make a shroud and put fans at then end where the power supplies are to blow out the hot air or it heats the case up.

I like HP over Dell because there are many options you can set in the bios that Dell seem to lack.

[rdl]

1. Whatever you end up using, don't leave emails on the server. If it's important, download it before deleting.
2. Chrome is Google. Trustworthy? Your call. I wouldn't touch it.
3. DNS server? There are probably better choices than what your ISP offers, or god forbid, Google.
4. Cookies are a problem. Most sites break badly without them. The damn things are relied on way too much for functionality.
5. Turn off all caching in your browser (unless maybe you have a slow connection). It can be used to track you.

[Zucca]

I know the DL380G6 is a heater and energy hungry... I just want to test it out and see how it goes (I don't even have AC in summer so... oh oh ....)  If it is too much I will replace it with something small and faster maybe.

I am very pleased with pfsense and pfBlockerNG so don't need a piHole I think.

MrMobodies I l think you have a wise and balanced setup,

4GB of low latency ram

on my pfsense machine I mounted ECC RAM...

Holy molly I just checked my GMAIL account I have about 13GB of crap. Size seems to be an obstacle (not cheap)  to outsource everything.

[ataradov]

I switched to FastMail after similar thoughts about GMail many years ago and I could not be happier. And FastMail provides a real IMAP interface, not the google-flavored one, and they don't screw around with their web interface. Gmail gets worse and worse over time.

Yes, it costs money, but it is a really laughable amount of money for what you get.

[Zucca]

3. DNS server? There are probably better choices than what your ISP offers, or god forbid, Google.

Thanks rdl I agree on everything, for DNS I use quad9:

https://www.eevblog.com/forum/chat/httpswww-quad9-net-dns-safety-layer-driven-internet-security-for-free/msg1881236/#msg1881236

[Zucca]

FastMail

25GB for 5$ an month, I like it.

[MrMobodies]

MrMobodies I l think you have a wise and balanced setup,

4GB of low latency ram

on my pfsense machine I mounted ECC RAM...

Holy molly I just checked my GMAIL account I have about 13GB of crap. Size seems to be an obstacle (not cheap)  to outsource everything.

ECC Nice.

In one of the places I worked about 5 years ago at were lots of old Dell Pentium 4's.

I got hold of a job lot of the Dual Intel MT gigabit network cards. I put 3 dual ports in each and we got a couple of them running Pfsense with Carp for redundancy with some UPS  to go with it. There were 3 slow 4mbps adsl lines. (1 dis used for SIP phones, one from a merged company. It worked really well until some digger dug through the lines on the estate.

[Zucca]

with some UPS  to go with it

For the pfSense Box I don't bother to put an UPS. If the power goes down then modem and internet goes down. For the FreeNAS box it's another story.

BTW thanks guys you are awesome.

[eugenenine]

e-mail is pretty easy, you can host it yourself or pay nearly anyone else to do it.  When I had to leave time warner's roadrunner service I knew I would have to tell everyone and change account at a lot of places from <myname>@rr.com to something else.  So I registered my own domain at that time so it would only be a one time change.  From then on I was <myname>@<mydomain.com> and have moved my e-mail hosting a couple times and simply re-pointed the domain.  This makes it flexible for me, I can host it myself or pay someone else without having to change all my accounts.

The other piece mentioned is calendar and contacts.  I use owncloud.  You can download and install yourself or pay to host it somewhere.  Then download sync tools on your phone/laptop/tablet/whatever and use the calendar/contacts and files there.

It takes maybe one hour or less to write (Slackware) Linux to a microSD card, boot it, download owncloud, setup apache and mysql and have an owncloud site up and running.  This keeps my data off of Google/Apple/microsoft/whomever else.

[Zepnat]

Wish I could understand all this 

[ataradov]

Yes, changing to my own domain was also a huge part of my decision to move to FastMail. Email is a big part of my life, and if google were to ban my email for whatever arbitrary reason, it would be a huge blow. If google bans me now, I will be mildly inconvenienced, but overall I would not care.

[Zucca]

I use owncloud

I will use FreeNAS and I see owncloud as a plugin. Still ponding to put ownclould on one of the hundreds Rasp I have and point it to the FreeNAS, and keep the FreeNAS plugin free..

was also a huge part of my decision

I noticed that too, 5$/Month for 25GB and own domain it's hard to beat. 

[PA0PBZ]

don't use Twitter, Instagram or Facebook (and I will never do, I hope).

I use every day Whatsapp

Someone should tell him...

[Nusa]

That Whatsapp is Facebook? Which is a bigger worry than Google, historically.

[Zucca]

Privacy 100% vs being isolated from rest of world.

I unfortunately cannot jump off the Whatsapp boat, all my friends use it. What I have to do?

[PA0PBZ]

Privacy 100% vs being isolated from rest of world.

I unfortunately cannot jump off the Whatsapp boat.

I know, it's just that you said you're happy to not use facebook.

[Zucca]

you said you're happy to not use facebook.

Oh, yes. Whatsapp is already time consuming enough. Imagine to deal also with Facebook. No thanks.

[Mr. Scram]

I know, it's just that you said you're happy to not use facebook.

You're talking about Facebook as a company and Zucca seems to be talking about Facebook as a product. Using either is not the same thing and doesn't mean sharing the same data, even if Whatsapp and Facebook are both owned by the same company.

[Nusa]

I know, it's just that you said you're happy to not use facebook.

You're talking about Facebook as a company and Zucca seems to be talking about Facebook as a product. Using either is not the same thing and doesn't mean sharing the same data, even if Whatsapp and Facebook are both owned by the same company.

Whatspp terms of service about affiliated companies actually says they make use of your data between the various facebook companies, in any way that benefits their operations. The only thing they promise not to do is making your messages public (although another part of the agreement seems to say that the laws of ANY country where the data happens to be stored might say otherwise):

We joined the Facebook family of companies in 2014. As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings. This includes helping improve infrastructure and delivery systems, understanding how our Services or theirs are used, securing systems, and fighting spam, abuse, or infringement activities. Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads. However, your WhatsApp messages will not be shared onto Facebook for others to see. In fact, Facebook will not use your WhatsApp messages for any purpose other than to assist us in operating and providing our Services.

[Mr. Scram]

Whatspp terms of service about affiliated companies actually says they make use of your data between the various facebook companies, in any way that benefits their operations. The only thing they promise not to do is making your messages public (although another part of the agreement seems to say that the laws of ANY country where the data happens to be stored might say otherwise):

We joined the Facebook family of companies in 2014. As part of the Facebook family of companies, WhatsApp receives information from, and shares information with, this family of companies. We may use the information we receive from them, and they may use the information we share with them, to help operate, provide, improve, understand, customize, support, and market our Services and their offerings. This includes helping improve infrastructure and delivery systems, understanding how our Services or theirs are used, securing systems, and fighting spam, abuse, or infringement activities. Facebook and the other companies in the Facebook family also may use information from us to improve your experiences within their services such as making product suggestions (for example, of friends or connections, or of interesting content) and showing relevant offers and ads. However, your WhatsApp messages will not be shared onto Facebook for others to see. In fact, Facebook will not use your WhatsApp messages for any purpose other than to assist us in operating and providing our Services.

This doesn't contradict what I said. Using a different service yields different data.

[Zucca]

Regarding Whatsapp in Germany they said:

Einen Tot muss man sterben

https://dict.leo.org/forum/viewUnsolvedquery.php?idThread=759954

Looking for buying a domain for 10 years:

godaddy.com        218,84 € No privacy protection
namecheap.com    160,32 € with privacy protection
name.com            166,77 € No privacy protection

I will hit namecheap.com oherwise you guys know better.

[Mr. Scram]

Regarding Whatsapp in Germany they said:

Einen Tot muss man sterben

https://dict.leo.org/forum/viewUnsolvedquery.php?idThread=759954

Looking for buying a domain for 10 years:

godaddy.com        218,84 € No privacy protection
namecheap.com    160,32 € with privacy protection
name.com            166,77 € No privacy protection

I will hit namecheap.com oherwise you guys knows better.

Use an EU party with EU severs or one in a part of the world with even more favourable laws. I'd avoid US parties, unless privacy centred.

[Zucca]

dynadot.com €129,00 with security.

https://www.dynadot.com/domain/security.html

so a gmail free life will cost me at the end about 1865€/year. I like it.

EDIT: Math problems...

[Mr. Scram]

dynadot.com €129,00 with security.

https://www.dynadot.com/domain/security.html

so a gmail free life will cost me at the end about 18€/year. I like it.

What's your goal? Just mail? Check out the Swiss based Protonmail. They have a free version too.

[Zucca]

With 13GB to carry over Fastmail still wins

[vtwin@cox.net]

google can data mine me all they want, my life isn't that exciting and they're not likely to make any money off of me, as I've yet to purchase a single, solitary item ever presented to me in an online ad.

[Mr. Scram]

google can data mine me all they want, my life isn't that exciting and they're not likely to make any money off of me, as I've yet to purchase a single, solitary item ever presented to me in an online ad.

You'd be surprised how many people think advertisements don't work on them. Research shows they're wrong, unsurprisingly. The idea of not being susceptible is probably part of what makes people susceptible. They don't understand ads are finely tuned to abuse human nature. Not being susceptible means not being a functioning human.

https://medium.com/@dahanese/advertising-works-don-t-believe-me-then-you-are-my-favorite-demographic-ebf6b1f2541a

[apis]

Truth is, unless you are both a computer wizard and willing to spend an unreasonable amount of time on this issue you're probably just going to end up making things worse than it already is. There isn't a quick fix for this (maybe becoming a hermit would work). You could run your own web server and such, but unless all the people you are emailing are also running their own web servers (which is becoming harder and harder) it probably won't make that much of a difference. If all your emails come from or end up in a gmail account google have all your email anyway. Google are relatively harmless though, they have to follow some laws at least and are mainly interested in using your data to increase ad revenues and thus also want to keep the sheeple happy so they come back for more free meals. But there are many other actors with more nefarious intentions who has more resources and some doesn't even have to follow the rules, so you're still completely screwed even if you manage to avoid google.

[NiHaoMike]

Better than not giving them your data is to give them fake data. That said, I'm not sure how good the following extension really is:
https://cs.nyu.edu/trackmenot/
Then there's AdNauseum, although the default settings to "click" every ad is probably less effective than setting it to only do so occasionally.
https://adnauseam.io/

[Halcyon]

I've worked in the IT security field for quite a while, this is what I personally do to protect my privacy:

1. No social media. This forum is the closest thing to social media that I use.

2. Gmail - I use Gmail daily for email, contacts and calendar entries, however I keep it completely "unclassified". Anything sensitive is stored offline on my NAS and never traverses Google's servers.

3. Keepass everything - Every single service I use has its own unique password. All account information is stored in Keepass with a very strong password.

4. Use AdBlock Plus and Ghostery plugins for my browser (Opera). I don't use Chrome. I also clear cookies upon exit.

5. I too use pfsense but for network-wide ad-blocking, I use Pi-hole.

6. Run "Fake GPS" on my Android phone. Not only does every application think I'm in an entirely different state, it messes with Google's data collection, especially when it tries to link my location (based on my search history, IP etc...) with GPS data from my phone when on Wi-Fi. Sometimes I'm in Sydney, other times I'm just "Somewhere in Australia". I usually block most things, but feeding fake information back via location services is great.

[Mr. Scram]

Better than not giving them your data is to give them fake data. That said, I'm not sure how good the following extension really is:
https://cs.nyu.edu/trackmenot/
Then there's AdNauseum, although the default settings to "click" every ad is probably less effective than setting it to only do so occasionally.
https://adnauseam.io/

It's probably naive to think modern data mining algorithms don't cut through this type of noise. That's one part of the problem. People consistently underestimate how sophisticated data extraction has become and how fast it's still evolving and adapting.

[bd139]

They love those tools. Firstly they charge for the clicks and make money anyway.  Secondly they know what clicks are likely to be automated and then don’t track those. It’s quite simple to distinguish these because the click patterns of the average user are well known. Also they don’t usually care because so few people do this.

This just adds to the problem. The only way to do it is take their infrastructure away which is remove or block all the tracking side channels (hard) or don’t use the product with the tracking in it (easy).

[Zucca]

Thanks for the discussion, I will probably move soon all my crap out of GMAIL with my own domain on FASTMAIL finally.



 

[bd139]

Good choice. They are excellent (and cheap!) 

[Zucca]

Thanks to you! BTW do you bother do keep a local emails backup, or you just trust/believe they will never crash?

[bd139]

I do keep a local backup. I have a script that wraps up isync (confusingly aka mbsync): http://isync.sourceforge.net ... this gets run once every couple of days. Nothing has ever gone wrong or missing.

Contacts and calendars are in iCloud (because it's convenient to share with family and works with iMessage etc). You can add your icloud calendar as a data source inside Fastmail's web interface and you end up with one calendar everywhere for example.

[apis]

Not sure what you gain by changing email provider. As long as someone else administer the email server they can read your emails.

Forgot to mention that the EFF has some nice browser add-ons:
https://www.eff.org/privacybadger
https://www.eff.org/https-everywhere

The only thing that will work in the end is to put pressure on politicians and spread awareness though.

[bd139]

They can for sure.

What you need is to pick a company that acknowledges this and explains their limitations and legal stance when it comes to accessing your data, retention and their general competence. For example some bigger hosts haven’t even sussed DKIM yet. FastMail is a good one:

“We won't release any data without the required legal authorisation from an Australian court. As an Australian company, we do not respond to US court orders.“

The US worry me most and the UK.

[rdl]

Correct. You cannot be sure your emails are private or secure. Something like this happened recently with my comcast email account.


It is the reasoning for my comment #1 It does not fix the problem, but minimizes it somewhat.

1. Whatever you end up using, don't leave emails on the server. If it's important, download it before deleting.

[Mr. Scram]

They can for sure.

What you need is to pick a company that acknowledges this and explains their limitations and legal stance when it comes to accessing your data, retention and their general competence. For example some bigger hosts haven’t even sussed DKIM yet. FastMail is a good one:

“We won't release any data without the required legal authorisation from an Australian court. As an Australian company, we do not respond to US court orders.“

The US worry me most and the UK.

With Australia being part of the five eyes and them being quite willing to adopt laws to facilitate monitoring that promise seems somewhat empty.

[vtwin@cox.net]

You'd be surprised how many people think advertisements don't work on them. Research shows they're wrong, unsurprisingly. The idea of not being susceptible is probably part of what makes people susceptible. They don't understand ads are finely tuned to abuse human nature. Not being susceptible means not being a functioning human.

For the "typical" person surfing the internet, they're probably correct. But, I'm not your "typical" user, having been around since the days of bitnet, uucp and usenet.

At the moment, for instance, I'm spending a significant amount of time researching cribs, not because Mr. Google is showing me ads of cribs, but because my wife and I need one. I know exactly what I am looking for in terms of specifications/requirements, no number of flashy ads is going to change my mind. In this respect, I'm not a "typical" consumer.

Every now and then I'll screw with them by searching for something obscure too, just for the hell of it.

[Mr. Scram]

For the "typical" person surfing the internet, they're probably correct. But, I'm not your "typical" user, having been around since the days of bitnet, uucp and usenet.

At the moment, for instance, I'm spending a significant amount of time researching cribs, not because Mr. Google is showing me ads of cribs, but because my wife and I need one. I know exactly what I am looking for in terms of specifications/requirements, no number of flashy ads is going to change my mind. In this respect, I'm not a "typical" consumer.

Every now and then I'll screw with them by searching for something obscure too, just for the hell of it.

Yes, that's pretty much what everyone says.



Subtext: "Hey, what are the odds -- five Ayn Rand fans on the same train!  Must be going to a convention."

[bd139]

Indeed.

Best thing is carry on and boringly be normal. Do normal things. Be a boring median not an outlier.

At least as far as any data collection is concerned that is.

If you think the correlative ability of the agencies goes past basic surveillance then you give them too much credit.

[jmelson]

I do keep a local backup. I have a script that wraps up isync (confusingly aka mbsync): http://isync.sourceforge.net[/u

I own my own domain (through Network Solutions, but getting a bit expensive) and run my own web and mail servers (at home).
This way, I can change ISPs and nobody has to ever know, or change the email address they use to contact me.  Also, I am immune to any crazy filtering they might implement on email.  (I do a fair amount of international business, so if they cut off emails from some country, it could lose me business.)  I have it set up through Charter (Spectrum) that they allow me to send and receive email under my own domain name, although their reps say that is not permitted.  But, it just works.

One issue is I can't send email through that route when traveling!  So, I have to have a gmail account so I can do that.

Jon

[vtwin@cox.net]

Yes, that's pretty much what everyone says.

So, it's your assertion Mr. Google and his plethora of ads for cribs made out of pine and MDF are going to sway me into purchasing a substandard product rather than a crib made from maple or oak?

[bd139]

I do keep a local backup. I have a script that wraps up isync (confusingly aka mbsync): http://isync.sourceforge.net[/u

I own my own domain (through Network Solutions, but getting a bit expensive) and run my own web and mail servers (at home).
This way, I can change ISPs and nobody has to ever know, or change the email address they use to contact me.  Also, I am immune to any crazy filtering they might implement on email.  (I do a fair amount of international business, so if they cut off emails from some country, it could lose me business.)  I have it set up through Charter (Spectrum) that they allow me to send and receive email under my own domain name, although their reps say that is not permitted.  But, it just works.

One issue is I can't send email through that route when traveling!  So, I have to have a gmail account so I can do that.

Jon

You are not immune to some of the nasty upstreams like Yahoo deciding to black hole you for 6 months however. Also your “home” IP address probably has a high risk rating with the RBLs which means you may suddenly get silently discarded by big providers like Google and Microsoft. Also you have to piddle around setting up domain keys now.

I spent a long time running mails servers for people and I wouldn’t bother any more. It’s just hell when it goes wrong.

[NiHaoMike]

It's probably naive to think modern data mining algorithms don't cut through this type of noise. That's one part of the problem. People consistently underestimate how sophisticated data extraction has become and how fast it's still evolving and adapting.

Increasing the chance of real data being discarded is a step in the right direction, even if not perfect.

[bitwelder]

3. DNS server? There are probably better choices than what your ISP offers, or god forbid, Google.

Thanks rdl I agree on everything, for DNS I use quad9:

https://www.eevblog.com/forum/chat/httpswww-quad9-net-dns-safety-layer-driven-internet-security-for-free/msg1881236/#msg1881236

You might want to try as DNS 1.1.1.1 ("quad 1"), by Cloudflare. In some cases their RTT is shorter than your ISP DNSes.
If you just access https://1.1.1.1 from the browser of your Android/iOS mobile you can also download app (or rather, a configuration) to VPN all your DNS traffic.

[Zucca]

Thanks.

From Mexico and Germany I see 1.1.1.1 two time faster than 9.9.9.9 . Very cool.

I did not moved everything on 1.1.1.1 because it lacks on security, privacy is OK!

https://www.quad9.net/faq/#Is_there_a_service_that_Quad9_offers_that_does_not_have_the_blocklist_or_other_security

The primary IP address for Quad9 is 9.9.9.9, which includes the blocklist, DNSSEC validation, and other security features. However, there are alternate IP addresses that the service operates which do not have these security features. These might be useful for testing validation, or to determine if there are false positives in the Quad9 system.

I don't see such services in 1.1.1.1 .

I will now investigate the DNS change on my phone, very interesting stuff.

[EEVblog]

Given that I've had a gmail account almost forever, am obviously a Youtuber who need a google account, and there are other engineering Youtubers who talk on a private gmail group, and I use Google instant message thing all the time, it would be almost impossible for me to change.

[Zucca]

Yes clearly you can't switch and jump off the Gmail boat,

PS: You have not only Gmail but also the EEVBlog Mail server... use it wisely as you already doing for sure. 

[Zucca]

Also your “home” IP address probably has a high risk rating with the RBLs which means you may suddenly get silently discarded by big providers like Google and Microsoft

And if you go public through a VPN service, is the public VPN IP considered more risky or not?

[Mr. Scram]

So, it's your assertion Mr. Google and his plethora of ads for cribs made out of pine and MDF are going to sway me into purchasing a substandard product rather than a crib made from maple or oak?

No, my assertion is that a lot of people thinks they are immune or smarter than advertisements when research indicates it isn't so. It's an unfair contest to begin with, so it's really not surprising.

[Mr. Scram]

Increasing the chance of real data being discarded is a step in the right direction, even if not perfect.

The problem is that the chance is tiny tot non-existent, as it shouldn't be too hard to filter this kind of noise out. The net result is that you put time and effort into something that's not effective, and are not putting time into something that is. You're essentially performing security theater for your own benefit. You feel like you're doing something while nothing's happening.

[NiHaoMike]

I wonder how much fake data has to be sent for them to discard all data from the IP as fake. At some point, it would be better to just discard the data rather than spend resources trying to pick out anything that could possibly be real. Maybe it would be best combined with not actually using the service so they actually won't get any real data.

[Mr. Scram]

I wonder how much fake data has to be sent for them to discard all data from the IP as fake. At some point, it would be better to just discard the data rather than spend resources trying to pick out anything that could possibly be real. Maybe it would be best combined with not actually using the service so they actually won't get any real data.

That honestly sounds like a somewhat simplistic view of how data mining works. It's unlikely all data from an IP address gets discarded. "Spending the resources" sounds dramatic, but it just gets pushed through the same algorithm as everything else. The internet is full of noise, so that needs to be filtered out anyway.

Like I said before, people seem to mostly underestimate how refined modern algorithms have become and are still becoming. What not too long ago was seemingly unrelated information can now be tied together with near certainty. Data thought of as anonymous turns out to be not quite that as we learn more tricks.

https://www.wired.com/story/genome-hackers-show-no-ones-dna-is-anonymous-anymore/

[NiHaoMike]

What's difficult about generating fake patterns that look real? Or even basing them on a subset of real data? Maybe send your actual searches through the search faker.

[MT]

I am not a youtubber (would love to become one), don't use Twitter, Instagram or Facebook (and I will never do, I hope). I use every day Whatsapp and dropbox only sporadically for not critical data.
I use GMAIL with Calendar and Contats.

Lately (don't ask me why), I got more interested to understand how my privacy and data in the internet are protected.
10sec later I realize that all my emails, contacts, calendar are in Google hands in some server on this planet. I don´t believe Google will cause damage to me, and it never did in the past (at least I did not notice that...).

What now what bothers me is the feeling there is someone (who could/can/is) always watching me and maybe keeping track of all my activities... I don't like it.

Please I don't want to start a political or ethical privacy discussion here (thread will be locked in hours, I believe), I just want a nice technical discussion what make sense to do in order to protect our privacy.

That says what I did so far....

1) At work only Chrome is allowed, so I have there 100% incognito on with uBlock Origin on. When I get home end December I will install Mozilla with noscript and auto cookie delete.
2) Use duckduckgo.com instead of google.com
3) On my Android Phone (yes I know... don't tell me) I installed the excellent Firefox Focus/Klar.
4) Pfsense with pfBlockerNG on (<-- This is very cool and stable! I love it)

Next on my list (with a very relaxed timeline/schedule) is to get rid of GMail.

I spotted this:

https://kolabnow.com/

which seems to be okay. (PS: Switzerland was famous to keep the bank info secret, now they want to keep the data secret?  )

Another attack plan (much more time and money cosuming) could be to buy a domain and have a nice server at home which runs IMAP email, ownCloud, Roundcube and Z-Push.
I am considering to buy a VPN service, but it is just shifting the problem I think. TOR is also on my radar, but I read it is slow.

I don't think I will ever be protected in the internet, but at least I want to try to rise the bar a little bit, right now I am just walking with my pants down and a smile on my face I think.

What you smart guys do? Do you have a private server at home? Thanks in advance for the suggestions.
Again please keep it technical, thanks.

TO MOD/ADMIN: IF YOU DON'T LIKE THIS POST FEEL FREE TO LOCK IT IMMEDIATELY. MY APOLOGIZES.

Whatever you do on the internet is tapped off by NSA and stored at Forth Mead, Bluffdale etc and other sites.
End of story and your security start point.

[Mr. Scram]

What's difficult about generating fake patterns that look real? Or even basing them on a subset of real data? Maybe send your actual searches through the search faker.

Fake patterns won't look like real ones. Basing them on real data generates repeating or known patterns. As with most things, mimicking human behaviour in a sensible way or one that's believable to a regular human is very hard. Mimicking them in a statistically indistinguishable way is nearly impossible. As technology to do so improves, the methods of detecting it do so too. Considering the mimicking is an amateur effort at best and the analysis is done by armies of skilled professionals, I wouldn't get my hopes up.

[NiHaoMike]

And what about making the real data look fake?

[Mr. Scram]

And what about making the real data look fake?

How would you propose to do that?

Of course, whatever it is it will only work when a very limited number of people do it.

[NiHaoMike]

Use it to "seed" the generation of many searches, just like how the fake searches are generated.

[cdev]

Resistance is futile.

Your data will be assimilated. (Really)

[Zucca]

Still, I think we can defend from some bad guys out there.
Investigating a VPN Tunnel right now....

Even if I know now I will never be 100% secure, it's very interesting to learn how the internet net works.
Thanks for all your posts I am learning a lot.

[Mr. Scram]

Use it to "seed" the generation of many searches, just like how the fake searches are generated.

You can't exactly seed searches, as they need to be coherent. Besides, it's also about the when, how and where. Just plunking sensible searches into a search box isn't enough.

[hammy]

Investigating a VPN Tunnel right now....

NordVPN or PIA

[Mr. Scram]

NordVPN or PIA

Based on what?

[MT]

Still, I think we can defend from some bad guys out there. Investigating a VPN Tunnel right now....
Even if I know now I will never be 100% secure, it's very interesting to learn how the internet net works.
Thanks for all your posts I am learning a lot.

Well, perhaps reading up on privacy breaching organisations could benefit , such as CIA, 2017 vault7.
https://wikileaks.org/ciav7p1/cms/index.html

[hammy]

NordVPN or PIA

Based on what?

Price, streaming capability, speed and amount of endpoints.

[jmelson]

You are not immune to some of the nasty upstreams like Yahoo deciding to black hole you for 6 months however. Also your “home” IP address probably has a high risk rating with the RBLs which means you may suddenly get silently discarded by big providers like Google and Microsoft. Also you have to piddle around setting up domain keys now.

Although my IP address is in the message headers, they get a "last" IP from Charter's SMTP servers, and that is what most filters look at.  I DO have a problem with this, some mail lists reject mail from some of Charter's servers, some reject mail from gmail's servers.  So, I have to keep switching my outgoing mail server depending on who I'm sending to -- what a pain!

Jon

[jmelson]

I wonder how much fake data has to be sent for them to discard all data from the IP as fake. At some point, it would be better to just discard the data rather than spend resources trying to pick out anything that could possibly be real. Maybe it would be best combined with not actually using the service so they actually won't get any real data.

Well, the problem is, this is a "business model"!  The scheme is you get people to use your free black list service to identify spam-generating IP's.  Then, once well-established, they start blacklisting everything they can, and charging a RANSOM to get you off their blacklist.  So, it is in their interest to blacklist every IP that they spot sending even ONE spam message to their spamtrap IP.
The fact that about half of Charter/Spectrum's SMTP servers are listed on several blacklists at any one time indicates something is really wrong.  Charter has 26 million accounts, they are a really major ISP.

SourceForge, for instance, uses these predatory blacklists to reject mail from Charter's servers.

Jon

Jon

[Zucca]

Although my IP address is in the message headers, they get a "last" IP from Charter's SMTP servers, and that is what most filters look at.  I DO have a problem with this, some mail lists reject mail from some of Charter's servers, some reject mail from gmail's servers.  So, I have to keep switching my outgoing mail server depending on who I'm sending to -- what a pain!

Thanks jmelson, have you tried to "mask" your IP with a VPN Tunnel?

[jmelson]

Thanks jmelson, have you tried to "mask" your IP with a VPN Tunnel?

Doesn't work (I think).  I have to send mail to an SMTP host that will accept it and forward it on to the WAN.  You have to use SOMEBODY's real SMTP server to do that.  For Charter, I need to send it from inside their network with an IP they also recognize as inside.

So, the issue is not MY IP, it is the IP of Charter's outgoing SMTP servers.

Now, I'm sure I could find some other SMTP server to use, but I'd likely have to pay for that.  Since I am already paying Charter for this service, I shouldn't have to pay somebody else for it.

Jon

[cdev]

Look up "SPF" "DMARC", "DKIM" and implement them, and then get a TLS certificate for your domain for your server's FQDN - also make sure your machine is not an open relay, to get your ability to send outgoing email from your servers fixed.

[bd139]

DKIM is a dick to set up. This is one reason I contracted it out to fastmail here.

[olkipukki]

Nobody suggested AWS WorkMail?
https://aws.amazon.com/workmail/faqs/

$4 (+VAT) per 50GB, and if EU data storage a bit of your concern, you can choose Ireland as the endpoint.
Of course, you will need familiarise yourself with Amazon T&C...

If you never used AWS before and considering to setup own mail server (vpn, etc) you can get one year free micro instance and access to most of their services, plenty time to learn and decide if you relly want to do these things.

[bd139]

I wouldn’t use AWS for this. Way too complicated. Plus most of it is slightly different to other realities which means once you’re in you’re stuck.
 
(I have AWS cert for ref and this I speak only from experience)

[cdev]

People pay for information about you. Thats their real business model. They get you addicted and the more you share the more they make. In ten or twenty years that info on your health or views or relations may be very valuable to somebody.

[Mr. Scram]

Price, streaming capability, speed and amount of endpoints.

Honestly, none of those should be the prime reason to go for a VPN provider. Trustworthiness is the most important, but also the hardest to gauge.

[bd139]

I think using a VPN is more likely to cause problems. Firstly the exit point is a known surface area. If NSA and GCHQ aren't all over the VPN providers I'd be surprised. Secondly it doesn't protect you from side channel leaks like accidentally picking up a Google cookie somewhere while not connected to the VPN and then connecting to the VPN.

Maybe if we went back to Gopher and used Tor as the transport... then again can you really trust Tor exit points? Who are they run by? Who was Tor developed by? Hmm 

tl;dr: If you're going to do bad shit, do it offline.

[Mr. Scram]

I think using a VPN is more likely to cause problems. Firstly the exit point is a known surface area. If NSA and GCHQ aren't all over the VPN providers I'd be surprised. Secondly it doesn't protect you from side channel leaks like accidentally picking up a Google cookie somewhere while not connected to the VPN and then connecting to the VPN.

Maybe if we went back to Gopher and used Tor as the transport... then again can you really trust Tor exit points? Who are they run by? Who was Tor developed by? Hmm 

tl;dr: If you're going to do bad shit, do it offline.

You have to consider what you're protecting yourself against. If it's the NSA and the GCHQ then good luck, I guess. VPNs are mostly useful against people running the local network sniffing your data out and preventing the many websites you're visiting from getting a very specific IP address and other meta data. A VPN may very well make you both more vulnerable and interesting to the big boys, but it definitely helps against the smaller fries. Pick your poison.

[Zucca]

I agree with both of you Scam and bd139.

I know what happens in Germany if you download a copyright movie with torrent.
Some how the information goes (ISP?) in the hands of a law attorney.
This is a nasty and horrible law attorney which hire only evil jung lawyer people fresh from university who have the task to send long letters written in their language asking for money to avoid going to court. Horrible work, according to my german friend which is a lawyer, and after 1/2 years people quit that job.  1500€ Bill.
Either you hire an attorney to deal with them (example proving you were not at home at time/day) or they escalate... No police involved as I understood, God knows why.
Did not happen to me but a friend of mine. I don't need to download movies... I just do Software (with tons of virus/trojan in it)  and nobody cares about a SW in torrent. 99% download movies or music or nasty stuff.

Now a VPN I think will fix the problem to keep that nasty german law attorney away. (I am right now working in Mexico and believe me if your VPN tunnel come out in Mexico (for example) nobody give a shit if you download Matrix. Just looking at the cars on the road and how they drive this is the real land of freedom!)

I don't like my ISP is watching my traffic, that's all.

[bd139]

There are similar things at major ISPs here. They have content firewalls now that block major torrent sites.

If you don't go with the major ones you're fine. Plus they're better anyway for 10-20% more cost. Worth it.

But I'm not downloading anything here, honest! 

[Zucca]

bd139 I had to put my hand on my mouth to avoid a loud LOL in my open office. Thank you.

[rdl]

...
I know what happens in Germany if you download a copyright movie with torrent.
...

Just as an fyi.

Once you join a torrent. your IP address becomes known by every other computer that's also part of it. That's how torrents work. The big media companies, or someone working for them or just a scammer, can also join and discover the IP address of all participants. They then send letters to your ISP, who may or may not do something at their request.

I know years ago, comcast would inform you that they had received a letter of complaint but do nothing in return unless you had multiple "strikes" within a certain time frame. A proxy service is sufficient to solve this problem, at least for me, by hiding your IP address and is cheaper than a full VPN. Nevertheless, I am now considering changing to a full on VPN.

[Zucca]

Thanks got it, interesting. With pfSense it should be easy to create a LAN area where it goes to the internet only via a VPN tunnel. Here you will have your sand box to do the dirty jobs safely.
Scammers aka law attorneys are my concern since I don't need or touch Big Media material.

Rearding the shared IP, since it is a public IP I don't care too much. Definitely here the ISP has to play with and maybe get a cut of the "faked fine".

Interesting enough, on torrent pages the VPN ads are always there... :-)

[bd139]

There’s an easy way that works for me.

Give out your guest WiFi details to your kids friends and if anyone complains then you say it must have been one of them. Only problem is you become a known oasis in a land of used up data allocations so you have to chase them off with a stick occasionally.

This plays on the “IP address doesn’t correspond to an individual” concept.

[Zucca]

Your guests are draining 220-330GB/Months, that's why they love to come back at your home.
They fell safe because they can point to your IP/name, and you feel safe because you can finger point to them.

[bd139]

Exactly. It was the parasites, not me

[Bassman59]

There’s an easy way that works for me.

Give out your guest WiFi details to your kids friends and if anyone complains then you say it must have been one of them. Only problem is you become a known oasis in a land of used up data allocations so you have to chase them off with a stick occasionally.

Just change the name of that guest network every so often.

[Zucca]

Done with Fastmail and my private domain, for the trash/spam email I was inspired by Chuck Norris:



thanks again guys!