Page 2 of 13

Privacy – File Syncing/Sharing

There are services like Dropbox, Google Drive, and One Drive which allows you to sync your files across multiple devices. One thing all of these providers lack is privacy. Because your files are on someone’s computer, you risk them making mistakes like what Dropbox had a history of doing.

I will separate the options available between two different categories. Products which requires that you either have a server or that you use a third party provider, and products that requires no server.

Server required.
These are good for the cases where you have your own server or have a home computer you can leave open and open ports on. All files are stored on the server and the server is used as a main location for all your devices to sync to.

The main reason this is good is because you can share files with others easily by just creating a shared link which the person you’re sending the file to can just click and download without installing additional software.

1. Seafile

Seafile my choice as it can use client side encryption which uses keys the server does not know. While this may not be important to you if you own the server, if it’s in a third party data center it could prevent them from taking a peak at your data.

Seafile is written by people in China, but have been audited and when problems are found they fix them quickly so I have no reason not to trust it personally.

2. OwnCloud

OwnCloud is a popular choice, I haven’t had too much experience with it due to it having a bug that isn’t going to be fixed on my server platform of choice. Take a look for yourself to see if it looks like something you’d like.

One thing OwnCloud is great for is when you have a server which you don’t control via SSH and it only supports PHP. Some servers don’t allow running custom binaries like what Seafile server is.

A bad thing would be because it just has community support, they don’t fix bugs that quickly.

3. Pydio

Pydio seems a bit like OwnCloud, and not much more than that.

4. Sparkle Share

Sparkle Share is a simple product which does encrypted syncing to a git repository. I wouldn’t recommend it as it doesn’t include features you’d expect and get from other products like Seafile and OwnCloud.

No server required.
These products do not require a server to function which means you don’t have to setup a server to sync files at all. You can setup a server and use it as a master which every device can sync to and from if you want some of the same sort of things that a server provides.

This is good as if your server is dead, you may be able to get your files from another machine which is still alive. But these systems lacks the ability to share files with a direct download. You can still share files, but the people who wants the file will have to download and install the client.

1. Syncthing

Syncthing is my choice for file synchronization. It is a bit harder to use than the other choice, but it is open source and provides a lot of power.

Syncthing is designed more for server setups as it uses a Web UI to manage and to configure it to startup automatically, you have to use a daemon configuration. Daemon configurations are not easy for people who don’t know computers that well, but they do have some instructions on how to set it up.

Something this is not great at is sharing folders with others. You have to hand your ID to someone, then when they add you, you have to determine that it’s actually them by reading the first few characters and then choose the folder you wish to sync with them. Discovery is all automated through the announcer servers, but it’s a bit more involved to share a folder than other solutions.

2. BitTorrent Sync

This is a closed source option made by the BitTorrent corporation which because it’s closed source you can never tell if it’s really doing what they say it does. I have no reason to believe that they are doing anything wrong, but it’s just a word of caution. Syncthing seems to do a better job at synchronization than this from my experiments, but it’s your choice.

One thing BTSync does well is sharing folders. You can share a folder easily by dragging to the icon and getting a link to share with a friend. The link will ask the person to install BTSync to receive the files if they don’t already have it.


As an overview, Syncthing is stable, but also is hard to use for people who knows little about computers; even with it’s down falls, it is my choice for server-less sync. Seafile is a great stable solution for server based file syncing.

Privacy – Messaging

Something that has become popular in recent times is messaging clients like facebook Messenger, Apple Messages, WhatsApp, and Hangouts. The issue is not all of these systems are secure.

Issues with popular methods:
1. WhatsApp – Owned my facebook, closed source, unknown encryption.
2. facebook Messenger – facebook knows everything you say.
3. Apple Messages – Apple acts as key server and can add their own key if they want future messages and only Apple Devices.
4. Hangouts – Google sees everything.

This post will first explain different things that can be done to protect privacy and show a table of my recommendations of clients with the different items I talked about checked or not.

Peer to Peer (P2P) – Making a direct connection to the other person you are communicating with.
This can be both a good and a bad thing. It is a good thing as your messages are not going to a third party server, but it does go through Internet Service Providers (ISPs) which they can view and capture the traffic which isn’t much different from going to a third party. It is a bad thing because an ISP can view which IP address you are communicating with and with this information, they can correlate (build a map) as to who you communicate with.

Self Hosted – You own the server which is used to communicate with your friends.
Self hosted is basically like P2P, as if you own it, basically your friends talk directly to you. While you can self host, you can also use either your friends (mine) server or even a third party (Example: allows you to register an account with them).

End to End (E2E) Encryption – Encrypting your messages so that only the person you’re communicating with can read the message.
This is a must when you’re talking privacy, if you encrypt just for the server that doesn’t protect you from the third party. If decided to be malicious or was hacked and you were not encrypting your messages using GPG/PGP or OTR, your messages can be read.

Open Source – Proof that the software does what it says.
In my book, this is a must because I like to compile my clients myself. While it can be proof that the software does what it says, if you download binaries from the service you may not know if those binaries are actually the result of the code. The third party could have compiled some secret back door into the binaries, but left those out of the source code. Trusting them to do the right thing is up to you, I’d say if you don’t know how to compile go ahead and use what they provide. If you trust the third party, go ahead and use what they provide.

Server for Transportation of Messages – When you send a message, it is sent to a third party to be delivered to your destination.
If the third party server is taken over by hackers or if the people owning the servers themselves decide to be malicious, they can capture messages and do what they want. Now if you have E2E Encryption, this may not be such a bad issue. But if the encryption is poorly written, then it could be possible for a malicious person to figure out what was in the messages your sent. The only major issue with a server transporting messages is they must know where to transport them to which means they can more easily correlate who is talking with whom.

Server for Key Discovery – Having a server tell you how to encrypt for E2E Encryption.
If the server tells you the public key to encrypt your messages with, it is also possible for them to become a man in the middle with encryption. They can say, here is the user’s public key and have it actually be their own allowing them to decrypt and see the messages then re-encrypt and forward to the person you’re communicating with.

Encryption Optional – Messages can be sent in plain text.
This can be a bad thing as if you or the person you are communicating with decides to not encrypt, your messages goes in the clear and can be read by anyone. For both XMPP and IRC, I have disabled non-encrypted methods of talking to the server so it is only possible when a third party decides to allow non-encrypted for the messages to go in the clear.

Traffic Correlation – Governments or server owners can make a map of who you talk to.
This is something which the NSA does often, they collect phone records to find out who you talk with. If it’s possible for correlation of messages, then they get data they want and can possibly figure out who you are and who you’re talking with by matching other data captured.

Privacy - Messaging

Now that you have an idea on what is good and bad for privacy and what clients do what and support what, I will post my own little comments on each client.

1. Tox
To me, Tox seems like something made by a designer and not a programmer as the client isn’t exactly stable on some platforms and when you look at the github page for the mac client they have almost nothing done with code, but things done mostly on the design side.

One thing I personally do not like about Tox is you can’t run it in two places at the same time. I have lots of devices and if I want to leave the house and still be on tox, I’d have to quit the client on my PC and open it on my phone, which I have a hard time getting the client for my phone in the first place.

To sum things up; it looks promising, but needs lots of work.

My ID is DF98B2F03C128CE28970C08EC51D72E645627215B5049B8905E6D6FFA1FA6D00F54195874542
I am not usually on this.

2. Threema
This one is a very interesting concept. The idea is there is three forms of verification, the ID, contact info in your address book, and physical verification via QR Code. You can trust that your messages are going to the right person when you physically verified them.

The main issue with this client is you can only have one identity per device, so I can’t even use it on my computer and my phone if they had a client for the computer.


3. TextSecure
Have not really played with this one because I know none who has it. But I am told good things about it from podcasts.

4. Bleep
This is in early stages in my opinion, I haven’t really played with it either.

My ID is 86f4df59a91ea2dc970a22f0c2b053a04eaf364e198faf071e5e0fc91d728d10,GRMrGecko

I am not usually on this.

5. XMPP (Jabber)
This is a protocol which I love, it supports signing into other services like Facebook and Skype and also supports talking to people on other XMPP servers. XMPP is supported on all platforms and can be used fairly secure. If you want to fix issue x, you can do so. For example, Traffic Correlation issue can be fixed by you setting up the server behind a TOR Hidden Service.

My favorite XMPP Server is Prosody, you do not have to setup your own server if you don’t want to as services such as exists and you can get an account on my server by contacting me or registering using xmpp. Servers can be enabled SSL and can also force SSL which is a good thing. Make sure that when you connect to any XMPP server that you are using SSL so that your messages at least get encrypted to the server. You can further secure your messages by using OTR or GPG, but I think if you trust the server you’re talking with, there is no need.

My account is (x is for XMPP).






6. IRC (Internet Relay Chat)
Mainly designed for chat room style messaging, but also can be used for private messaging with OTR.

I have my own server at which I hangout in #hangout. IRC is the same sort thing as XMPP where you can fix issues that exists and can encrypt your messages using OTR. I only have SSL enabled on my server at port 6697.







As an overview, I prefer XMPP, and IRC  as messaging systems. If you want to talk with me, try using one of those as I am pretty much always on them. You should now have a better understanding of how to protect yourself when talking with friends.


This little board is a cheap serial to WiFi device that allows hooking up devices like the Arduino to WiFi for wireless control.

I plan on using this for my room lighting whenever I get around to playing with it.


Privacy – Passwords

Passwords are hard to make secure these days, and we need to have more than one password because if your one password gets stolen then the malicious person can access everything you own. The problem we encounter having so many passwords is we now do not remember passwords. So what do we do when we don’t remember passwords? We write them down in a note book. What is wrong with writing them in a note book? Well, say someone found it in your house or you keep it in your purse. You lose all your passwords and someone else knows them. Another issue is that when we make a password, we don’t come up with something random; we usually just go about making it something memorable which means it’s something like married1998 or spotthedog23. These are some of the worst passwords one can come up with. Why? Because hackers can guess these easily because they know people do this. So the passwords you really need should look something like B^xD2$9zXP@#9t68w4U4UJ5r%J77SV. But there is no way you would want to type that or you would remember that, so this is where Password Managers come into play.

Password Managers keeps track of all the passwords you use, makes it easy to use them, are able to make unique passwords for sites you use, and they encrypt your passwords using a Master Password to protect them from just being stolen. These are all great reasons to use a Password Manager.

Here are some password managers I recommend:
1. LastPass
LastPass is a cloud based password manager which stores all your passwords in their data center and syncs between devices and browsers you use. One issue with going with a cloud based password manager is if they don’t do security right, malicious people can possibly break in and steal all your passwords. This is something LastPass has done right.

They had break ins in the past, however each time nothing important was stolen and they learned from their mistakes. At most what was stolen was a hash of the master password which they know how to hash the passwords so well that it’s incredibly hard to reverse into the actual password. For this reason, this has become the password manager for me.

They allow one type of device for free, Mobile/Tablet/Computer, but if you want to use more than one, it costs $12 a year which is a steal for something that protects your online life.

2. KeePass
This is an open source password manager which is free but platform availability is limited. It was made for Windows, but has Unofficial releases for Linux, Mac, Windows Phone, Android, and iOS. I don’t personally trust “Unofficial” releases, so I’m sticking with LastPass.

3. 1Password
This password manager is quite nice, the only thing that prevents me personally from using it is it doesn’t support Linux and is expensive in my opinion at $50.

Now my recommendation on how to do passwords is as followed.
1. Have a password you don’t care about for sites you don’t care about that don’t have important information (like forums).
2. Make your master password long and have lots of entropy (many kinds of characters). You can use something like or to get an idea as to how good your password may be.
3. Pad your master password, example put %^@3 at the front of the password and *22#$ at the end or something like that.
4. It’s ok to use phrases to make the master password memorable. Like maybe “I walked to the Candy Store, and I found some Butter Finger candy bars.” That mixed with some padding is “&*2^ I walked to the Candy Store, and I found some Butter Finger candy bars. $#6(” which could take 50.42 thousand trillion trillion trillion trillion trillion trillion trillion trillion trillion trillion trillion centuries to crack.
5. Use absolute random max length passwords for any place that has your credit card info or access to your money.
6. Protect your email address with two factor authentication and a random password because it can be a weak point for entry into your accounts.
7. Use two factor authentication on your password manager if possible so people have to both know your password and have your phone to get in.


This is what you have to do until Public Key encryption becomes popular. The one I’m waiting for is

Privacy – Search

Choice of search engine is another item which helps protect your privacy. Both Google and Bing keeps a log of everything you search for and uses it to improve search results and provide information to the government when requested.

Yahoo (A bing proxy)
Ask doesn’t provide you with a way to see or delete history, they do collect this info though.

In order to provide better privacy, you have to use a proxy site. These proxy sites would search on your behalf and not keep logs of what you search for or when you search. This protects you when you search for “How to build a bomb” and don’t want to get caught ;).

Proxy Search Sites I recommend are:
1. searx
This is the one I personally use, it is open source, secured with SSL properly, and provides many preferences to customize which search engines you want enabled. My personal settings is DuckDuckGo and Google as the search engines. One thing I never understood is why they default to Google and 3 Bing search engines (Bing, Yahoo, and DDG).

Another implementation of searx, but not fully updated and uses CloudFlare as an intermediate so I do not know how safe it is. Because CloudFlare is a man in the middle, CloudFlare could be keeping logs and the server that actually hosts it could be sending the data insecurely to CloudFlare. So you can use this service if you like, just beware of the details.

3. DuckDuckGo
This search engine is the most popular proxy search engine out there. There is two issue I have with it and that is it’s a proxy for Bing and other search engines ( which doesn’t give me the search results I want being a programmer and also DDG is not open source, so I can’t see how they work.

4. startpage
This is a Google search proxy which is similar to DDG. the only thing I have against it is it’s not open source.

Everything is up to you on what you want to use. I may eventually write my own search proxy in go because go is my favorite language. I had a search proxy before, and I even attempted to make my own search engine which crawled the interwebs, but quickly found that I failed quickly at it. There is a reason these search companies has multiple gigabit connections and lots of servers.

Privacy – Browser

The next line in defense is the web browser you use because it is usually what you use to talk to the world. If you use a browser which doesn’t respect your privacy, you are basically giving the company everything that you do online. If you have a plugin that is prone to vulnerabilities, you risk being exploited and having malware take over your machine. Due to OS browsers not being updated quickly, I would not recommend using the browser that comes with your OS unless it’s an Linux/BSD system.

Browser Suggestions:
1. FireFox
This is the one browser I use and recommend. It respects the privacy of it’s user and is updated constantly to fix security problems. Firefox also has an advanced extension API which allows for tools to increase security and privacy far better than other browsers.

2. Chromium (not Chrome)
Chromium is the open source version of Google Chrome which is safer to use than Google Chrome when it comes to privacy. It’s not as good as Firefox, but is good enough for some people.

1. HTTPS Everywhere
Available for Firefox and Chrome

This extension is designed to force websites which are known to support SSL to be SSL at the first connection preventing the use of tools like sslstrip on such websites which watches for the first insecure connection and prevents the redirect to a secure version.

2. Privacy Badger
Available for Firefox and Chrome

Privacy Badger is an anti spying extension which watches how third party domains behave and if a third party domain is acting like a tracking site Privacy Badger will take action ether blocking cookies or blocking the domain entirely preventing the third party from tracking you.

3. uBlock Origin
Available for Firefox and Chrome

uBlock Origin blocks content that may not act in your interest such as advertisements, sites known for malware, and sites known to track. It is light weight and highly configurable.

There is another extension called uBlock which is similar, but not maintained by the original developer. I recommend going with the extension by the original developer.

4. uMatrix
Available for Firefox and Chrome

This extension is made for the more advanced user. It allows white listing of specific things websites can do, first and third party.  It is somewhat like a addon for Firefox which was hugely popular with the security community called NoScript, but seems to do some things differently. uMatrix is written by the same guy who made uBlock.

5. Referral Blocking Extensions
Available for Firefox

RefControl allows you to control which sites gets what in the http referral header. The http referral header tells websites where you came from which can be used for tracking purposes and other privacy invading actions.

I set the default action for sites not listed to set third party to forge my referral meaning when I leave one site to another or when one site makes a request to another it looks like I’m coming from the site which I’m going to and not the site I actually came from.
Available for Chrome
Referer Control provides the same power as RefControl for Chrome based browsers.

Make sure you do not have Flash or Java enabled on your browser. It’s ok if it’s set for click to enable, but having it enabled by default is a bad idea with all of the vulnerabilities which exists in these old plugins.

In Firefox you can check what’s available by going to “about:addons” without quotes in the address bar.
In Chrome based browsers you can check by going to “chrome://plugins/” without quotes in the omni bar.

Privacy – Operating Systems

The first thing to think about when you think Privacy is the operating system (OS) you use. If you’re using an popular OS, that leaves you open for being a target by the hacker community. If you’re using an OS which doesn’t care about your privacy, such as Windows 10/8/7, you risk your information being seen by administrators of the servers or by hackers who break in.

For every operating system, if it’s not the one you use you will have a learning curve to learn how to use it and find new Applications to replace other ones you used.

Here are some of my choices for an Operating System.
1. Mac OS X


Some advantages are because it’s a popular OS, lots of programs are being developed for it and you can even run some Linux applications on it using Xorg.

2. Elementary OS

One thing Elementary OS does well is look pretty. It is based on Ubuntu which is based on Debian so you get all the benefits of both in one. You can configure it so that the Dock is auto hidden or auto shown so it doesn’t take space on screen giving you a lot of space for windows.



3. Linux Mint

4. Ubuntu

Ubuntu sort of mixes Mac and Windows into it’s own thing as far as UI goes. Everything else is the same as Linux Mint and Elementary OS.

The great thing about Ubuntu is there is lots of support for it. It’s hard to find software that will not work on it. If you have trouble, there is a great community ready to help.


5. Debian
This OS is more for the geeky community. It’s more bare bones and doesn’t come with a software center making it harder to find software for the normal user of a computer. It has great privacy and provides multiple UIs, I recommend you try the different UIs in a virtual machine before using. I personally like Gnome and the standard Debian UI which is chosen by default.

6. Arch Linux
For the true geek. You have to know Linux to install the OS. They have tutorials that teaches you what you need to know to install, but you will likely get lost if you don’t know much terminal. You start off in a terminal, you have to format and install onto a hard drive manually, you have to configure the internet manually, you have to install a UI manually, it’s really is for the true geek. You get the best privacy and security with this OS though because they have packages always up to date which means you get security updates really quick. Some things requires you to use the user repository which is hard to use unless you have yaourt installed.

7. BSD Variants
I have not tried NetBSD, PC-BSD or OpenBSD, but I’m assuming it’s similar to FreeBSD. These are true UNIX solutions which means many of the programs that works on Linux will also work on these systems with minor or no changes to the code. The only issue I have with BSD is I do not know how well support is as it’s even less popular than Linux. Mac OS X has some things based on FreeBSD like the user space and Juniper (a commercial router company), and Netflix uses FreeBSD as their core OS.

From what I’ve seen, installation is similar to that of Arch Linux, so it’s not made for the common user who doesn’t know much about terminal.








I haven’t posted in a long time, so may as well post images of my desktop internals.

They have nice specs. They run UNIX/Linux 90% of the time. The gaming machine is the only machine that runs Windows and it runs it with the web browser sandboxed and in an standard user account. I don’t want those drive by sites taking over the machine. Usually when I download something for it, I download using UNIX/Linux and scan it before moving to the windows side. Something you will learn about me is I can’t trust windows.

Photo of media server.


Photo of gaming machine.


« Older posts Newer posts »

© 2020 Mr. Gecko's Weblog

Theme by Anders NorenUp ↑