The Boring side of Privacy - Kieran Mesquita | ETHDam 2024

[Music] now we have uh I wouldn't call it super boring but we've got the boring side of privacy with uh Kieran mosquito who is uh not a non-chilling moon maath you know talking about weird crypto stuff so please uh welcome him to the stage [Applause] so you got your clicker here perfect hello there we go okay so uh the boring side of privacy um well I think we've had like plenty of uh cool interesting uh crypto projects um building things and probably going to hear a lot more um later in this conference um but the aim of my talk here is um hopefully uh people in this room maybe uh can leave it um having improved their personal privacy uh just a little bit um so we'll go over a few uh things that you can do like right now if you want to get laptop out or um you know do this later uh that you can do right now to um make your you know personal privacy just a little bit better um cool I'm going to start talking about tools that I use um probably the number one way that um we interact with web 2 stuff and probably web 3 stuff as well but um number one way that we interact with the wider internet is through uh web browser right um I think most people probably use Chrome um maybe this demographic might be a bit different but um it's not great privacy wise right so um there's a couple of options that you could use um you've got Brave Liber wolf um Firefox uh with a custom user JS um I think the most important thing um here specifically it's because you're um because you know it's sort of the primary um way that you interact with a lot of things um you want something that just kind of works uh doesn't really get in the way too much um so personally I think I've switched to Brave it tends to be fairly sane uh defaults but some other options you've got Libra wolf uh which is um a little bit more aggressive on the Privacy side of things um it's a custom build of Firefox um and so it it tends to be a bit harder um to just have like a working experience sometimes but um that's also an option and um you've got Firefox with a custom uh us ajs so um that's a bit more involved takes a a little bit more time to uh set up but you know you can kind of have a bit more uh of a tailored experience if you go down that route um they're all kind of googleable if you want to uh go and do that um cool I think this one's fairly self-explanatory um so if you're using Google please pick an alternative um they're all they're all pretty good uh the the differences between them um so you've got things like uh you've got uh things like um you know Brave and and duck. go which have their own crawler um and then you've got um other alternatives so start page um which um uses another search engin crawler the uh benefit of using something like start page is that you um you're not leaking your like individual uh queries just still sort of aggregate um like being in this sorry no Google in this case is still able to get like sort of an an aggregate idea of what people are searching but um you're individual you're not individually identifiable um the downside of that is maybe if you uh don't particularly like censorship um or maybe the way that Google specifically does censorship um this might not be a good good um option for you but Google's probably got the best like web crawlers out there so it choose your trade-off um and you know if you if you want to go a little bit uh harder on um uh being private with your search engine uh there's uh CX which um you know you can run your own and it kind of just lets you query uh things locally it has its own indexer and um there's you know multiple Community run um um Community run uh SE uh nodes out there as well that you could use um email so there's a bit of a caveat here um if you're using Gmail Maybe here's some Alternatives um so there's proton mail I think personally um I found that to be the nicest ux uh it's great if everyone that you're communicating with uses pgp uh because it does quite like it does natively use pgp um and you know all of these kind of have a a built-in like calendar as well so you can migrate your Google calendar across um but you know if you don't want to use prot mail to not a good um alternative um the downside of the top two there is because they use zero knowledge encryption um if you forget your password or something and you don't have your recovery key then uh you will lose access to your email so um if that's something that you don't want to happen uh there is the option uh of start mail uh start mail uh the way they handle um making it as difficult as possible for people to uh you know gain access to your account um or compel decryption is um there's a couple of different um you know the the founders sort of live in a few different places in in different jurisdictions um and they're all required to to participate in order to uh decrypt and and get you access to your account again um and you know if you just want to use your existing email uh Thunderbird with open pgp probably works fine um but I think you know switching to one of the other um email providers up there is a better option um there is a caveat with email if you're discussing things that are like really sensitive it's not really the best medium to be using um you know maybe you want to use a private uh messenger but um you know what we still kind of require email for a lot of things you know signing up for accounts and all so um here's here's some options all right uh Tua um this one's you know fairly self-explanatory I think the the like number one tofa app that I've seen um recommended is Google Authenticator um is great you should be using tofa but if you want to be a little bit more private um switching to either tfas or uh ente both are crossplatform both seem to work pretty well for me um you know we'll kind of decouple you a little bit from Google um I know Google Authenticator um introduced a sort of sneaky um you know off device backup which is kind of not ideal for to a phase so um switching Heroes is both like good for privacy and um maybe security um next one okay so you know we talked about email and email not being ideal for um actually discussing sensitive matters um so maybe you might want to do it over a a good Messenger right um some options yes uh okay I'll I'll get i'll get to that in a second so you've got signal which is kind of the your like gold standard for um you know encryption uh it's generally regarded as as pretty um pretty good um there's an like you've got the alternative for uh status as well which is like a peer-to-peer um uses your like eth address and know there's log us people in the room somewhere as well um you can go and ask them questions about how it works um but um those are two options for you know reasonably good uh user experience but also still like reasonably good uh privacy um in your messaging application uh if you're doing something that's really really uh sensitive and you can't for whatever reason meet up in person to discuss it um you know obviously the ideal is meet up in person leave anything with a microphone at the door and and and talk privately but if that's not possible um we've got things like bri talks and speak um all three of them run over uh tour um and the idea behind them is essentially you're able to uh spin up like a uh identity so it's just a public key um you can share it over um another um you share your public Keys over another medium so maybe you message them to each other over signal um for example um and it just sets up a little um like tour rendevu um chat right um or tour rendevu connection and then you can chat over that um and then when you're done uh because none of the uh data ever leaves like your device or the uh tour tunnel um you just delete the app and like the record of that Comm communication is is um uh well hopefully erased um and the last one up here because you know we we do end up working in teams like all things aren't just direct um personto person um you know talking in like a a work context or a signal um is not the easiest to manage and and so rocket chat is an alternative to like you're sort of like a slack um that is uh private although I wouldn't consider to be as private um as as some of the others uh video calls so uh Zoom um a while back you know did a little update to the ATMs of service saying that yeah we can use your um call um we can use your calls to go and train AI um which you know I I don't know what people stances are on AI but it's not good for privacy um so there's there's two options up here um if you're you know willing to self host uh there's jitsy meet run run it on your own infra and everything um but if you just want something like you can just go and use uh you've got Brave talk um which is basically jitsy meat just someone else runs it um so depending on how how much effort you want to put into it um either of those two work fine uh note taking so oh okay uh not taking so um there's two options they're both uh end to end encrypted um standard notes and notes no um so these are your alternatives to things like Google keep um if you're on like in the Apple ecosystem to be honest um you know iCloud notes probably works pretty well um if you go into like your settings and and turn on I forget what Apple calls it like paranoid or um like heightened security modee or something um it does end up like actually being end encrypted um but but those are two two options that are both crossplatform um and keep your notes nice and safe Maps um this was the hardest uh for me to move away from from like Google or big tech services um Google Maps is a very very good service but um yeah here's here's some options so open street maps on the web um and the other two are just really uh front-end applications that use open street maps in the background um I think the cool thing about both of them is you can actually just straight up like download the the maps and like trails and stuff that you want offline and now like if you're somewhere um you know traveling and you don't have internet um or you know you've got unreliable internet well you've got reliable maps at least um which is useful um see DNS okay so leaving the standard uh just alternatives to Applications uh behind um that QR code goes to a couple of uh tutorials that I've written on how to like set up uh private DNS on each um platform so as Android um iOS Mac OS Windows um personally I think I found quad 9 to be like quad the one that I use I haven't really found anything else that I'm like quite happy with um if you don't want to go so that Q code the tutorial um walks through setting it up at like an OS level if you don't want to do that and want something a little bit easier um there's some applications up there that are um are option so like Unbound on your laptop desktop whatever nebulo and and DNS cloak on your uh phones um so DNS is probably like the the one thing that people kind of think about the least when they're trying to set up their devices to be a little bit like be more private um you know all traffic um on the Internet is basically TLS by by default now uh which is good but um you know you still end up leaking a lot of metadata on what sites you're visiting um just purely by your DNS queries um if you're you know using your computer at home the DNS server that you're using is probably either like Google DNS or your isps so um with that um The Underneath quad 9 there's a few terms over there so like DNS over TLS and uh DNS over htps which are both standards for um encrypting your DNS traffic so um you know anyone watching your network can't actually see what what DNS queries you're making um okay vpns got a bit of an asteris on this one um I have to address that anyway so I think for like the the reason that most people use a VPN is okay I'm on like public Wi-Fi and I don't want someone else on that on that Land network to to Snoop in my traffic um that's not as big of a deal nowadays with TLS being everywhere but you know still I guess better safe than sorry um I think for that specific use case actually just running a yod um setup so yod will just let you self host a VPN on pretty much any like connection um computer that you want um so like the the best thing if you're like worried about public Wi-Fi in my opinion is like run y God on your computer at home and then whenever you're at coffee shop working you can just like connect to your uh home um home internet and like route all of your uh traffic through that um if you want to use like a VPN service um there proton and and mvad which tend to have pretty good encryption um and I mean as far as I can tell are run pretty well um maybe be careful about like just installing any random uh uh VPN so yeah I know like Facebook uh recently got caught um using a VPN app that um they they partnered or owned um but basically using the VPN app to um Access Network traffic on uh users devices which is not great so um you know using like a a sketchy VPN provider you're actually just trading like you're trading your isp's ability to log your uh traffic for the VPN provider like your VPN provider ends up being your ISP right so please don't choose a getet you VPN provider um dvpn like I know where in crypto there's quite a few um projects um I have questions come show your dvpn project to me afterwards like I'd actually be interested in learning about it if anyone here is working on that um all right cloud storage so for uh things that you just want to synchronize between devices you've got sync thing um which is an open source um just like a folder synchronization program you can install on on like your phone your laptop or two laptops or whatever your setup is and it'll just keep those folders in in sync um if that's all you want then that's probably what um you want to use um I know there's there's some other like so there's there's things like Google photos and all which um specifically for photo storage provide a lot of cool features that you can't just get from like a simple file sync program um you know things like being able to like browse through your photos by date or um going through and like seeing the actual previews without like downloading all of the photos for example um so you've got something like uh ENT as a um option for that so that is an encrypted um photo storage uh service um if you absolutely have to use a um like a a cloud um storage service so um whatever that may be like Google drive or something maybe you want to like make sure that you've got a copy of whatever you're syncing um on something that you don't directly own so it's like oh if I lose all my devices I still have like a copy of that data somewhere uh you can use a program called cryptomator which will um actually encrypt all of your um all of your data locally and then just like place that in the in the sync folder that your cloud service uses and now you sort of just bring your own encryption to whatever whatever um cloud service you're using um the just use it like options you got Mega pram drive file n um which just like you just install the app and it's roughly equivalent to just downloading like one drive or Google Drive um but you know I'd still prefer to use it with cryptomator um and if you want to self host the option there is nextcloud um file sharing so let's say you've got um you know you're you're like talking to someone a signal or whatever and like you want to send them a file that's like above the file size limit for whatever um whatever application you're using right um you've got a couple of options here to send that um securely you can send it using just actually just zip it um and then like use szip Ora um set a password on it you can share that password through your um secure messaging application uh just make sure that when you um zip the file you encrypt it with specifically as26 encryption um and you can send it or you know seven up as well um and if you don't want to like deal with files and all you can use something called onion shair which uh similarly to the um like ephemeral chat applications that I was talking about earlier just you know you uh establish a connection over tour and then send the file and then uh get rid of the con connection afterwards um but th those are your two options um language tools I assume a fair number of people in here are uh a little bit nomadic like me um travel to places where maybe you don't speak the uh language there um you know Google Translate is like reasonably effective right but again like we care about privacy um so uh what what I tend to use is a linga translate it's just a like a front end to Google translate that you know um again it's sort of like uh Google can see all of the queries in uh bulk um but it makes it more difficult to like individually attribute um a particular like translate query um to you specifically and because I'm absolutely terrible at writing um uh I I've I've used a language tool as um sort of an alternative to grammarly um it's a nice private like grammar spell checker um helps me write better sometimes I don't know how effective it is but yeah um all right so another thing that people maybe don't think about much is um on phones um a potential way to uh leak your privacy or reduce your privacy is actually through the um keyboard that you use um on iOS the system keyboard is actually reasonably good but on Android um the default um if you got a Samsung uh thing is probably Flex key um or uh something to that effect if you're um on more or less any other um Android manufacturer you're probably using uh gboard so Google's keyboard um you can switch that keyboard out for uh one of the options here so Floris board or open board open board gives you a very similar feel to um Google keyboard if you just want to like simple switch out um and I find Flor Bo to be a little bit like nicer uh you y wise but those are both uh options to make sure that um you're not like leaking uh any of your like private Secrets through uh things like uh autoc correc and and uh you know data that get S sent off uh for things like that um and since we have probably a reasonable number of devs here this is a hackathon um the last little thing I have here is if you're using vs code which I think uh a lot of people uh here would be doing um an option just to switch out is vscodium um so vs code is actually like the if you download the build from uh Microsoft isn't actually the um open source just directly the open source uh code that gets published it's um Microsoft uh produces builds of vs code with extra Telemetry uh baked into it right so uh vs codium is just a a build purely of the open source uh code um off that like obvious code so you don't end up with any of the extra bundle Telemetry um and you know if you're like a crypto Dev maybe you're like a little bit more protective of the sort of um I don't know like environment Secrets or things like that that might exist in your in your de environment um something to keep in mind is it does like very rarely break some of the like extensions that um that like depend on some of the Microsoft services that get bundled with vs code but that's that's very rare and uh domain registration you've got uh inala which is a nice little way to to like anonymously register domains um now I got a SCH slide if you want to go and pump my social numbers um this that but otherwise hopefully you end up uh you know doing some of the some of the things that um talked about and and a little bit more private in your personal life [Applause] awesome thank you so much we have a couple questions from the audience real quick for us to uh for us to talk about um first thoughts on obsidian for note taking um yeah the mic would be helpful I'll grab that again um uh obsidian I have used obsidian I do like the like markdown formatting um it just kind of annoyed me with uh some of the limitations on sync and so I I switched to some of the other uh one of the others yeah all right how do iCloud notes and Google keep compare in terms of privacy um I think so Google keep is as far as not taking applications go is probably like the worst you can do in terms of privacy um iCloud notes is actually a little bit better um it does have encryption um and like if you're using like if you're in the Apple ecosystem um and are like using these these Services what you can do is there is a specific setting that you can go and turn on in iCloud which uh makes everything like purely end encryption uh end to end encrypted uh the downside of that is like if you lose access to your like devices um Apple can't reset things for you right so you lose the ability to like password reset and like gain access to your data again um but if you value privacy maybe that's a trade off you're willing to make all right cool thank you and um I have a question for you are you ready for your next panel yes awesome cool thank you so much for your presentation and teaching us all how to be more private [Applause] [Music]