Contact me for feedback or questions! I reply to everyone.

Ninja's guide to the Internet

- Introduction -
- Operating systems -
- Web browsers -
- Browser extensions -
- Search engines -
- E-mail providers -
- Virtual Private Networks -
- The Onion Router -
- Darknet only setup -
- Instant messengers -
- Cloud storage -
- Text upload / sharing -
- Image upload / sharing -
- Video upload / sharing -
- Translation -
- Other services worth noting -
- Website hosting -
- On self-hosting -
- The Clearnet is doomed! -
- OPSEC -

Introduction

There are probably hundreds of guides to Internet privacy out there now, and most of them are terrible. They recommend browsers from evil companies like Mozilla Firefox; E-mail providers that collect LOTS of your data, such as Mailfence or Runbox; useless or malicious addons like Privacy Badger or NoScript; communication software that ask for your phone number like Signal or Telegram; suspicious VPNs like Proton; care too much about where a service is hosted instead of its policies or functionality; fall for false advertising; have "sponsored" recommendations; ignore very good providers and fail to mention essential things that you SHOULD do. My aim here is to create an ultimate guide which will hopefully not suffer from any of these issues. And the best thing is, you can do everything here for free! Why the Ninja's guide? Well, they hide in the shadows (archive). And it sounds fucking cool, doesn't it?

Operating systems

Can't avoid talking about them since that's what all your software runs on in the first place. Obviously, do not use Windows - it spies on almost everything you do (archive) and has auto-updates that cannot be turned off in the Home edition. Apparently some newer updates have allowed to disable some more of the spying, but that still doesn't salvage this system. Even if you disable all of the telemetry, Windows still sends 11 unsolicited requests per minute (archive). Of course Linux has its own problems too - Ubuntu has had spyware issues (archive) in the past, and systemd is pretty much an attempt at a takeover of Linux (archive) by big corporations. The best thing to do here is to use a Linux distribution without systemd, like Salix.

Web Browsers

Briefly, most browsers don't care about your privacy or even are actively malicious; many of those that aren't suffer from usability issues like no extension support. Ungoogled-Chromium or IceCat send no unsolicited requests and support add-ons. However they are dependent on the evil giants Google and Mozilla, respectively, so I suggest using a de-spyware'd and addon-hardened Pale Moon - which is independent from those. For more information read this article.

Browser extensions

The most important one, offering almost complete control of your browsing, is uMatrix. Decentraleyes is another essential one that works in the background, preventing connections to Content Delivery Networks (that could track you all over the Internet, due to being embedded on so many sites). WebRTC Control is essential for Chrome-based browsers to not leak your real IP through VPN / TOR. More information here.

Most so-called "private" search engines rely on either Google, Bing or Yahoo for results and can be considered compromised by default. Even worse is that many of them are doing their own tracking or have other flaws. The only ones which have their own indexes are Mojeek and Wiby - but both have very weak results. If you don't mind relying on the violators - a good SearX instance is your best bet. More information here.

E-mail providers

RiseUp is the best, and it's free - but you need an invite code. It does not require personal information to sign up, has onion domains, supports mail clients and unlimited aliases (allowing you to sign up in many places with different identities), as well as having a great privacy policy. Disroot does not need an invite code, but has no onion domains and a terrible spam filter which blocks legitimate providers; its alias feature is also paid for. From the commercial ones, Posteo is your best bet. Click here for a report which reviews the main players in depth.

Virtual Private Networks

Don't venture out without this! But be sure to get a trustworthy one. The only free provider worth its salt is RiseUp (UPDATE March 2022: it ceased supporting OpenVPN). Of course, you can always pay for a good one such as Mullvad - which will provide you with more servers all over the world, allowing you to bypass various blocks and bans. The VPN industry is dirty as fuck, though - so watch out when choosing one. Avoid custom "apps" that rob you of control - stick to WireGuard or OpenVPN (all free VPNs now require Bitmask, unfortunately). It is sad that - since RiseUp's deprecation of OpenVPN - my guide cannot anymore boast about being fully free (as in price) and still give the recommendations that I think are the best. So, in the end, you can get either deal with Bitmask or get a paid VPN supporting OpenVPN. Here's how to configure the latter:

  1. First of all, get an OpenVPN config file from your chosen VPN provider and put it in /etc/openvpn
  2. Now we will need to set up some firewall rules which prevent your real IP address leaking. Install the ufw package if you don't have it yet.
  3. In the config file, find a line that starts with "remote". Take note of the IP and port. Now type this into terminal: sudo ufw allow out to [IP] port [PORT]. Of course replace IP and PORT with the relevant values. This will let the system connect to the VPN through the firewall.
  4. Now find the line starting with dev tun. Change the tun to something recognizable, like tun_myvpn.
  5. Type these two rules into terminal: sudo ufw allow in on tun_myvpn and sudo ufw allow out on tun_myvpn. This will allow both incoming and outgoing connections through the VPN.
  6. Now type sudo ifconfig. Take note if the IP that appears after inet. This is your local (router) IP.
  7. Allow it through the firewall like this: sudo ufw allow out to [LOCAL_IP] . This will enable actually establishing the VPN connection.
  8. To set up your system to use the VPN's DNS servers instead of your ISP's. type sudo resolvconf -l. Now copy the nameservers and put them into /etc/resolv.conf (nameserver 172.27.0.1 for RiseUp, for example). Without this step, your ISP will still know every site you visit.
  9. Now make /etc/resolv.conf unmodifiable, either by chattr +i or putting nohook resolv.conf wpa_supplicant into /etc/dhcpcd.conf (my preferred option). This will prevent the system from overwriting your VPN's DNS servers with the ISP's.
  10. Finally, allow the VPN's DNS servers through the firewall; as before - sudo ufw allow out to [DNS_IP] (you've just typed the addresses into resolv.conf, so just allow all those). Without this step, you would not be able to connect to any domain unless you knew their actual IP address (since we've blocked the ISP's resolver).
  11. All that remains is to block everything except what we've just specified. sudo ufw default deny incoming and sudo ufw default deny outgoing. This is the part that actually keeps your shit secure.
  12. To enable the firewall on your system's startup, add this code to /etc/rc.d/rc.local:

    if [ -x /lib/ufw/ufw-init ]; then
    /lib/ufw/ufw-init start
    fi

    This is for Slackware-based distros and might not necessarily work on others. Search around for equivalents.

That's it for OpenVPN! However, web browsers can also leak your real IP address through WebRTC, so you're going to have to disable that as well. Firefox uses the media.peerconnection.enabled about:config entry, while Chrome-based browsers need an extension such as WebRTC Control (Pale Moon users do not need to do anything). An earlier version of this guide suggested turning off IPv6 system-wide, but it doesn't seem to be necessary if you do everything else right. However, some VPNs apparently do leak if you don't do that, so if yours is one of those, do all these steps just to be safe (earlier version had only step 1, but it seems it's not always sufficient):

net.ipv6.conf.wlan0.disable_ipv6 = 1
se net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Now run your VPN with a command such as cd /etc/openvpn; sudo openvpn [vpn_config_file.conf]. Then visit https://ipleak.net to check for leaks. A leakless result for RiseUp VPN, for example, would look like this.

Keep in mind you're still relying on trust for any VPN you use - theoretically they could choose to spy on you if they wanted to - but eventually, you'd think that information would come out (and has for some VPNs). Still, they are way superior to barebacking your ISP - who has your real name and address, stores all your logs, and will almost certainly work with the police. In case you don't think VPNs are enough - there fortunately are ways to improve your privacy even further:

The Onion Router

Moved to a separate article.

Darknet-only setup

Moved to a separate article.

Instant messengers

XMPP + OMEMO encryption is the gold standard. Gajim and Psi are the best clients for privacy and feature support, but they both require mitigation. I have a full XMPP guide now. Don't use Signal or Telegram (despite their sustained shilling) - they ask for your freaking phone number! Discord is even worse. WhatsApp is owned by Facebook - enough said. Skype works directly with the Prism program and used to redirect Chinese people to a modified version, which allowed the Chinese government to implement censorship and surveillance. XMPP is decentralized - anyone can run a server, so you should choose one with good privacy such as...well, just read the policies for yourself. Remember that XMPP stores your roster server-side regardless. Don't skip out on the encryption even if you're using secure software and server! That's the main takeaway here.

Cloud storage

Get into the habit of storing everything locally! And make fucking backups, holy shit - don't be the clown who loses everything because of malware, hardware failure, theft, or whatever. All you need is a spare USB drive or SD card. Anyway, I've researched most of the available free cloud storage providers and they either require your private data like name or phone number, don't support the English language, pretend to be free but are actually paid, or have other issues. Disroot is the only one with a passable grade - but Nextcloud is bloated and they will also delete your whole account if you upload something they think is against their ToS (unless you remove the offending file in 24 hours). If you do decide to use such services anyway, remember that you can password protect your files (for example, with the command gpg -c terrorism_manual.pdf) from the admins or other snoops, and still share them with the people you want to.

Text upload / sharing

AKA the famous pastebin. UPDATE September 2022: deep paste seems down, this seems to work similarly. A clearnet replacement is https://pst.moe or https://paste.cf. PrivateBin requires WebAssembly, necessitating the usage of bloated browsers, so I don't recommend it. Don't use Ghostbin (uses cloudflare, no privacy policy), 0bin (admits they don't care about protecting your uploads), or pastebin (the worst - stores your IP and other data, is not encrypted, admits to censorship [archive], uses Google Analytics and has targeted advertisements).

Image upload / sharing

Coinsh used to be here, but it died. Use lainsafe until someone makes another coinsh instance. Another option is ttm.sh (no IPFS integration, files remain for 30 to 365 days depending on their size). Keep in mind those hosts can store files for a long time. If you need fast file deletion, cockfile is your best bet.

Video upload / sharing

Unfortunately, nothing tops YouTube in terms of the amount of users and content. Regardless of its Google integration, absolutely terrible privacy policy, cluttered UI, shitty "features" like autoplay / auto-load next video as well as advertisements and massive censorship issues (archive) - we have to deal with it if we want the videos. There are two good ways of doing this - one is Invidious which debloats the UI and now does not require google connections to watch the videos (if you choose the dash quality as preferred in the settings). The other is youtube-dl, which, by downloading the video instead of using someone's server, completely avoids their issues like throttling etc. The video is now just a file on your drive - you do whatever you want with it. Of course, if you want "features" like comments, you have to succumb to the botnet and sign in with your google account (which I don't recommend, of course). What about the so-called youtube alternatives? Briefly - they all suck. Vimeo and Dailymotion have much less content and their privacy policies aren't good anyway. Bitchute requires a cloudflare browser check before you can even access it. Brighteon is anti-censorship but requires an invitation (really like the content there though). UPDATE: Rumble is probably the best if you really need an alternative video site. You can try some peertube instances but those could die at any time (obviously, since they are not supported by a big corpo) and there is so many of them that you can forget about gaining popularity as a content creator (since there is no big, centralized database for people to find your videos - a problem common to mostly any decentralized service). Unfortunately I do not foresee this solved until Google fucks with content creators so hard they all decide to pack up, leave and create their own YouTube alternative - which they aren't going to do as long as they earn the ad money - so capitalism has to die first.

Translation

Swisscows translator used to be recommended here, but it died. There are some local ways to do it, though I know nothing about them. UPDATE: one of our chat members has managed to install Apertium and said it works okay. UPDATE 2: a lean proxy for Botnet Translate now exists.

Other services worth noting

Cockfile allows you to store a file for 24 hours and alleges to keep no logs. The size limit is 5GB and there are some filetype restrictions. Disroot's Lufi is a similar kind of service with an up to 60 day timespan and 1GB size limit. It also encrypts your files so even the admins can't see the contents. Snopyta, in addition to what I've mentioned before, provides various other services such as Git, a YaCy instance (weak search results though, but completely decentralized), a Mumble (voice chat) server, collaborative editing and others - many of which have hidden services.

Website hosting

Neocities stands head and shoulders above other clearnet hosts - it has free 1GB storage, IPFS integration, in-built bitcoin donation as well as some quasi-social media features that allow you to find other interesting sites, post comments, etc. However, in terms of privacy or censorship, it is a black box (though I have not heard of any real case of the latter actually, I now have 2 examples of IMO baseless censorship that neocities did [where I knew the people personally], and one more possible [where I did not]). And so, I don't think neocities is so great now. It still requires recaptcha (edit: now hcaptcha, same issue with performing tricks) for registration and the privacy policy is really suspicious, I think they store everything (since they don't tell you what they store). FC2 is an alternative someone mentioned to me, also with 1GB storage but banning almost everything in their ToS and probably putting ads on your site. There's also tilde.club, which I don't know much about. Everyone else suffers from crippling flaws such as being paid for, requiring personal data, slow speed, enforced downtimes or ads (especially if free), and most importantly - shitty censorship policies (archive). Your best bet is to store your site on Freenet or find a host on the TOR network. All the mentioned hosts only allow static sites - the only free one that allows dynamic (PHP, etc) is HelioHost (but is slow and unreliable). An alternative is to host on a VPS, which is paid for and needs more effort / learning, but provides several advantages. Do consider if you really need it though, since Neocities should be perfectly servicable for most people.

On self-hosting

Even though a lot of people recommend it as a panacea - you do not need this if you just want to E-mail, chat, or browse websites in privacy. There are a lot of issues with self-hosting that are usually glossed over by its lovers. First of all, you have to pick the right VPS provider (the only good ones are Privex and Incognet) and pay them money every month (cryptocurrency accepted by the two given above). You have to install your own OS and take care of its security (learning how e.g permissions work will be essential). You will need to buy a domain and set up the DNS records - as well as SSL certificates - for it. Set up FTP to be able to copy files easier. All of those steps take a lot of effort and can break in a lot of ways (especially if you want to do something custom, instead of just following LandChad's instructions). Becoming a master of the command line will also be crucial (prepare to be typing mv, ls, chmod hundreds of times). By using Neocities, RiseUp, random XMPP servers, etc. you are offloading all the work to them - and for the vast majority of people, that is all that will be needed. Remember, also, that by using a VPS, you are putting all your eggs in one basket - one hack, government takeover, or ToS violation could compromise everything that's hosted in there. Whereas with varied providers each hosting a different service, one break means one point penalty - instead of instant full match loss (remember to backup everything you care about locally, such as chat members' accounts, config files, etc). Also, any additional service you host adds more maintenance effort, so there is no requirement to self-host everything.

With that out of the way, self-hosting does have significant advantages. So much so, that for anyone who is serious about taking control of their digital life - I do recommend it down the road. You get a lot more configurability for the services that you host. You decide how long your chat or mail server stores logs for (or what kind of logs). And you can change it all at any time. You get direct file access to everything on the server, bypassing the heavy limits that your provider's interface usually gives you. For example, deleting chat accounts en masse with the command line is now possible, as well as anything else you can come up with that would be denied by your usual provider. If you know coding, you can even set up your custom software in there (that no other provider would give you). The power given by this is insane - it's like sitting at home all your life, and finally leaving it to see all the beautiful seas, forests, etc. But it demands effort, responsibility, patience and passion - and is surely not for beginners.

The Clearnet is doomed!

In the end, whenever we use a clearnet service, we're relying on some server controlled by a stranger or big corpo that can install any policies it wants to and change them at any time. It can also die of course, and take your data with it (big corpos kind of resist that but still...). The Internet is being consolidated in the hands of a few players like Cloudflare, Amazon, Google, Twitter and Facebook. Did you know that, for example, even if the site you're connecting to has no elements from any of those, it can still go through their data centers (you can confirm that through a network monitor)? Not to mention the fact that all connections go through a few ISPs, which can not only install their own policies, but are also subject to the governments' increasing crackdown on free speech (or even free read) and privacy. To bypass these, we need to rely on decentralized solutions that are harder to censor or block. Some of them are ZeroNet, RetroShare, TOR and IPFS (all these have serious flaws), and Freenet, which is, IMO, the only decent one out of those (though not all that great either). Decentralization has many inherent flaws in general (some I've touched on in the Video section) - however, if the clearnet becomes unusable, we will have no choice but to move onto them, and wait for their inevitable improvement (or help make it happen if you can!). Freenet is the oldest and the only one available that allows hosting a site without being online 24 hours per day. It cannot be censored and can be made highly anonymous with proper security settings (you choose the level of compromise you're going to make). I recommend moving to it right now since I don't give the clearnet too much time from now on. But also read Avoiding "The Botnet" - impossible? for some clarification on decentralization and the internet in general (short summary: we will need the physical infrastructure eventually). But for now, Freenet is our hope!

OPSEC

Security / privacy is not just about software or services, but your behavior as well. Try not to put your personal data on the internet - such as name or phone number - as well as, preferably, any real life details which could connect your Internet activity to your real persona (people got their lives ruined by failing to heed this advice). Unless those details are something you want to be revealed - but then, do it with a new account on a platform that won't use it against you. E.g if you have a Reddit account with a thousand posts, you might not want to attach that to an event you've been at in real life, like a protest or something. It's a good idea to have several identities on the Internet anyway, even so that an account you care about is not "tainted" by something stupid you've said on a video game forum, or whatever.

Obviously, make regular backups of your data so that malware, a hack or disk failure doesn't destroy you. Have several layers of security - use TOR for any program that supports it, along with a VPN and trusted providers. Encrypt your communication as well as the data on your disk. For the really sensitive stuff, you might even want to use another installation or a whole new computer with a public WiFi network way away from your house (heads OS [UPDATE October 2022: this has not been updated in years, so use Tails I guess - or make your own OS] is often used for such purposes). Use different passwords for every account you care about. Delete all registration E-mail so that, in the event it got hacked, the attacker couldn't just "Remember password" for all your accounts. Obviously, don't download untrusted software, like scripts from shady imageboards (lol) unless you can read and understand the code (still, malware has happened even in official Linux repos (archive)). If you're hardcore, you could also sandbox certain applications with Firejail, or even use a security-oriented distro like Qubes or Whonix (since by default, applications in Linux have all the permissions of the user account they're run from). There's way more to cover here - entire books have been written about OPSEC - but this is a good start. However, if you're trying to do something that could really get you in trouble - go on the darknet, find people with experience, ask questions. Don't rely on this entirely unprofessional guide.

Back to the front page