Contact me for feedback or questions! I reply to everyone.

Ninja's guide to the Internet

- Introduction -
- Operating systems -
- Web browsers -
- Browser extensions -
- Search engines -
- E-mail providers -
- Virtual Private Networks -
- Instant messengers -
- Cloud storage -
- Text upload / sharing -
- Image upload / sharing -
- Video upload / sharing -
- Translation -
- Other services worth noting -
- Website hosting -
- The Clearnet is doomed! -
- Other privacy sites -

Introduction

There's probably hundreds of guides to Internet privacy out there now, and most of them are terrible. They recommend browsers from evil companies like Mozilla Firefox; E-mail providers that collect LOTS of your data, such as Mailfence or Runbox; useless or malicious addons like Privacy Badger or NoScript; communication software that ask for your phone number like Signal or Telegram; suspicious VPNs like Proton; care too much about where a service is hosted instead of its policies or functionality; fall for false advertising; have "sponsored" recommendations; ignore very good providers and fail to mention essential things that you SHOULD do. My aim here is to create an ultimate guide which will hopefully not suffer from any of these issues. And the best thing is, you can do everything here for free! Why the Ninja's guide? Well, they hide in the shadows (archive). And it sounds fucking cool, doesn't it?

Operating systems

Can't avoid talking about them since that's what all your software runs on in the first place. Obviously, do not use Windows - it spies on almost everything you do (archive) and has auto-updates that cannot be turned off in the Home edition. Apparently some newer updates have allowed to disable some more of the spying, but that still doesn't salvage this system. Even if you disable all of the telemetry, Windows still sends 11 unsolicited requests per minute (archive). Of course Linux has its own problems too - Ubuntu has had spyware issues (archive) in the past, and systemd is pretty much an attempt at a takeover of Linux (archive) by big corporations. The best thing to do here is to use a Linux distribution without systemd, like Salix.

Web Browsers

Briefly, most browsers don't care about your privacy or even are actively malicious; many of those that aren't suffer from usability issues like no extension support. Ungoogled-Chromium or IceCat send no unsolicited requests and support add-ons. However they are dependent on the evil giants Google and Mozilla, respectively, so I suggest using a de-spyware'd and addon-hardened Pale Moon. For more information read this article.

Browser extensions

The most important one, offering almost complete control of your browsing, is uMatrix. Decentraleyes is another essential one that works in the background, preventing connections to Content Delivery Networks. WebRTC Control is essential for Chrome-based browsers to not leak your real IP through VPN / Tor. All other extensions are pretty much toys or distractions. Avoid malicious addons like NoScript, Ghostery and Stylish. More information here.

Since this section was getting too long, I've created a separate article for it. Briefly: the best one is Swisscows with good usability and no logs. Right after them come Disroot and Snopyta with their SearX instances that unfortunately don't go beyond the first page in results (but have a thousand other useful features; Snopyta's also has a hidden service). DuckDuckGo, MetaGer and Qwant are some other privacy-respecting engines with more or less significant flaws which make it inferior to the above. StartPage is not recommended at all due to getting its results exclusively from Google, which censors all alternative and conspiratorial content. There is lots more to say about this topic - highly recommend to check out my report to get a deeper view.

E-mail providers

RiseUp is the best, followed by Disroot and Autistici - though they either need a written justification or an invitation. Posteo is the best from the paid ones; there are no completely hassle-free ones that are really worth it. LOTS of providers out there that falsely pretend to care about your privacy - watch out! Read my full report here and remember to GPG-encrypt your e-mail locally (Claws Mail client supports that automatically). For registration, all of Autistici, Disroot and RiseUp have an alias feature - however, Disroot's is paid for and Autistici's reveals your main account in the headers, so RiseUp's is the best. With that and a few VPNs (see below), you have the ability to bypass all bans.

Virtual Private Networks

Don't venture out without this! But be sure to get a trustworthy one. My best free recommendation is the RiseUp VPN - but Snopyta does also provide one. Do not recommend ProtonVPN whose E-mail service leaves a lot to be desired, so we should expect the VPN to be the same. In general, OpenVPN does take a lot of setting up before it can be used - but when you're finished, it should be more reliable and secure than custom clients. Here, I've compiled the steps to doing just that to the best of my knowledge:

  1. First of all, download this script which will push the VPN's DNS servers to your system's resolver. Requires the openresolv package, so install that if you don't have it yet.
  2. Put the script in /etc/openvpn, make it executable (chmod +x update-resolv-conf.sh), and open your VPN's config file (as root). Put these three lines at the end of it:
  3. script-security 2
    up /etc/openvpn/update-resolv-conf.sh
    down /etc/openvpn/update-resolv-conf.sh

  4. Now we will need to set up some firewall rules which prevent your real IP address leaking. Install the ufw package if you don't have it yet.
  5. In the config file, find a line that starts with "remote". Take note of the IP and port. Now type this into terminal: sudo ufw allow out to [IP] port [PORT]. Of course replace IP and PORT with the relevant values. This will let the system connect to the VPN through the firewall.
  6. Now find the line starting with dev tun. Change the tun to something recognizable, like tun_myvpn.
  7. Type these two rules into terminal: sudo ufw allow in on tun_myvpn and sudo ufw allow out on tun_myvpn. This will allow both incoming and outgoing connections through the VPN.
  8. Now type sudo ifconfig. Take note if the IP that appears after inet. This is your local (router) IP.
  9. Allow it through the firewall like this: sudo ufw allow out to [LOCAL_IP] . This will enable actually establishing the VPN connection.
  10. All that remains is to block everything except what we've just specified. sudo ufw default deny incoming and sudo ufw default deny outgoing. This is the part that actually keeps your shit secure.
  11. To enable the firewall on your system's startup, add this code to /etc/rc.d/rc.local:
    if [ -x /lib/ufw/ufw-init ]; then
    /lib/ufw/ufw-init start
    fi
    This is for Slackware-based distros and might not necessarily work on others. Search around for equivalents.

That's it for OpenVPN! However, web browsers can also leak your real IP address through WebRTC, so you're going to have to disable that as well. Firefox uses the media.peerconnection.enabled about:config entry, while Chrome-based browsers need an extension such as WebRTC Control (Pale Moon users do not need to do anything). An earlier version of this guide suggested turning off IPv6 system-wide, but it doesn't seem to be necessary if you do everything else right. However, some VPNs apparently do leak if you don't do that, so if yours is one of those, do all these steps just to be safe (earlier version had only step 1, but it seems it's not always sufficient):