Category: Privacy

Day One encryption

I have been using Day One for going on three years now. One concern I’ve had is that journals by default are encrypted but with Day One holding the encryption key. This means that someone at Day One might be able to access my journals. Journals with Standard encryption are also exposed to a data breach or security glitch. This has caused me to limit what I write in them.

Now, after reading Shawn Blanc’s ”Best Journaling App for iPhone, iPad, and Mac” on The Sweet Setup I’ve taken his advice and enabled End-to-end encryption for all my journals.

Shawn Blanc:

End-to-end encryption is not turned on by default for providing the best type of security for your journal entries, as users must maintain their encryption key at all times to unlock journals if necessary. As Day One’s FAQ puts it:

When using end-to-end encryption, it is essential you save your encryption key in a secure location. If you lose your key, you will not be able to decrypt the journal data stored in the Day One Cloud. You’ll need to restore your data from an unencrypted locally-stored backup.

We recommend turning on end-to-end encryption whenever you create a new journal to ensure your data is always kept safe and secure. Save your encryption key in an app like 1Password or a locked note inside Notes.app and never lose the key.

Now no one has access to my journals without the encryption key. I keep it in 1Password.

What you need to know about the tech giants Amazon, Facebook, Google, Microsoft, and Apple

I just finished reading Kashmir Hill’s series of articles Life Without the Tech Giants. Here’s what I learned. It’s impossible to get along without them even if we’re boycotting their apps. Amazon, Facebook, Google, Microsoft, and Apple dominate the internet in ways I never realized.

This should be required reading for everyone who uses the internet. It is an education in the way the internet operates and how dependent it is on these five companies.

This is a story of how, over six weeks, I cut them out of my own life and tried to prevent them from knowing about me or monetizing me in any way—not just by putting my iPhone in a drawer for a week or only buying local, but by really, truly blocking these companies from accessing me and vice versa. I wanted to find out how hard it would be—or if I could even do it—given that these tech giants dominate the internet in so many invisible ways that it’s hard to even know them all.

To keep my devices from talking to the big five’s servers, and vice versa, Dhruv a technologist built a custom virtual private network, or VPN, for me, through which I sent all my internet traffic. He then used the VPN to block my devices from being able to use the IP addresses owned by Amazon, Google, Facebook, Microsoft, and/or Apple, depending on the week.

Week 1 Kashmir blocks Amazon
I Tried to Block Amazon From My Life. It Was Impossible

After reading this, news broke that Amazon purchased Eero the WiFi router that I personally use. This had made a lot of people unhappy. They don’t want Amazon sniffing all their internet traffic. I think Zack Whittaker’s TechCrunch article What Amazon’s purchase of Eero means for your privacy frames how we should think about this perfectly.

Everyone seems to forget Amazon’s massive cloud business. Most of the internet these days runs on Amazon Web Services, the company’s dedicated cloud unit that made up all of the company’s operating income in 2017. It’s a cash cow and an infrastructure giant, and its retail prowess is just part of the company’s business.

Think you can escape Amazon? Just look at what happened when Gizmodo’s Kashmir Hill tried to cut out Amazon from her life. She found it “impossible.” Why? Everything seems to rely on Amazon these days — from Spotify and Netflix’s back-end, popular consumer and government websites use it, and many other major apps and services rely on Amazon’s cloud. She ended up blocking 23 million IP addresses controlled by Amazon, and still struggled..

Week 2 Kashmir blocks Facebook
I Cut Facebook Out of My Life. Surprisingly, I Missed It

Week 3 Kashmir blocks Google
I Cut Google Out Of My Life. It Screwed Up Everything

Week 4 Kashmir blocks Microsoft
I Cut Microsoft Out of My Life—or So I Thought

Week 5 Kashmir blocks Apple
I Cut Apple Out of My Life. It Was Devastating

Week 6 Kashmir blocks all 5
I Cut the ‘Big Five’ Tech Giants From My Life. It Was Hell

Additional reading by technologist Dhruv Mehrotra the person who built Kashmir’s custom VPN.
Want to Really Block the Tech Giants? Here’s How

Cloudflare’s 1.1.1.1 privacy-first DNS service is now available as an iOS app

I’ve been using Cloudflare’s 1.1.1.1 DNS service on my Mac since reading a post by Kirk McElhearn on the Intego Mac Security Blog about the service. The service was introduced April 1st of this year and is designed to be faster than traditional DNS services and more private which is what got my attention.

There are a number of things to explain here. First, DNS, or domain name system, is the system that acts like a sort of phone book on the Internet. Instead of having to remember a numerical IP address, such as 96.126.119.191, you can type intego.com to go to the Intego website. There is a huge directory that records the correspondence between these numerical addresses and domain names to facilitate Internet usage, and to make it easy to move a domain from one server to another.

Most people rely on the DNS server provided by their ISP or phone company. By default, your Macs and iOS devices look for this DNS server, which is either specified in your router, or in the server your iPhone connects to, in order to perform this address translation. But you don’t need to use this DNS server; you can use any one you want. In many cases, ISP’s DNS servers may not be the fastest ones, and this can have a big effect on your Internet usage. For example, if a web page is made up of multiple elements, that are not all hosted on the same server, your browser has to request these elements at a number of servers, and each different domain name requires a new request.

In addition, some ISPs may record the metadata of your Internet activity, or the requests you make: the websites you visit, the servers you connect to, and more.

Now, months after announcing its privacy-focused DNS service, Cloudflare is introducing an iOS app. Having had a good experience using 1.1.1.1 on my Macs I didn’t hesitate to install the iOS app on my iPhone and iPad. I’ve been running the app now for several days and it has been working great and definitely seems to be faster.

For instructions on setting up 1.1.1.1 on your Mac visit this page using your Mac and scroll down to Setup on Mac. For iOS, you can download the app from the App Store, or to set it up manually visit this page using your iOS device and scroll down to Setup on iOS.

Web Finds for October 26, 2018

Web Finds are from my web surfing travels. You’ll find some unique and informative news, apps and websites that you may have never known existed. Enjoy!

Apple’s Privacy Website Updated to Reflect Latest Measures Taken in iOS 12 and macOS Mojave – Mac Rumors
Apple updated its privacy website to reflect the latest measures it has implemented in iOS 12 and macOS Mojave to protect customers.
Via MacRumors

How to Request a Copy of Your Apple ID Account Data – Mac Rumors
Apple now allows its customers to download a copy of their personally identifiable data from Apple apps and services. This can include purchase or app usage history, Apple Music and Game Center statistics, marketing history, AppleCare support history, and any data stored on Apple servers, including the likes of calendars, photos, and documents.
Via MacRumors

Apple News’s Radical Approach: Humans Over Machines – The New York Times
Via The New York Times

Here’s How the New UltraFICO Credit Score Will Work
The biggest shift in three decades is coming to how FICO credit scores are calculated next year.
Via lifehacker

Previous Web Finds are here.

Web Finds for October 2, 2018

Web Finds are from my web surfing travels. You’ll find some unique and informative news, apps and websites that you may have never known existed. Enjoy!

Apple, Firefox tools aim to thwart Facebook, Google tracking
New protections in Apple’s Safari and Mozilla’s Firefox browsers aim to prevent companies from turning “cookie” data files used to store sign-in details and preferences into broader trackers that take note of what you read, watch and research on other sites.
Via AP News

National Cybersecurity Awareness Month: Cybersecurity at Home | US-CERT
October is National Cybersecurity Awareness Month (NCSAM), an annual campaign to raise awareness about cybersecurity. The National Cyber Security Alliance (NCSA) has published general tips to help you increase your cybersecurity awareness—including whom to contact if you are the victim of cyber crime—and protect your online activities.

NCCIC encourages users and administrators to review NCSA’s guidance for online safety basicsand the NCCIC Tip on Avoiding Social Engineering and Phishing Attacks for additional information.
Via US-Cert

How to Delete Your Facebook Account: A Checklist
Here’s a guide on how to delete your Facebook account.
Via lifehacker

Previous Web Finds are here.

Facebook gets hacked again. 50 Million users personal information put at risk.

I’m sure you’ve already read or heard about the latest Facebook hack involving the personal information of at least 50 million users. The hack was revealed in a Facebook blog post yesterday. If you haven’t here are the details.

Mike Isaac and Sheera Frenkel, writing for the New York Times

Facebook, already facing scrutiny over how it handles the private information of its users, said on Friday that an attack on its computer network had exposed the personal information of nearly 50 million users.

According to TechCrunch, Instagram and other third-party sites that use Facebook Login may not be out of the woods either.

In a follow-up call on Friday’s revelation that Facebook has suffered a security breach affecting at least 50 million accounts, the company clarified that Instagram users were not out of the woods — nor were any other third-party services that utilized Facebook Login. Facebook Login is the tool that allows users to sign in with a Facebook account instead of traditional login credentials and many users choose it as a convenient way to sign into a variety of apps and services.

As I’ve written before, now is a good time to delete your Facebook account. Between getting hacked and selling your personal data for advertising purposes Zuckerberg and his gang just can’t be trusted.

Facebook is using your 2FA phone number to target you with ads

Facebook has stooped to the lowest possible level. TechCrunch has exposed the fact that Facebook is using 2FA phone numbers to target users with ads. Zuckerberg and his gang are taking the number users are using to additionally secure their accounts and using it for ad targeting.

Some months ago Facebook did say that users who were getting spammed with Facebook notifications to the number they provided for 2FA was a bug. “The last thing we want is for people to avoid helpful security features because they fear they will receive unrelated notifications,” Facebook then-CSO Alex Stamos wrote in a blog post at the time.

I guess the bug wasn’t a bug after all. Just another Facebook lie.

Facebook has confirmed it does in fact use phone numbers that users provided it for security purposes to also target them with ads.

Specifically a phone number handed over for two factor authentication (2FA) — a security technique that adds a second layer of authentication to help keep accounts secure.

Here’s the statement, attributed to a Facebook spokesperson: “We use the information people provide to offer a better, more personalized experience on Facebook, including ads. We are clear about how we use the information we collect, including the contact information that people upload or add to their own accounts. You can manage and delete the contact information you’ve uploaded at any time.”

If you haven’t deleted your Facebook account yet now would be a good time to do so.