TheHackersManual2015RevisedEdition

Performance

How snappily do they run?

Verdict

JonDo Live

+++++

Qubes OS

+++++

Ubuntu

Privacy Remix

+++++

Tails

+++++

Whonix

+++++

Both Tails

and JonDo are modest on resources.

Privacy hacks

Desktop usability

Can you be anonymous and still enjoy a feature-rich desktop?

Verdict

JonDo Live

+++++

Qubes OS

+++++

Ubuntu

Privacy Remix

+++++

Tails

+++++

Whonix

+++++

Thebest offerfamiliar softwareand anonymitytools.

Good wiki pages, FAQs and other helpful documentation are important for any software. This

is certainly the case with anonymous distros that can be frustrating even for people familiar with Linux.

Tails offers in-depth end-user documentation with general information, first steps, commonly asked questions and detailed explanations for almost all aspects, even those not related to Tails directly, but it’s all essential if you want to study the basics of privacy and encryption. There’s even a chat room and a 'request a feature' form.

Ubuntu Privacy Remix has a neat and compact website, yet there isn’t that much materials, but the quantity of UPR resources corresponds with its feature set. You can find some helpful

how-to guides, such as instructions for creating a personal UPR build (with a custom software set).

Nearly all Whonix documentation resides in a dedicated and detailed wiki portal. We found it to be very comprehensive and more in-depth than the resources Tails supplies – Whonix has

more articles, more support options and a very active forum.

The Qubes OS project also has a wiki portal with essential and advanced articles. The OS architecture is explained in detail and there's an FAQ, tutorial slides and user documentation. Qubes OS has many extra features, such as running non-Linux AppVMs, and this is covered in a detailed manual.

There’s also a helpful developer's corner, which provides all you need to develop custom solutions.

JonDo has help topics, an FAQ, tutorials, a wiki portal and a forum. Though it looks complete, a thorough review shows many weaknesses. The FAQ is brief, and the wiki is very small. Very few topics are actually covered, which is disappointing.

Verdict

JonDo Live

+++++

Qubes OS

+++++

Ubuntu

Privacy Remix

+++++

Tails

+++++

Whonix

+++++

Whonix sneaks in front of Tails for it’s level of support.

1st JonDo Live-DVD +++++

Web: http://bit.ly/JonDoLive-DVD Licence: BSD Version: 0.9.71.2

Fast, portable, effective and easy to use for anonymous web surfing.

2nd Tails +++++

Web: https://tails.boum.org Licence: GNU GPLv3 Version: 1.2.3

Balanced for 'mostly' safe internet access. Also a friendly way to try Tor.

3rd Whonix +++++

Web: www.whonix.org Licence: Mainly GNU GPL Version: 9.6

Very usable and super-secure, but the hardware specs are quite high.

4th Qubes OS +++++

Web: https://qubes-os.org Licence: Mainly GNU GPL Version: R2

Very secure, but like riding a bumpy narrow road between concrete walls.

5th UPR +++++

Web: www.privacy-cd.org Licence: Mainly GNU GPL Version: 12.04r1

Consider it as a special-purpose distro for securing sensitive data.

Over to you...

Tell us about your anonymous web surfing experiences at lxf.letters@futurenet.com. What’s your favoured distro for privacy?

Also consider...

projects too, such as IprediaOS, Polippix and Mandragora that didn’t fit in this Roundup but are worth considering. In fact, it’s not too hard to turn your existing Linux install into a digital fortress. Almost all tools for anonymity on Linux are open source, including Tor front-ends, extensions and encryption methods. Θ

Protecting your information and your privacy go hand in hand and it all starts with limiting the information you give out to web companies. They

don’t always have your best interest at heart and some are infamous for selling or trading personal information.

The most basic way of being identified is through your IP address. From your IP address, a website can determine your rough geographical location, such as your city or area. This is fairly common technique exploited by web advertisements, which try to grab your attention by mentioning your location. IP addresses are dynamic, which makes them unsuitable

for tracking a user over time. But by combining your IP address with other tracking information, such as HTTP referrers and cookies and you can be easily monitored.

The job of the HTTP referrer header is to load the website you clicked on and inform it where you came from. It’s also sent when loading content on a web page. So if a web page includes an advertisement, your browser tells the advertiser what page you’re viewing. Some unscrupulous marketers embed invisible images in emails that take advantage of the HTTP referrer to track you when you open emails.

Tough cookie

Almost every website uses cookies to store information about the visitors and how they use the website. These are stored on a user’s computer but the user has little control over what information is stored within the cookie.

Cookies have plenty of legitimate uses, such as for storing settings and preferences on a website, eg online email services use cookies to remember your login details.

However, these cookies also allow the website to track you as you move around on their website. This might sound pretty harmless, but major websites such as Google aren’t just confined to a single domain. Google, as you may be aware, controls the largest advertising network on the internet.

As you move from website to website, in addition to displaying advertisements, the advertising system will also track the websites you visit. The advertising system then uses this data to display advertisements that are similar to the sites that you’ve visited.

Google is not alone in doing this, according to a survey by www.digitaltrends.com, there at least 125 different companies or company products being used to track your online activity through the top 100 sites. Many of these are simple advertising networks, but others are particularly nefarious. Take for example the Disqus comment widget.

It tracks information, such as a user’s posting history, IP address, and web browser version, across websites that use Disqus, even if the user is logged out. They also put the comments on public profile pages for each user.

While some online services offer an option to opt-out, many are opt-in only. You can opt out of the major tracking networks by visiting the Network Advertising Initiative’s OptOut page (www.networkadvertising.org/choices).

This online service will check your system for tracking cookies from participating ad networks and enables you to opt-out from them.

Additionally, all browsers offer options to zap cookies. You can also use the browser’s Private Browsing mode to ensure that the cookies are flushed when you close the window. This also prevents websites from learning where you’ve previously been. The mode is especially handy when using a public computer.

But there is one nasty little cookie that’s more invasive than a standard cookie. The Local Shared object (LSO) or Flash cookie, as its commonly known, is particularly dangerous because it isn’t stored with the other cookies and is designed to evade the commonly used privacy controls.

To restrict how Flash stores LSOs, visit Flash’s online settings manager (http://bit.ly/1m33E9X) and deselect the Allow Third-Party Flash Content To Store Data On Your Computer option. Note: If you go down this route of restricting the use of cookies then it will impact your web browsing experience, but the trade-off in regards to privacy is well worth it.

Make sure you check

Firefox’s

Privacy Preferences to block thirdparty cookies.

Did you know?

The NSA has been collecting a lot of metadata about internet traffic. Things like who’s talking to who, when and for how long. Metadata is a lot easier to store and analyse, and can be extremely personal to the individual.

Switch to SSL

One of the first steps you should take when navigating the Internet badlands is to encrypt your network traffic by switching to the Secure Sockets Layer (SSL) protocol. SSL uses certificates to create a secure, encrypted link between the visitor’s web browser and the web server that hosts the page.

The encrypted connection ensures that any data that’s transferred from the browser to the web server, such as your credit card details, remains private during transmission. The certificate is provided

by a certifying authority’ such as VeriSign and Thwate. All SSL encrypted websites will have a padlock icon in the browser window and you can click on the icon to get more details about the certificate.

However, there is one subtle danger to be aware of. There are several types of SSL certificates and some phishing sites have purchased legitimate certificates in order to trick people into believing they are trustworthy.

Keep an eye out for the Domain Validated certificates. These are pretty

cheap to procure, but do not provide authentication or validation of the business behind the website. Clicking on the padlock icon will not display any information other than encryption information. Other secure certificates will supply data about the organisation behind the website.

Every insecure network protocol has an equivalent secure one. For web browsing, there’s HTTPS, for transferring files there’s SFTP and SCP, and for remote logins there’s SSH.

JonDo’s interface includes the Anonym-O-Meter which gauges the level of anonymity offered by the active service.

law enforcement with the right paperwork. There is a wonderful writeup by TorrentFreak.com on which VPN services take anonymity seriously (http://bit.ly/1dvMqay).

When you’re looking for a VPN look for a service that supports OpenVPN and uses SSL/TLS for key exchange. Privacy conscious users will also want to pick a service operated from outside their home country. A service that has servers in multiple locations is always a better choice.

Embrace the onion

Another way to bypass censorship and maintain anonymity is to use a proxy server tool. The most well-known of these is the Tor network. Tor, an acronym for The Onion Router, is a software that creates a network to allow people to browse the web anonymously.

It creates a network of relay nodes across the Internet. When you visit a website using Tor, the data to and from your computer is bounced around these nodes before ending up at the website, which masks your origins from the website.

You can use Tor to visit websites that block visitors based on their geographic location. The easiest way to use Tor is via the Tor Browser Bundle to connect to the Tor network. (See Setup the Tor Browser Bundle, p48.)

One downside to Tor is that websites load slower as the network data goes through so many relay nodes in the middle. Further, some ISPs, particularly in China, actively search and block Tor relays, making it difficult for some users to connect. Also note that Tor only encrypts traffic from your computer to the exit node, which prevents your ISP from monitoring you. But since the traffic at the exit node is unencrypted, anyone that’s running the exit node can see your internet traffic. There are unconfirmed reports that many exit nodes are run by government agencies.

One way to negate the vulnerability at Tor’s exit node is to only use secure protocols (HTTPS, SSH etc) when using the Tor network. You can also use the Java Anonymous Proxy called JonDo, which uses interconnected proxy servers to conceal your IP address. JonDo is similar to Tor, however the

one major difference is that it only uses certified partners as nodes. Also you can choose which proxy nodes you wish to route the traffic through. You can view the location of its proxies and choose accordingly for increased security.

JonDo caps connection speeds of free users, but you can subscribe to its premium service, which is as fast as VPN services. The project also has details on how to pay for the service while maintaining anonymity.

I know JonDo

To use the service, download the Java-based JonDo client, extract its contents and run its installation script as root. The script will install the client under /usr/local. When it’s done you can launch it by typing jondo on the command line.

When it starts for the first time, an installation assistant will take you through a brief connection process. When it’s done, the app will connect to a proxy server. You can choose which proxy network you want to use from a pull-down list. The geographic location of each network is marked with its country’s flag.

In addition to the JonDo tool, the project also produces a secure profile for Firefox called JonDoFox. Or, you can download JonDo’s own Firefox-based browser called JonDoBrowser. You can download and install the Deb package for the browser from the project’s website or add their repository to your Debian-based distro. The

JonDoBrowser is preconfigured to work with the JonDo proxy. Furthermore, unlike Tor, you can use the JonDo app to turn off anonymity and still continue using the JonDoBrowser.

You can also use JonDo and Tor if you use a different browser, or a different network app, such as an instant messaging or email client. All you need to do is configure the applications to route all their traffic through these apps.

To route traffic through them, go to the app’s connection settings page and specify the following manual proxy settings. For JonDo, select the SOCKSv5 proxy and use 127.0.0.1 as the host and 4001 as the port. To pass the traffic through the Tor network, use 9150 as the port if you are running the bundle.

Also remember that if you’re a free user of JonDo, you can only connect to ports that are used for web browsing, 80 for HTTP and 443 for HTTPS. For other applications you have to subscribe to its premium services. Although it’s difficult to compare JonDo and Tor, many consider the former to be a safer option. Tor is more susceptible to internal attacks where a node operator itself attacks the network. The possibility of such attacks is reduced in JonDo since it screens its proxies.

Avoid being tracked by spoofing the MAC address of your network card, such as ifconfig eth0 hw ether 0A:A0:04:D4:AA:11.

have public keys, so you shouldn’t enable encryption by default. Enigmail can fetch public keys of contacts from preconfigured list of key servers and also create per-recipient rules for contacts whose public keys you have.

Encrypt your emails

By default, the Enigmail will create a 2048-bit key with a validity of five years. In addition to the key, you can also use the extension to generate a revocation certificate for invalidating a key, in case your private key is compromised.

Once you’ve created your keys, you should export it for safe keeping. Head to the OpenPGP menu and select Key Management. Right-click the key you want to save and select the Export Keys to File option. In the pop-up select the Export Secret Keys option to save both your private and public keys.

You should never send this file to anyone else. In fact, you should keep this file in an encrypted storage area (see Create and use a TrueCrypt Volume, p52). This file will help you import the keys on another installation or if you lose the keys.

To encrypt messages with the keys, compose a new message and bring up the OpenPGP menu from inside the Compose window. It’ll have options to Sign Message and Encrypt Message. It’s prudent to select them both and then continue writing your message as usual. When you click the Send button, you’ll be prompted for the passphrase. Type it in, and your email will turn into unintelligible encrypted text.

In addition to the body of the message, you can also use the Enigmail to encrypt any attachments as well. Just attach the files as usual, and Enigmail will take care of the rest.

However, if you use webmail service, such as Gmail or Yahoo Mail you can use the Mailvelope plugin for Firefox and Chrome browsers to send encrypted messages (see Encrypt Webmail, p50). The plugin uses the OpenPGP.js JavaScript library that brings the power of OpenPGP to web browsers. Encrypting your email alone will not protect them from a determined intrusive party. Law enforcement agencies and other motivated individuals can still force you to hand over

the keys. As a further precaution you can route the encrypted emails through the Tor or JonDo proxy networks. The TorBirdy extension will configure Thunderbird to make connections over these proxy networks.

Similarly you can also encrypt real-time communications such as instant messaging. The two most popular open source IM clients, Kopete and Pidgin, can encrypt messages via plugins. The Off-The-Record (OTR) protocol , for instance, enables end-to-end encryption for IM conversations. It’s implemented via the OTR plugin that you’ll find in the repositories of most desktop distributions. All parties must have the plugin to exchange encrypted messages, though.

Once you’ve installed and enabled the plugin, you’ll have to generate a private key for each configured account. From then on whenever you connect using that account, the plugin will automatically establish a private conversation if your contact has properly setup the OTR plugin as well.

There is one thing to bear in mind when using IM: Your