Another great resource for privacy is https://privacyguides.org. I assume most of the recommendations there are approximately the same, but they may list additional private alternatives for some software.

I used to be pretty active in the online privacy community (PrivacyGuides, GrapheneOS, etc.) and I've seen a LOT of absolutely terrible misinformed privacy advice. Your guide doesn't seem to parrot any of that, which is really refreshing to see.

From a quick glance, there are only two (pretty minor) issues I can find in your guides:

Your VPN section explains how VPNs hide your activity from the ISP, but they don't seem to mention the fact that they just shift the trust from your ISP to the VPN provider. Yes, Proton is definitely more trustworthy than ISPs in authoritarian countries, but I think it should still be mentioned that VPNs don't make you anonymous and you still need to trust a third-party with your traffic.
You recommend F-Droid for app downloads, which is fine, but it has some fundamental security issues and it's considered better nowadays to use things like Obtainium. See here and here for more information.

Reply

[-]Rana Dexsin2h30

Slight format stumble: upon encountering a table with a “Cost of tier” column immediately after a paragraph whose topic is “how to read this guide”, my mind initially interpreted it pretty strongly as “this is how much it will cost me to obtain that part of the guide”. Something like “Cost of equipment & services” would be clearer, or “Anticipated cost” (even by itself) to also suggest that the pricing is as observed by you at time of writing (assuming this is true). You could also add a sentence like “The guide itself is free of charge, but some of its recommendations involve purchasing specific equipment or services.” to the previous paragraph.

Reply

[-]jbash27m20

Good work.

I do really mean that it's good stuff. Most people would be a lot better off if they did it. But of course it's traditional to whine.

On contacts, do you want to remind people that their associations can still be identified through the associates' contact lists? People give out their contact information like it's going out of style. Not to mention doing things like uploading metadata-laden pictures with your face in them, and probably other things that would come to mind without too much searching. It's really hard to keep people from leaking information about you.

I know it's hard to tell people not to use so many damned cloud services, but jeez do people use too many damned cloud services these days. Not only is whatever you put on one of them exposed to anybody who can infiltrate or pressure the operator, but, since they tend to get polled all the time, each of them is another opportunity to get information about what you're up to.

Calling Proton Mail "E2EE" is pretty questionable. Admittedly it's probably the best you can do short of self-hosting, but there's a lot of trust in Proton. Not only do they handle the plaintext of most of your mail, but they also provide the code you use to handle the plaintext of all your mail.

Signal is surely the best choice for centralized messaging, and in the past I wouldn't have said that normal people (in the US) needed to be worried about traffic analysis... but it's not the past and I'm not sure normal people in the US don't need to be worried about traffic analysis. The legal protections that have (mostly) kept traffic analysis from being used for civilian mass surveillance look a lot less reliable now. Using a centralized service, with a limited number of watchable servers, makes it relatively easy to do that, even if you do it via a VPN and even if the servers themselves are out-of-country. Session, Briar, or Jami might be alternatives. Of course, the reality is that you can only move to any of these if the people you communicate with also move.

Migrating from X to Mastodon or Bluesky gets you some censorship resistance (although note that Bluesky isn't really effectively federated). Nostr would get you more, at the cost of a worse experience and, in my opinion, a much worse community. But, especially since this is a privacy guide, maybe what most people should really be doing is thinking hard about what they really need to trumpet to the world.

I think there are probably occasions when even relatively normal people should be using Tor or I2P, rather than a trustful VPN like Proton or Mullvad. [And, on edit, there is some risk of any of those being treated as suspicious in itself].

I'd be careful about telling people to keep a lot of cash around. Even pre-Trump, mere possession of "extraordinary" amounts of cash tended to get treated as evidence of criminality.

Reply

Moderation Log

Tier	Time for tier	Cost of tier	Protection level
Quick start	50 minutes	$0	Online accounts secured against most hacking. Limited private communication ability.
Privacy basics	90 minutes upfront + 45 minutes for YubiKey setup when it arrives	$110 + $13/month	Significant privacy against mass surveillance. Govt. has a harder time seeing who you talk to and can't easily monitor what you say on the Signal app.
End-to-end encrypt your data	At least 4.5 hours	$14/month	Mass surveillance unlikely to capture your important data or communications.

Your situation	Threat level	Recommended sections
Living in a stable democracy, a Trump supporter who does not belong to any marginalized groups	Low	Quick Start & Privacy Basics
US citizen who does not support Trump	Medium	This guide and the sequel, all sections
Immigrant, journalist critical of regime, opposition politician	High	Both guides & consult security professionals
Facing imminent arrest or deportation	Critical	This guide is insufficient—seek legal counsel immediately

LESSWRONG
LW

LESSWRONG
LW

75

An Opinionated Guide to Privacy Despite Authoritarianism

75

75

What should I read?

What's your risk level?

What information this guide will and won't help you protect

Overview of the technical recommendations in each post

Privacy Despite Authoritarianism

Advanced Privacy Despite Authoritarianism