Good work.
I do really mean that it's good stuff. Most people would be a lot better off if they did it. But of course it's traditional to whine.
On contacts, do you want to remind people that their associations can still be identified through the associates' contact lists? People give out their contact information like it's going out of style. Not to mention doing things like uploading metadata-laden pictures with your face in them, and probably other things that would come to mind without too much searching. It's really hard to keep people from leaking information about you.
I know it's hard to tell people not to use so many damned cloud services, but jeez do people use too many damned cloud services these days. Not only is whatever you put on one of them exposed to anybody who can infiltrate or pressure the operator, but, since they tend to get polled all the time, each of them is another opportunity to get information about what you're up to.
Calling Proton Mail "E2EE" is pretty questionable. Admittedly it's probably the best you can do short of self-hosting, but there's a lot of trust in Proton. Not only do they handle the plaintext of most of your mail, but they also provide the code you use to handle the plaintext of all your mail.
Signal is surely the best choice for centralized messaging, and in the past I wouldn't have said that normal people (in the US) needed to be worried about traffic analysis... but it's not the past and I'm not sure normal people in the US don't need to be worried about traffic analysis. The legal protections that have (mostly) kept traffic analysis from being used for civilian mass surveillance look a lot less reliable now. Using a centralized service, with a limited number of watchable servers, makes it relatively easy to do that, even if you do it via a VPN and even if the servers themselves are out-of-country. Session, Briar, or Jami might be alternatives. Of course, the reality is that you can only move to any of these if the people you communicate with also move.
Migrating from X to Mastodon or Bluesky gets you some censorship resistance (although note that Bluesky isn't really effectively federated). Nostr would get you more, at the cost of a worse experience and, in my opinion, a much worse community. But, especially since this is a privacy guide, maybe what most people should really be doing is thinking hard about what they really need to trumpet to the world.
I think there are probably occasions when even relatively normal people should be using Tor or I2P, rather than a trustful VPN like Proton or Mullvad. [And, on edit, there is some risk of any of those being treated as suspicious in itself].
I'd be careful about telling people to keep a lot of cash around. Even pre-Trump, mere possession of "extraordinary" amounts of cash tended to get treated as evidence of criminality.
1
1
I've created a highly specific and actionable privacy guide, sorted by importance and venturing several layers deep into the privacy iceberg. I start with the basics (password manager) but also cover the obscure (dodging the millions of Bluetooth tracking beacons which extend from stores to traffic lights; anti-stingray settings; flashing GrapheneOS on a Pixel). I feel strongly motivated by current events, but the guide also contains a large amount of timeless technical content. Here's a preview.
This guide will help you protect your communications and information so you can think and speak freely. The privacy won't be perfect, but it should give you breathing room. As more people reclaim their privacy, their networks grow more secure and resistant to authoritarian punishment.
Obligatory disclaimer: I work on AI alignment at Google DeepMind but am only expressing my own views.
What should I read?
This guide is long. Don't try to complete it all at once. My website has long-lasting checkbox functionality (my site hosts the article you are previewing). As you complete items, check them off to remember your place in the guide.
Each tier builds on the previous, so do them in order.
What's your risk level?
This guide is about protecting yourself, but it's not necessarily about hiding. I personally think what's going on right now is horrible and that most citizens should act. At the same time, you should take intelligent risks via intentional public statements—not avoidable risk because the government spies on your private communications.
⚠️ Warning: These posts do not suffice to protect you against targeted surveillance. If you're at risk of that, read this guide and the more advanced sequel but also refer to a more hardcore guide with targeted surveillance in mind and consult a security professional.
What information this guide will and won't help you protect
If your phone is connected, cell towers track your approximate location. License plate readers track your car. Facial recognition identifies you in public spaces and others' photos. You will be hard-pressed to turn invisible while participating in modern society.
This guide will teach you to protect a limited selection of your data:
In high-risk situations, leave wireless-enabled devices at home, in airplane mode, or in Faraday bags for truly sensitive meetings. Otherwise, pessimistically assume the government knows where you are at all times. Also, financial privacy is hard and this guide only helps a bit on that front.
Overview of the technical recommendations in each post
Privacy Despite Authoritarianism
Tier 1: Quick-start essentials (50 minutes, free) Bitwarden password manager, Proton Authenticator for 2FA, Signal for E2EE messaging, iOS Advanced Data Protection, strong device passwords.
Tier 2: Privacy basics (90 minutes + 45 min, $110 + $13/month) ProtonVPN with kill switch (though iOS/macOS breaks VPNs), Brave browser, privacy search engines, two YubiKeys for hardware 2FA, minimize app permissions, disable geotagging.
Tier 3: End-to-end encrypt your data (4+ hours, $14/month) Migrate to Proton Mail, Proton Drive, Proton Calendar, Ente Photos, and EteSync—all E2EE. Commercial tracking feeds government surveillance via data brokers.
Advanced Privacy Despite Authoritarianism
Harden your hardware (12+ hours, $900+ or free) GrapheneOS on Pixel, Linux Mint (free) replacing Windows, GL.iNet router with OpenWrt for whole-home VPN & DNS-level adblock, optional Apple TV and Home Assistant.
Secure your digital footprint (3 hours, $15/month) Pseudonyms via Bitwarden, SimpleLogin email aliases, Privacy virtual credit cards, delete PayPal, opt out financial data sharing, local LLMs or Apple Private Cloud.
Advanced mobile & travel security (1 hour, free) LibRedirect privacy frontends, disable Bluetooth/Wi-Fi scanning (beacon tracking), disable 2G (stingrays), disable AirDrop, turn off devices at borders, generic device names.
Medium-term strategic shifts Emergency cash reserves (the regime threatens financial warfare), migrate Slack to Element (E2EE Matrix protocol), gradually leave X for Bluesky/Mastodon (federated censorship resistance).
The rest of the post is on my website. The main reason is that my site offers checkboxes to track progress on the many detailed recommendations. Continue reading here.