Privacy Guides

A Flaw With the Security Level Slider in Tor Browser

Jonah Aragon — Sat, 03 May 2025 15:00:00 +0000

A Flaw With the Security Level Slider in Tor Browser

Illustration: Jonah Aragon / Privacy Guides

Tor Browser and Mullvad Browser users should be aware of a flaw with the Security Level slider: Not all protections advertised by the browser are properly engaged until the browser is fully restarted.

This flaw was anonymously reported to Privacy Guides by a member of our community, and I confirmed it via the latest Tor Browser 14.5.1 on macOS. Additionally, I confirmed this behavior in Mullvad Browser 14.5.1 on macOS.

~~I was unable to find any documentation or open GitLab issues with Tor regarding the need to take additional steps before security settings are fully applied, and~~ Tor Browser documentation does not note that a restart is required, nor does it prompt users to restart the browser after security changes are made. (update: see below)

This presents a high risk to people who switch from Standard to Safer security during a browsing session with the goal to protect themselves from browser exploits.

Demonstration

The effect can be easily demonstrated in your own Tor Browser install by running a JavaScript benchmark such as JetStream 2.2. These benchmarks rely on a technology called Just-in-Time (JIT) compilation to improve performance, but JIT is linked to numerous security vulnerabilities in modern web browsers. The "Safer" security level normally disables JIT entirely to prevent these issues, however, you can see virtually no performance impact when switching to the Safer security level in Tor Browser and running the benchmark again:

JetStream 2.2 benchmark results in Standard mode

JetStream 2.2 benchmark results in Safer mode, without restarting Tor Browser

While the performance is virtually identical between these two runs, after restarting Tor Browser and re-running the test, we see drastically lower performance results, in line with what we would expect with JIT properly disabled:

JetStream 2.2 benchmark results in Safer mode, after restarting Tor Browser

As you can see, there is no visible indicator that anything is different between the last two runs, and there was no prompt to restart the browser after changing these settings. However, this clearly indicates that JavaScript technologies that are meant to be disabled in Safer mode can still be accessed by websites until the browser is restarted, potentially opening you up to browser exploits if you are unaware of the additional steps required to secure yourself.

Safest Mode

We have not tested or verified the full extent of security features which require a browser restart. We tested whether JIT remained enabled after switching to Safer mode because it was the easiest feature to test. Safest mode disables JavaScript entirely, so the demonstration above will not demonstrate this problem exists when switching to Safest mode.

However, it is possible that there are other features normally disabled by Safest mode which remain enabled until you restart your browser. Out of an abundance of caution, we recommend always restarting your browser after changing this setting, regardless of whether you are switching to Safer or Safest mode.

Conclusion

The Tor Project advertises the security slider as a way to conveniently adjust the protections that the Tor Browser provides, but does not note additional steps necessary to ensure those settings actually go into effect.

This is our public service announcement to make sure you always completely restart Tor Browser after adjusting your security settings. Relying on these indicators can create a false sense of security and potentially expose users relying on this security level slider to greater risk than they expect based on Tor Browser's UI and documentation.

Hopefully, Tor Browser will prompt or force their users to restart the browser after adjusting these settings in a future update.

Update (5/3): A few hours following the publication of this article, the Tor Project emailed us the following statement:

The Tor Project is aware of this issue, and it is being tracked and activelyaddressed. Those interested can follow the discussion and progress here:https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42572. Inaddition to a restart prompt, we’re also exploring broader improvements to thesecurity level system, including aligning it more closely with Tor Browser'supdated threat model[1] and possibly delegating even more of its back-endto NoScript for additional flexibility. These improvements may be part of theupcoming 15.0 release cycle.
[1]: https://gitlab.torproject.org/tpo/applications/wiki/-/wikis/

In Praise of Tor: Why You Should Support and Use Tor

Em — Wed, 30 Apr 2025 20:24:37 +0000

In Praise of Tor: Why You Should Support and Use Tor

Illustration: Em / Privacy Guides | Logo and icons: The Tor Project

You might have heard of Tor in the news a few times, yet never dared to try it yourself. Despite being around for decades, Tor is still a tool too few people know about.

Today, Tor is easy to use for anyone. It helps not only journalists and activists, but anybody who seeks greater privacy online or access to information regardless of location. But what is Tor exactly? How can Tor help you? And why is it such an important tool?

What is Tor

Tor is an overlay network that was specifically designed to protect the privacy of its users. The Tor Network uses multiple layers of encryption and relays in order to protect a person's location and other potential identifiers, such as an IP address.

Its name comes from the acronym for The Onion Router, a routing system using multiple layers that can get peeled off at each step, like an onion 🧅

This special network can be easily accessed by anyone, for free, through the Tor Browser. The Tor Browser is as easy to use as any other browser you are familiar with already.

Both the tools for the Tor Network and the Tor Browser are maintained by a nonprofit organization called the Tor Project.

The Tor Network

The Tor Network was deployed in 2002, although its core principle was developed in the mid 1990s. It was first created at the United States Naval Research Laboratory in order to protect intelligence communication online.

In 2004, the laboratory released the project's code under a free and open source license, and the Electronic Frontier Foundation (EFF) began funding its development. A few years later, the onion routing project officially became the Tor Project.

Today, Tor is one of the largest anonymity networks, with thousands of relays and millions of users worldwide.

How does it work

The Tor Network is run by a community of volunteers who operate the relays required for the network to function.

Each time someone uses the Tor Network, the communication passes through at least 3 relays: A Guard Relay, a Middle Relay, and an Exit Relay. Each relay has a different function to protect the communication.

The Guard Relay knows where the communication is from (IP address), but doesn't know where it's going (which website is visited, for example). This relay only knows that you want to access the Tor Network. Its task is to send your encrypted communication to a Middle Relay, but it cannot read it.

The Middle Relay doesn't really know anything. It doesn't know who you are nor where you are going. It only knows a Guard Relay wants to send encrypted data to an Exit Relay. The Middle Relay transfers this communication from one relay to another, and it cannot read it either.

The Exit Relay has no idea who you are. It only knows someone, somewhere, wants to access this website (or other content). The Exit Relay will get the information from the website, then send it back to the Middle Relay, so that you can receive it from the Guard Relay. If you only visit pages using HTTPS, the Exit Relay can know someone is visiting this website, but cannot know what they are doing on it. Visiting non-onion websites using HTTPS instead of just HTTP is very important for security and privacy.

Onion service websites

Onion service websites are special websites that can only be accessed using the Tor Network.

They are easy to recognize because they use the .onion domain at the end, and are often composed of a long string of seemingly random characters. Onion websites offer protections equivalent to HTTPS.

You can see this represented by the onion padlock icon in the Tor Browser.

How Tor works using a letter and envelopes analogy

Tor works a bit as if you put a letter (request) into an envelope with someone's address. Then, you put this envelope in another envelope addressed to someone else, with instructions. Finally, you put this second envelope in yet another one.

Each envelope protects the content of the other, and can only be opened one at the time by each recipient. In this analogy, each recipient (relay) has a key that can only open the envelope addressed to them, and not the others.

Illustration: Em / Privacy Guides

What is a Tor Circuit

The network of randomly selected relays to complete a request on the Tor Network is called a Tor Circuit. This circuit changes each time a new connection is established.

From the Tor Browser, you can see each relay that was selected for a circuit, and even change it manually. To generate a new circuit, click on the "Tor Circuit" button on the upper-left of the browser, then on "New Tor circuit for this site" at the bottom.

The Tor Browser

The Tor Browser was created in 2008 to facilitate access to the Tor Network. It is a modified version of Mozilla's Firefox browser, and can be installed on Linux, macOS, Windows, and Android systems.

The Tor Browser start configuration is private by default. No additional extensions are required to make it more secure or more private. Actually, it's even discouraged to install any additional extensions, as this would weaken its fingerprinting resistance.

Highest security settings

Even if the Tor Browser is configured to be private by default, if you are in an especially sensitive situation, for example if you are using Tor as a whistleblower or a dissident activist, you might want to adjust the Tor Browser security level to "Safest".

For this, click on the shield icon on the upper-right, then on the "Settings" button in blue, and select "Safest" instead of the default "Standard".

The default search engine is the privacy-focused DuckDuckGo. You will not even find Google in the options for the default search engine. More browsers should follow this good practice.

The first page opening with the Tor Browser will give the option to Connect to Tor. From there, you can click on "Connect" to start browsing through Tor, or on "Configure Connection" if you need additional settings. For example, if you need to set up a Bridge because Tor is blocked from your country.

Only connect to Tor if it is safe for you

Be careful when using Tor from a country where Tor might be blocked or perceived as suspicious. Similarly, be careful if you connect from a location where revealing you have been using Tor could be dangerous to you.

Once connected to the Tor Network, you will be directed to the DuckDuckGo welcome page, and you can search or type any URLs in the address bar, like you would with any other browser.

If you know an organization has an onion site (a website that is only accessible through Tor), you can type this onion address directly in the address bar.

If you don't know if an organization has an onion site, you might find it from its regular URL. For example, if you visit privacyguides.org from the Tor Browser, you will notice a purple button on the right informing you that an onion version of this website is available, click on it to get redirected to it.

Mullvad Browser and the Tor Project

If you are familiar with the Mullvad Browser, know that the Mullvad Browser was developed by the Tor Project team!

The Mullvad Browser was born of a collaboration between Mullvad VPN and the Tor Project, to build a browser that offers similar privacy features to the Tor Browser, but while using it through a VPN instead of through the Tor Network (both offering different benefits).

The Mullvad Browser can also be used without a VPN, and will still provide better privacy protections than most other browsers. It cannot be used to access the Tor Network, however.

The Tor Project

The Tor Project is the US-based nonprofit organization maintaining the software and community for the Tor Network, and developing and maintaining the Tor Browser. It's also a privacy advocacy organization, with a mission to advance human rights and freedoms around the world through the free technology it creates.

The nonprofit was founded in 2006 and gets its funding from various sources including government grants, independent contributors, and individual donations.

What Tor can do

Improve Privacy

Tor is not magical, but it's by far one of the best privacy tool we have. Using Tor will not make you perfectly anonymous online, but it will greatly reduce the traces your leave online.

Here are a few benefits Tor can provide for your privacy:

Tor can prevent the websites you are visiting from collecting your IP address (and your IP address can indeed lead to identifying you).
Tor can prevent your Internet Service Provider (ISP), Virtual Private Network (VPN) provider, or authorities requesting information from them to collect a list of the websites you have visited. They will know however that you have been using Tor.
The Tor Browser isolates each website you visit. This prevents ads and trackers from following you around, potentially popping up later in your Facebook ads and accidentally outing you.
The Tor Browser is fingerprinting resistant. This reduces the ways you can be tracked and identified online, even without your IP address.
When keeping the default settings, the Tor Browser only uses private windows and will not keep any traces of your browsing history. It will also delete all cookies and site data when closing.

Circumvent censorship

Because of how the Tor Network redirects traffic, it's a perfect tool to resist censorship. Using Tor can give access to websites or services that aren't accessible from a country blocking them.

Even from a region where Tor itself is actively blocked, the network can still be accessed using pluggable transports.

Using this type of measures to circumvent government censorship will make Tor accessible even from countries with heavily censored internet, such as China, Russia, Iran, and many others.

If you can't download the Tor Browser from your country

If you cannot download the Tor Browser because of your country's censorship, and if it is safe for you to do, you can try downloading the browser from a proxy website such as the EFF website, the Calyx Institute website.

You can even directly email gettor@torproject.org and send the name of your operating system (Linux, macOS, Windows) to get a direct link to download the Tor Browser.

If you want to help people around the world access the internet freely, you can volunteer to run a Tor Snowflake proxy. For more tech-savvy volunteers, you can also help by running a Tor Bridge, or even a WebTunnel Bridge.

Why Tor is so important

Tor is vital for human rights and democracy

Tor is an essential tool for journalists, activists, whistleblowers, dissidents, and people in vulnerable situations everywhere. It is one of the best tool we have to increase privacy online, and to resist censorship from oppressive regimes.

Thanks to Tor, activists have a safe way to continue fighting for human rights.

Some of the most respected human rights organizations use Tor to offer safe access to their services and information. This includes organizations such as Amnesty International, Electronic Frontier Foundation, Freedom of The Press Foundation, and of course the Tor Project.

Without Tor, journalists would lose invaluable sources of information provided by courageous whistleblowers reporting in the public interest.

Without Tor, brave citizens fighting against authoritarian governments would be at much greater risk when organizing and bringing vital information to the public's attention.

Without Tor, victims of domestic violence and LGBTQ+ people living in hostile environments could be in much greater danger when researching life-saving information online.

Without Tor, people living in oppressive regimes would not have access to the crucial information they need to fight for freedom, democracy, and peace.

Add an onion service for your organization's website

If you would like to add this service for your website to help more people access it safely, you can read more about onion services on the Tor Project Blog. As of 2021, you can even get domain-validated certificates for your onion site using HARICA, an operator founded by a nonprofit civil society from Greece.

Tor is for everyone to use

Tor is a tool that can help so many people. But Tor isn't only for people in highly sensitive situations like whistleblowers and journalists, Tor is for everyone!

Of course, people in more dangerous situations will need Tor to stay safe, but everyone can benefit from Tor's privacy protections in their daily lives. I personally use Tor when I am forced to visit Google Map. Not because it's dangerous to me, but just because I greatly dislike the idea of Google tracking my location activities.

Tor can also help fighting surveillance capitalism!

Moreover, you can considerably help people in dangerous situations by using Tor for trivial reasons like I do.

By using Tor for banal activities, when you aren't in any danger worse than a nasty ad-attack, you help to normalize the use of Tor and add more noise to the traffic. The more people do this, the more using Tor becomes just something people do when they care about privacy online, and nothing more.

Who uses Tor?

Anyone who cares about privacy!
Journalists who need to conduct research and protect their sources.
Whistleblowers using special websites to communication information to newspapers anonymously.
Democracy activists fighting against authoritarian governments who require anonymity online to stay safe from persecution.
People living under oppressive regimes who need to circumvent their country's censorship to access information freely.
Victims of domestic violence who need to research safe shelters and supportive resources without raising suspicion from their aggressor.
LGBTQ+ people living in hostile environments who need to access information online and stay connected with their community.
Generous people who want to help and support all the above 💜

The Tor community has gathered this wonderful collection of anonymous user stories from people describing why they use Tor.

Tor is critical public infrastructure

To keep Tor strong for everyone, it's essential to support and grow the network of volunteer-operated relays forming the Tor Network.

Thousands of journalists and activists rely on the Tor Network every day to stay safe and to continue their important work.

Furthermore, countless privacy-oriented projects depend on the Tor Network.

To name only a few, the messaging applications Briar, Cwtch, and SimpleX all use Tor to harden some of their privacy-preserving features.

For whistleblowers to stay safe, both SecureDrop and Hush Line use the Tor Network. Many newsrooms around the world host onion services to protect sources, such as The Guardian in the UK, CBC in Canada, ProPublica in the US, and many more.

There's also all the applications protecting people with the highest needs such as Tails, OnionShare, and more.

Losing the Tor Network would mean losing all the applications and features relying on it.

This would be disastrous for the privacy community, journalists, activists, dissidents, victims of domestic violence, LGBTQ+ population, and so many worldwide.

From a human rights perspective, we simply cannot afford to lose Tor.

Things to consider when using Tor

Tor compared to VPN protections

When using a VPN, your ISP will not know which websites you visit online (or other activities). Your ISP will see that you are connecting to a VPN, but will not know what you do from there. Your VPN however could know which websites you visit. Using a VPN is a transfer of trust from your ISP. When using a VPN, you should always trust your VPN provider more than your ISP.

The websites you visit will see the IP address of your VPN provider instead of yours. This can help protect your identity and location, but they will know this connection uses a VPN.

VPNs can offer great benefits for your privacy. However, if your VPN provider was compelled by law to provide the logs of the websites you visited (or will visit), it is technically possible to do for them.

When using the Tor Network correctly, no one knows which websites you visited, or other services you accessed. Your ISP or VPN provider will only know you have accessed Tor, but will not know which websites you have visited from there. Even if compelled by law, they could only share that you have accessed Tor, at this specific time.

The websites you have visited also won't know who you are (unless you tell them). They will only know someone accessed their websites through Tor, at this specific time.

The relays used for a Tor Circuit cannot alone re-recreate the link between your IP address and the websites you visit either. This offers much stronger protection for your privacy than a VPN does.

Who knows you are using Tor

When using the Tor Network, your ISP and the Guard Relay will both know you (the IP address you are using) are using Tor.

To prevent this, you could use Tor from a trustworthy VPN.

If you do so, your VPN provider will know you are using Tor, but your ISP will not. Your ISP will only see you are accessing your VPN, and the Tor Guard Relay will see your VPN's IP address instead of yours.

HTTPS for non-onion websites

The Exit Relay from the Tor Circuit will see someone is accessing this website (or other service).

If you were to use Tor to visit a non-onion website that isn't protected with HTTPS, and log in with your credentials, this Exit Relay could technically read this information. Using HTTPS with non-onion websites is very important when using Tor. Onion sites offer protections that are equivalent to HTTPS.

Be careful with files when using Tor

While it's safe to visit secured websites through Tor, be careful when downloading files or opening documents.

Depending on what kind of files it is, there are a number of problems that could arise. For example, it's a bad idea to download torrent files over Tor. Additionally, Tor will not protect you from downloading malware or exposing metadata with shared files.

If you need to share files through Tor with a trusted contact, OnionShare is a good option.

Addressing misconceptions

There has been misconceptions floating around about Tor. Most of them repeat similar misinformation attributed to many other privacy tools: Why using this if you have nothing to hide? But this argument is incredibly flawed and comes from a naive understanding of privacy rights and needs.

Most people use privacy tools for protection, and everyone needs protection. Moreover, privacy is a fundamental right intrinsically connected to democracy and civil liberties.

The dark web, the deep web, and the surface web

Some misconceptions have spread from confusion on what the deep web and the dark web are. Because yes, Tor is part of the dark web.

While using the term "dark web" might make for great sensationalist news title, the dark web isn't anything to fear.

It's not "dark" as in "dark intent" or the "dark side of the Force". It's really just dark as in "it's so dark on this road, I can't read the addresses around".

This dark web needs special software, configuration, or authorization to access it. For example, the Tor Browser is the streetlight you need to navigate on the Onion roads.

If you use Tor to visit the Privacy Guides onion site, you will be using the dark web. It's a website (or website version) that can only be accessed using a specialized tool. That's it!

The dark web is part of the deep web, which is simply all the online information that isn't indexed by any standard web search engines. Aren't you happy your bank account is on the deep web?

Illustration: Em / Privacy Guides | Inspired by: Ranjithsiji

Criminals use envelopes, doors, and clothing too

Some fear that Tor is used by criminals. While that might be true some criminals use Tor, a lot of people who aren't criminals at all also use Tor.

This kind of argument really leads nowhere. Criminals also use Google, Facebook, and Twitter (a lot actually). Criminals use envelopes to hide their ransom letters, closed doors to hide their crimes, and clothing to conceal weapons! Are we going to forbid clothing because some (all?) criminals use clothing to hide their weapons?

We shouldn't ban clothing, and we shouldn't ban Tor either. There are other better ways to catch criminals than removing a tool millions use to stay safe online.

Tor receives government funding

Yes, Tor does receive government funding, and that's a good thing. A lot of nonprofit organizations receive government funding as a stable (usually) source of income. Our governments should be contributing financially to the tools we all use to improve our security and privacy for free, moreover if they are using it themselves.

While any organization should thrive to diversify its sources of income to reduce its dependency on large contributors, it's not always easy to do.

If you feel uneasy about a privacy tool you use receiving government funding, the best thing you can do to fight this is to donate directly to reduce its dependence to it.

Depending on where you are, using Tor is likely safe

If you are not living under an oppressive regime with heavy censorship, it's likely that using Tor is safe for you, and will not put you on "a list". Even if it was putting you on "a list", it likely is a list full of great people working to defend human rights and privacy rights online.

That being said, if you are living in a region where using Tor is dangerous, and could put you on a list of anti-regime dissidents, you should absolutely be careful and take special measures to hide your usage of Tor.

Additionally, if you are in a vulnerable situation where an aggressor has access to your device or ISP information, and could hurt you if they knew you have used Tor, you should use a Tor Bridge and only access Tor through Tails.

Tor is fantastic for your privacy, but is not magical

Tor is a great tool to improve your privacy online and make it much harder to identify you, your location, and the content you access online. However, it will not make you magically anonymous.

If you use Tor with files containing metadata about you, this metadata can still identify you.

If you use Tor to log in your Facebook account, then of course Facebook still knows it's you, and now also knows you are using Tor.

If you use Tor to create a new account, but use an email address, phone number, username, or profile picture you used elsewhere when not connected through Tor, then your Tor activity can get linked to your previous activity.

If you use Tor to reveal information so specific that only you, or only someone at your company, or only someone in this small government department could know, then of course authorities can identify you this way.

You should also consider correlation in time when using Tor. If your activity is so specific that it can be narrowed down to only a few people, and your ISP or VPN knows you have accessed Tor at this specific time (and shares this information with authorities), a correlation in time could be enough to de-anonymize you.

Misconceptions are very detrimental to Tor, and other privacy tools

We need to be extremely careful when spreading information that could be inaccurate or hasn't been verified when talking about Tor (or any other privacy tools).

Misinformation can create mistaken fears and stop people from using a tool they would greatly benefit from.

If someone is so scared of Tor because of some rumor they heard, that they continue their activism from the surface web instead, they could needlessly put themselves at risk.

Furthermore, unjustified bad reputations can severely hurt funding for tools like Tor. This leads to less resources to continue developing the browser, the network, and to advocate for privacy everywhere.

We all have a responsibility to verify which information we share with others, make sure we stop misinformation at its root, and correct harmful misconceptions everywhere we hear them.

Tor needs our support

Tor is at risk, and needs our help. Despite its strength and history, Tor isn't safe from the same attacks oppressive regimes and misinformed legislators direct at encryption and many other privacy-enhancing technologies.

Moreover, due to its US government funding, Tor has already been on the destruction path of the recent hectic government cuts. Thankfully, the US Agency for Global Media finally rescinded the grant termination it had announced on March 15th to the Open Technology Fund, which the Tor Project benefits from. Sadly, considering the unpredictability of the current US administration, this doesn't mean the Tor Project is safe from cuts later on.

As much as the Tor Network relies on generous volunteers to run it, the nonprofit Tor Project relies on grants and donations to survive.

The good news is, we can help with both!

The more individuals donate to the Tor Project, the less it depends on government funding, and the more stable its donation income becomes.

Similarly, the more people volunteer to run a Tor relay, the more stable and reliable the Tor Network becomes.

Tor is a privacy tool so many people, organizations, and applications need to stay safe and secure. It is our collective responsibility to contribute what we can to keep Tor strong and thriving for all of us.

How to support Tor

There are many ways to help Tor survive and thrive! You can help by:

Donating to the Tor Project (includes really neat merch!)
Spreading the word about Tor
Joining the Tor community
Making your website accessible as an onion service
Asking your university to run a Tor relay
Running a Tor relay yourself
Running a Snowflake proxy to help fight censorship
Using Tor for anything from important to trivial
Sharing this article 💜

Onion sites you can visit using the Tor Browser

For more in-depth information about Tor, you can consult our Tor Overview.

Unless credited otherwise, all screenshots from: Privacy Guides

Privacy Pass: The New Protocol for Private Authentication

fria — Mon, 21 Apr 2025 17:25:55 +0000

Privacy Pass: The New Protocol for Private Authentication

Background Image: Thomas Ensley / Unsplash

Services that require authentication can correlate your activity on that service with your account, and that account is normally linked with payment information that could potentially link back to your real identity. With the Privacy Pass protocol, it doesn't have to be that way.

History

The story of Privacy Pass begins with a paper by David Chaum from 1985 (he actually has an earlier paper from 1982, but I'll be referencing this one), in which he laments the ever-increasing data collection by companies and government agencies.

It's funny that all the way back in 1985 he talks about the same issues we deal with today: persistent identifiers tied to our real identity for transactions, government IDs, etc.

Chaum proposes three solutions to the state of affairs he describes.

Pseudorandom Identifiers

Instead of persistent identifiers like we now have with our government IDs, credit cards, etc., Chaum suggests randomly generated identifiers. For example, you could have a one-time unique identifier for each transaction at a shop.

For ongoing relationships such as a bank, you can use a single pseudorandom identifier for that organization that you use continuously.

Card Computers

One of the more quaint ideas in the paper is the idea of a small "card computer" on which you would perform transactions. Chaum's theoretical device resembles "a credit-card-sized calculator, and [includes] a character display, keyboard, and a limited distance communication capability (like that of a television remote control)".

Nowadays, we carry around credit-card sized computers like it's nothing. The secret "card number" he describes would probably be your device PIN or even biometric authentication, which are already used to authenticate transactions.

We still haven't quite reached Chaum's vision yet in some areas. His idea is for these "card computers" to fully replace ATMs and checkout terminals in stores. Essentially, he wants all transactions to be online transactions, with something like Apple Pay or Google Pay on your device mediating the transaction and using your device PIN to prevent fraudulent transactions.Making all transactions online transactions is an interesting idea. I think most people can share in the frustration of dealing with checkout terminals, especially the self-checkout ones with cameras pointed at your face.

We're still falling short in a major area though.

card computers could be purchased or constructed just like any other personal computer, and would have no secrets from or structures unmodifiable by their owners.

Current smartphones are non-upgradeable by their owners and can't be built from scratch like a desktop computer can. They also contain lots of black-box proprietary code. Even a Google Pixel, the gold standard of Android smartphone freedom that allows you to install your own operating system securely, still suffers from the same pitfalls.

Cryptography

How do we ensure the pseudonyms can't be linked together? We already use cryptography to protect our communications. Chaum presents ways to similarly protect unlinkability using cryptography:

Simple mathematical proofs show that, with appropriate use of the systems, even conspiracy of all organizations and tapping of all communication lines cannot yield enough information to link the pseudonyms-regardless of how clever the approach is or how much computation is expended.

Digital signatures normally are used to ensure that something like a piece of software or a message comes from the original sender and hasn't been tampered with. You want to know who the signer is for this system to work.

But what if the signer and the one sending a request are different? Say you have a membership to a hypothetical PrivacyGuides+ subscription service, and you want to authenticate with it, but don't want to identify yourself. That's where blind signatures come in.

How it Works

You can imagine blind signatures like an envelope that's been wrapped in carbon paper with a window showing your pseudonym for that account, whether it be an account number, username, etc. They never see anything but the account identifier, or whatever they need to verify that you're a valid customer.The organization then signs it, indicating you're a valid customer, and you're allowed to access the service.

Later, when you're presented with a request to authenticate as an active subscriber of PrivacyGuides+, you unwrap the envelope and discard it along with the carbon paper. You rewrap it in a new envelope with a window showing the signature and a different pseudonym, and the requester can then be sure that you're allowed to access PrivacyGuides+.

Illustration: David Chaum

This system relies on the same strong cryptography that tried and true systems use, with the difference being the unlinkability between the credential issuer and the credential receiver.

Problems

Services that don't require an account or payment to use are great; you can use them with Tor, clear your browser history, whatever you need to do to keep your activity private.

But logging into an account completely invalidates all of that. Every time you log in or authenticate with a service, you have to identify yourself as the same person, linking all your previous activity together. Increasingly, we're asked to provide personal information in order to be able to use certain websites or services.

Linkability

As long as you're logged into an account with a service, all your previous and current activity can be linked together, along with any data you provided such as an email address, payment information, etc.

Data Collection

A lot of websites and services want to — or are forced to — filter out users below a certain age.

We're starting to see a rise in extremely privacy-invasive age verification systems such as submitting a government ID when you want to access a website or invasive facial scans.

Blocking VPN and Tor Users

Bots are a rampant problem for online services, leading them to sometimes block non-residential IP addresses such as those used for commercial VPNs and Tor.

CAPTCHAs

When VPN and Tor users aren't blocked, they often have to deal with annoying CAPTCHAs that take up your precious time and use invasive fingerprinting.

CAPTCHAs aren't even particularly good at detecting bots. With advances in AI, bots can solve CAPTCHAs better than humans can.

Privacy Pass

Several blind signature-based solutions are in various states, some being implemented but not widely used, some being proposed browser APIs, and some being IETF standards.

The landscape is very confusing right now, so I'll try to elucidate what I've found.

Privacy Pass started out as an attempt at a privacy-preserving way to bypass CAPTCHAs.

It started out and is still an extension that can be installed on the Chrome or Firefox extension store, but it's since expanded to become an IETF standard.

The Privacy Pass protocol has massively outgrown its original purpose. It's been updated to support multiple different schemes and purposes.

There are three main roles that need to be played for the authentication mechanism to work. These can be filled by all the same party, by three separate parties, or any combination in between. You'll have increased privacy the more separation there is between each role, so ideally they should all be filled by different parties.

Origin

The origin is the original website or service that's requesting a token for redemption. The client presents a valid token, or it must request more tokens.

Attester

The attester is responsible for verifying something about the client. There are several ways it can achieve this, and it can use multiple at the same time if desired.

CAPTCHA

The attester can make the client solve a CAPTCHA to prove that it's not a bot. Not the most elegant solution but solving one CAPTCHA instead of multiple is preferable.

Client State

The attester can verify something about the client's state like the geographic location, whether the client has a valid account, or the number of issuance protocol invocations.

Trusted Device

If your client is running on hardware that's capable of producing device-level attestation, like a device with a secure element, then it can use that to verify that the device is trusted.

For example, in Apple's Private Access Token implementation, they use certificates stored in the Secure Enclave and verify that your Apple account is in good standing.

Issuer

The issuer is responsible for issuing tokens in response to requests from clients.

The client presents tokens to the Origin once they're provided by the issuer.

Illustration: Cloudflare

The tokens need to identify which issuers are trusted.

They can also be interactive or non-interactive. Interactive means that you need a fresh token based on the challenge, whereas a non-interactive token can be stored for later use.

Tokens can also be constrained to one specific Origin, or they can be used across Origins.

Private State Tokens

Private State Tokens (PSTs) are a proposed browser API by Google as part of their Privacy Sandbox. They're based on the Privacy Pass protocol.

The main benefit of PSTs is that they provide a secure place for websites to store their tokens so that you don't need a separate extension for every service.

A browser-level API, I imagine, would significantly reduce the development burden of browser-based services looking to implement Privacy Pass, but it would leave non-browser apps like VPNs high and dry.

Private Access Tokens

Private Access Tokens are based on Privacy Pass as well, but they don't seem to be specifically bound to the browser.

It's unclear to me what really makes Private Access Tokens different from Privacy Pass itself, other than that Private Access Tokens seem to call for separation of the Attester and Issuer while Privacy Pass allows the origin, attester, and issuer to be the same. Delegating each role to a different party adds extra privacy.

The origin website only knows your URL and IP from the initial connection.

The attester only knows the data needed to verify you as a valid user.

The issuer knows the site you visited, but doesn't know any of your device information that the attester used to verify you.

Kagi

There are scant services actively using Privacy Pass to authenticate users, but a recent and very exciting example is Kagi.

With their implementation, you can now install their extension for Firefox and Chrome. Safari isn't supported at the moment, but their Orion browser supports it and is WebKit-based.

The need for an extension and lack of support for some platforms highlights the need for widespread support for Privacy Pass in browsers and platforms. It's not reasonable to expect every single platform to implement Privacy Pass themselves and users likely don't want to install a separate extension for every platform either.

That said, I applaud Kagi for their efforts. They went above and beyond to protect their users' privacy. A few notes for future improvements, though.

No Account Requirement

Currently, Kagi requires an account in order to use it. Although they allow you to put in a fake email address on account creation since they don't check it, it's still a persistent identifier that could be eliminated.

Their announcement blog post states that the ability to use Kagi fully without an account is a possibility for the future with an invitation to request the feature on their forum, so feel free to add your voice. A fully accountless search engine that doesn't rely on ads would be great to see.

Separation of Origin, Attester, Issuer

Kagi uses the Shared Origin, Attester, Issuer model for their implementation, which leaves the possibility of data being correlated between each step of the process, such as device fingerprinting or IP address being used to correlate a user who is issued tokens with when they redeem them.

Kagi's onion service helps to mitigate this issue, but I think it would be a significant privacy improvement to separate all three entities.

Remove Requirement for an Extension

Having to install an extension is annoying as an end user and surely incurs some development cost in both the initial development and upkeep over time. I'm not sure how it would be possible to get rid of the extension as it seems like there's no good way to do so at the moment, but I'm hopeful that the Private State Token API could be used for that in the future if it ever gets fully standardized as a browser API.

Future Possibilities

Overall, Privacy Pass is an exciting standard that is already improving the privacy of users on a wide scale.

Easier Adoption

However, for widespread adoption of anonymous authentication for all online services, there needs to be an easier way for developers to implement it. I see Private State Tokens and Private Access Tokens as paths toward that goal, but they have their own limitations.

Private State Tokens seem to be restricted to browsers, which is mostly fine since so many online services are accessed through the browser. It does put services like VPNs that operate outside the browser in a tight spot though.

Private Access Tokens seem like a possible solution for device-wide Privacy Pass authentication, but the only place I've seen them implemented is in Apple's operating systems to identify users as real iOS or macOS users. I'd like to see wider adoption for more use cases than just that. It's unclear what the vision for Private Access Tokens is for the moment.

Carriers

One of the biggest and most privacy-invasive services is mobile carriers. They take lots of personal information when you sign up, and then you have permanent identifiers, both IMSI identifying you as a subscriber and IMEI identifying your device, tied to that information while you use it. Because of how the cell network works, they also can tie that information to your physical location and all the traffic you send through their network.

Cape is a privacy-focused carrier that says they're "studying the use of blinded tokens and zero-knowledge proofs to disaggregate subscriber information." This would have a massive impact on user privacy, possibly allowing a KYC'd mobile subscriber to use their carrier at least semi-anonymously (it's unclear how IMSI and IMEI fit into this scheme, as well as location information).

VPNs

Commercial VPNs typically require some kind of account identifier, even if it's just a randomized number.

Apple's iCloud Private Relay uses RSA blind signatures to anonymously authenticate users to each of the two hops.

Google's former VPN service also used blind signatures to protect users.

Image: Google

Hopefully we can see more VPN companies start to use Privacy Pass to authenticate users, I think it would be a massive improvement to user privacy.

Digital Cash

Part of Chaum's vision was anonymous digital transactions using blind signatures, which he made a reality with his company DigiCash.

For whatever reason, eCash, as it was called, never caught on and the company filed for bankruptcy in 1998. We're left with the terrible current system where you need to input your credit card and personal information in order to make a transaction, which is easily traceable back to you. Not to mention the security implications, credit card fraud is rampant today.

The dream isn't dead, however. Chaum's eCash 2.0 is quantum-resistant and has been built and tested in the Bank for International Settlements' Project Tourbillon.

Digital ID

Laws are being passed forcing 18+ websites and even app stores to collect verify the ID of users. This is a massive slap in the face to the privacy and security of everyone. Data breaches and tracking are inevitable under the current system.

Blind signatures could provide a private and secure way to verify age or other information without having to submit your entire ID or submit invasive face scans.

Signal Configuration and Hardening Guide

Privacy Guides — Tue, 15 Apr 2025 04:00:00 +0000

Signal Configuration and Hardening Guide

Signal is a widely regarded instant messaging service that is not only easy to use but is also private and secure. Signal's strong E2EE implementation and metadata protections provide a level of assurance that only you and your intended recipients are able to read communications.

This guide details actions you can take to configure and harden Signal in accordance with your threat model.

Signal Configuration

Signal PIN

When you register for Signal with your phone number, you will be asked to set up a Signal PIN. This PIN can be used to recover your profile, settings, contacts and who you've blocked in case you ever lose or switch devices.

Additionally, your Signal PIN can also double as a registration lock that prevents others from registering with your number.

Registration Lock

The server will not enforce the registration lock after 7 days of inactivity. After that, someone will be able to reset the PIN at registration and register with your phone number. This will wipe the data stored in your Signal account, as it is encrypted by the PIN, but it won't prevent someone from registering with your number provided that they can receive a text on it.

Important update: since this blog post was published, there have been changes to the registration flow for Signal. You should read about this here.

If you haven't set up a Signal PIN, or have previously opted out of setting one up, follow these steps on Android/iOS:

Select > Settings > Account > Signal PIN
Select Create new PIN

Signal will prompt you to enter a PIN. We suggest using a strong alphanumeric PIN that can be stored in a password manager.

Once you have done that, or if you already have set up a PIN, make sure that Registration Lock is also enabled.

Select > Settings > Account > Signal PIN
Turn on Registration Lock

Important

If you forget the PIN and have enabled a registration lock, you may be locked out of your account for up to 7 days.

You can learn more about Signal PIN on Signal's website.

Safety Numbers

Safety numbers are a feature in Signal that allows you to ensure that messages are delivered securely between verified devices.

It is best practice to always compare safety numbers with your contacts. This can be done in a couple of ways:

Scanning your contact's QR code while viewing their safety number.
Comparing the safety numbers on both ends, be it visually or audibly.

Important

In order for safety numbers to also verify that the intended recipient has access to the device you're verifying, you need a secondary communication channel where you can authenticate the person that is holding the device. For example, an in-person meeting or during a video call.

To view the safety number for a particular contact, you need to follow these steps within Signal:

Go to a chat with a contact.
Select the chat header or > View Safety Number

Once you've compared the safety numbers on both devices, you can mark that contact as Verified.

A checkmark will appear in the chat header by your contact's name when the safety number is marked as verified. It will remain verified unless the safety number changes, or you manually change the verification status.

After doing that, any time the safety number changes, you'll be notified.

If the safety number with one of your contacts changes, we recommend asking the contact what happened (if they switched to a new device or re-installed Signal, for example) and verify the safety numbers again.

For more demanding threat models, you should agree on a protocol with your contacts in advance on what to do in case the safety number ever changes.

You can learn more about safety numbers on Signal's website.

Disappearing Messages

While communication in Signal is E2EE, the messages are still available on the devices, unless they are manually deleted.

It is good practice to set up disappearing messages in Signal's settings so that any chats you start will disappear after a specified amount of time has passed.

On Android/iOS:

Select > Settings > Privacy
Under Disappearing messages, select Default timer for new chats
Select the desired amount of time and select Save

Override the global default for specific contacts

Go to a chat with a contact
Select on the top right
Select Disappearing messages
Select the desired amount of time and select Save

We recommend setting up a reasonable timer by default, such as one week, and adjusting it per contact as you see fit.

Snapchat-like Functionality

Signal allows you to send "view-once" media that are automatically removed from the conversation after they have been viewed.

Disable Link Previews

Signal offers the ability to retrieve previews of webpages linked within a conversation.

This means that when you send a link, a request will be sent to that website so that a preview of the website can be displayed alongside the link. Thus, we recommend disabling link previews.

Your recipient doesn't make any requests unless they open the link on their end.

On Android/iOS:

Select > Settings > Chats
Turn off Generate link previews

Screen Security

Signal allows you to prevent a preview of the app being shown (i.e., in the app switcher) unless you explicitly open it.

On Android:

Select > Settings > Privacy
Turn on Screen Security

On iOS:

Select > Settings > Privacy
Turn on Hide Screen in App Switcher

Screen Lock

If someone gets a hold of your device while it is unlocked, you run the risk of them being able to open the Signal app and look at your conversations.

To mitigate this, you can leverage the Screen Lock option to require additional authentication before Signal can be accessed.

On Android/iOS:

Select > Settings > Privacy
Turn on Screen Lock

Notification Privacy

Even when your phone is locked, anyone who can lay eyes on the device can read messages and sender names from your lock screen.

On Signal, you have the ability to hide message content and sender name, or just the message content itself.

On Android:

Select > Settings > Notifications
Select Show
Select No name or message or Name only respectively.

On iOS:

Select > Settings > Notifications
Select Show
Select No name or Content or Name Only respectively.

Call Relaying

Signal allows you to relay all calls (including video calls) through the Signal server to avoid revealing your IP address to your contact. This may reduce call quality.

On Android/iOS:

Select > Settings > Privacy > Advanced
Turn on Always Relay Calls

For incoming calls from people who are not in your Contacts app, the call will be relayed through the Signal server regardless of how you've set it up.

Bypass Internet Censorship

If Signal is blocked in your country, it has a built-in "Censorship Circumvention" feature that uses domain fronting to bypass restrictions.

On Android/iOS:

Select → Settings → Privacy → Advanced
Turn on Censorship Circumvention

Additionally, Signal allows you to set up a proxy to bypass censorship.

Warning

All traffic remains opaque to the proxy operator. However, the censoring party could learn that you are using Signal through a proxy because the app fails to route all the IP connections to the proxy.

You can learn more about Signal's proxy support on their website.

Disable Signal Call History (iOS)

Signal allows you to see your call history from your regular phone app. This allows your iOS device to sync your call history with iCloud, including whom you spoke to, when, and for how long.

If you use iCloud and you don’t want to share call history on Signal, confirm it’s turned off:

Select > Settings > Privacy
Turn off Show Calls in Recents

Signal Hardening

Avoid Device Linking

While it may be tempting to link your Signal account to your desktop device for convenience, keep in mind that this extends your trust to an additional and potentially less secure operating system.

Avoid linking your Signal account to a desktop device to reduce your attack surface, if your threat model calls for protecting against Passive Attacks.

Molly (Android)

If you use Molly on Android to access the Signal network, there are many privacy and security-enhancing features that you may want to explore.

Privacy and Security Features

Molly has implemented database encryption at rest, which means that you can encrypt the app's database with a passphrase to ensure that none of its data is accessible without it.

Note

As long as Molly is locked, you will not receive notifications for any incoming messages or calls until you unlock it again.

Once enabled, a configurable lock timer can be set, after which point Molly will lock itself if you haven't unlocked your device for that specific time period. Alternatively, you can manually lock the app whenever you want.

For the database encryption feature to be useful, two conditions must be met:

Molly has to be locked at the time an attacker gains access to the device. This can include a physical attack in which the attacker seizes your device and manages to unlock the device itself, or a remote attack, in which the device is compromised and manages to elevate privileges to root.
If you become aware that your device has been compromised, you should not unlock Molly's database.

If both of the above conditions are met, the data within Molly is safe as long as the passphrase is not accessible to the attacker.

To supplement the database encryption feature, Molly securely wipes your device's RAM once the database is locked to defend against forensic analysis.

While Molly is running, your data is kept in RAM. When any app closes, its data remains in RAM until another app takes the same physical memory pages. That can take seconds or days, depending on many factors. To prevent anyone from dumping the RAM to disk and extracting your data after Molly is locked, the app overrides all free RAM memory with random data when you lock the database.

There is also the ability to configure a SOCKS proxy in Molly to route its traffic through the proxy or Tor via Orbot. When enabled, all traffic is routed through the proxy and there are no known IP or DNS leaks. When using this feature, call relaying will always be enabled, regardless of the setting.

Signal adds everyone who you have communicated with to its database. Molly allows you to delete those contacts and stop sharing your profile with them.

To supplement the feature above, as well as for additional security and to fight spam, Molly offers the ability to block unknown contacts that you've never been in contact with or those that are not in your contact list without you having to manually block them.

You can find a full list of Molly's features on the project's repository.

Hide Nothing

Dan Arel — Sat, 12 Apr 2025 02:26:12 +0000

Hide Nothing

In the wake of the September 11, 2001, attack on the United States, the US government enacted laws that weakened citizen privacy in the name of national emergency. This sent up many red flags for human rights and privacy advocates.

These concerns were met with “if you have nothing to hide, you have nothing to fear.” The argument goes that if you're not doing anything illegal, then these violations of your privacy shouldn't bother you. If you care about privacy, you clearly can't be up to anything good.

On the surface, this seems true to many people – but the reality is very different. We may not have had anything to hide in the immediate aftermath of 9/11, but that was not the only information being sought after by governments. Indeed, following the passage of the Patriot Act in the US, the FBI issued 192,499 National Security Letters, meaning they collected the records and online activity of nearly 200,000 people.

In the end it only convicted one person.

Now, many have argued that stopping one terrorist might be worth giving up some security for, but according to the ACLU, the conviction would have occurred without the Patriot Act.

Many legal actions you take today could be deemed illegal by future laws or future government. In the US today there is discussion around the possibility of Roe v. Wade being overturned, allowing states to outlaw abortions. You may not currently feel the need to hide internet searches, menstrual cycle apps, or donations to women's health clinics today because it's not illegal, but tomorrow that information could be used against you.

In countries were organizing around political dissent is legal, that doesn't mean the government is tracking those taking part and using that information to create informants or infiltrate such groups. Or worse, when or if laws change, using that surveillance to punish those involved.

And even if you break away from the legal aspects, we all have something to hide. You may not be ready to reveal your sexual or gender identity, but your internet usage could potentially do that for you. You don't want to make your bank account public; you have that information to hide. And you can continue to list things about your life you'd just rather not make public, regardless of potential legality.

In July 2021, a Catholic priest by the name of Jeffrey Burrill lost his job and was forced to resign after data collected through his cell phone showed that he was active on the gay dating app Grindr, and that he had visited multiple gay bars in the area. According to the Washington Post:

“A mobile device correlated to Burrill emitted app data signals from the location-based hookup app Grindr on a near-daily basis during parts of 2018, 2019, and 2020 —– at both his USCCB office and his USCCB-owned residence, as well as during USCCB meetings and events in other cities,” the Pillar reported.
“The data obtained and analyzed by The Pillar conveys mobile app date signals during two 26-week periods, the first in 2018 and the second in 2019 and 2020. The data was obtained from a data vendor and authenticated by an independent data consulting firm contracted by The Pillar,” the site reported. It did not identify who the vendor was or if the site bought the information or got it from a third party.
The Pillar story says app data “correlated” to Burrill's phone shows the priest visited gay bars, including while traveling for the USCCB.

While it was not clear who was tracking Burrill's device, the Post went on to say that:

Privacy experts have long raised concerns about “anonymized” data collected by apps and sold to or shared with aggregators and marketing companies. While the information is typically stripped of obviously identifying fields, like a user's name or phone number, it can contain everything from age and gender to a device ID. It's possible for experts to de-anonymize some of this data and connect it to real people.

While Burrill was without a doubt in violation of his work's own code of conduct, he did decide on his own to be a priest. However, his personal life was not harming others and was just that, his personal life. While the question looms about who was tracking him to begin with and why, the fact it was so easy to do is alarming.

What if Burrill wasn't a priest, but just happened to work for someone who held anti-homosexual views who used this data to out him, humiliate him, and fire him under false pretenses? This data, which should be private could (and likely did in the real-life circumstance) ruin his life.

That is what makes internet privacy so important. It's not hiding nefarious activity, it's that we all have an innate right to our privacy.

You might not feel today that you have anything to hide, but you might not feel that way tomorrow and once something is public, it cannot be made private again.

Encryption Is Not a Crime

Em — Fri, 11 Apr 2025 15:58:03 +0000

Encryption Is Not a Crime

Photo: Matt Artz / Unsplash

Contrary to what some policymakers seem to believe, whether naively or maliciously, encryption is not a crime. Anyone asserting encryption is a tool for crime is either painfully misinformed or is attempting to manipulate legislators to gain oppressive power over the people.

Encryption is not a crime, encryption is a shield.

Encryption is the digital tool that protects us against all sorts of attacks. It is the lock on your digital door preventing harmful intruders from entering your home. Encryption is also the door itself, protecting your privacy and intimacy from creepy eavesdroppers while you go about your life.

It's not a crime to lock your home's door for protection, why would it be a crime to lock your digital door?

Encryption protects you from cyberattack, identity theft, discrimination, doxxing, stalking, sexual violence, physical harm, and much more.

Who says encryption is a crime

Anyone who is well-informed will find it hard to believe someone could want to sabotage such fantastic protection.

Yet, year after year, oppressive regimes and lazy or greedy law enforcement entities around the world have attempted to undermine encryption using the pretext this is needed to "solve crime", despite all the experts repeatedly warning on how unnecessary and dangerous this would be. And this is without accounting for all the countries where encryption is already severely restricted, such as Russia, China, India, Iran, Egypt, Cuba, and others.

Whether breaking encryption is brought up naively by misinformed authorities, or as a disguised excuse for mass surveillance is up for debate.

Nevertheless, the result is the same: An attempt to destroy a tool we all need to stay safe.

Encryption is a protective shield

Encryption, moreover end-to-end encryption, is a tool we all use in our digital life to stay safe.

In today's world, the boundary between online and offline life is largely dissolved. Almost everything we do "offline" has a record of it "online". Online life is regular life now. It's not just your browsing history.

Your medical record from a visit at the clinic, your purchase transaction from a trip to the store, your travel photos saved in the cloud, your text conversations with your friends, family, and children, are all likely protected with encryption, perhaps even with end-to-end encryption.

Such a large trove of personal data needs to be protected against eavesdropping and malicious attacks for everyone to stay safe.

Encryption offers this protection. End-to-end encryption all the more.

What is end-to-end encryption, and what is the war against it

End-to-end encryption is a type of encryption where only the intended recipient(s) have the ability to decrypt (read) the encrypted data.

This means that if you send a message through Signal for example, only the participants to this conversation will be able to read the content of this conversation. Even Signal cannot know what is being discussed on Signal.

This greatly annoys some over-controlling authorities who would like to be granted unlimited power to spy on anyone anytime they wish, for vaguely defined purposes that could change at any moment.

End-to-end encryption can also mean a situation where you are "both ends" of the communication.

For example, when enabling Apple's Advanced Data Protection for iCloud (ADP), it activates end-to-end encryption protection for almost all of iCloud data, including photos. This means that even Apple could not see your photos, or be forced to share your photos with a governmental entity.

Without ADP, Apple can read or share your photos (or other data) if they are legally compelled to, or if they feel like it. The same is true for Google's services, Microsoft's services, and any other online services that aren't end-to-end encrypted.

This is at the root of the latest attack on encryption:

In February this year, it was reported that Apple was served with a notice from the UK's Home Office to force it to break ADP's end-to-end encryption. In response, Apple removed access to ADP from the UK entirely, making this protection unavailable to UK residents.

Do not mistakenly think this attack is limited to the UK and Apple users, however. If this regulation notice or a similar one gets enforced, it would impact the whole world. Other countries would likely soon follow, and other services would likely soon get under attack as well.

Moreover, do not feel unaffected just because you use end-to-end encryption with Signal or Proton services instead of Apple, they are both under attack as well in this war.

Just in recent years, the war against encryption has affected the US, the UK, Sweden, France, Australia, New Zealand, Canada, India, Japan, and all the European Union countries with proposals such as Chat Control.

The arguments given to break encryption make no sense

Authoritarian entities generally use the same populist excuses to justify their senseless demands. "Protecting the children" is always a fashionable disingenuous argument.

Because no one would disagree that protecting the children is important, it is often used as an attempt to deceitfully make an irrefutable argument to justify breaking encryption.

The problem is, breaking encryption doesn't protect the children, it endangers them.

When law enforcement officials claim they need to be able to read everyone's messages and see everyone's personal photos to be able to fight child predators, they seem to neglect that:

This means they will expose the children's messages, contact information, locations, and photos in the process, potentially endangering the children further.
Exposing everyone's data will make this data much more likely to be found and exploited by criminals, making everyone more vulnerable to attacks.
Predators will simply move to underground channels, unbothered.

They use the same kind of deceptive argument trying to justify weakening the protections we have to supposedly catch "criminals" and "terrorists".

Of course the exact definition of what is a "criminal" or a "terrorist" is always vague and subject to change. In the past, human rights activists and authoritarian regime dissidents have been labeled as such, climate change activists as well, LGBTQ+ people even in some countries. Maybe next year this label will include "DEI advocates", who knows where they draw the line and what can be considered a "criminal" worth spying on.

You cannot remove everyone's right to privacy and protection from harm while pretending it is to protect them. No one who is well-informed and well-intended could possibly consider this a smart thing to do.

An attack on end-to-end encryption isn't an attack on criminals, it's an attack on all of us.

Magical backdoor only for "the good guys" is a complete fantasy

Let's say the strategy is akin to creating a MagicalKey that unlocks every door (a magical key because thinking encryption backdoors would only be used by "the good guys" is a great example of magical thinking).

Imagine, for the sake of this exercise, the MagicalLock for this MagicalKey is impossible to pick, and imagine only police officers have MagicalKeys. Let's say one thousand police officers each have a MagicalKey.

They argue they need to be able to unlock anyone's door if they suspect a crime is happening inside. "It's for safety!"

Overtime, let's say only 1% of the police officers accidentally lose their MagicalKey. This kind of things happen. Now 10 MagicalKeys are lost in the wild and could be used by anyone else, for any purposes, including crime.

Then, let's say only 0.1% of police officers get corrupted by a crime gang. That's just one right? This corrupted "good guy" lets the gang create a double of the MagicalKey. Which crime gang wouldn't want a key that can magically open any door? They pay the police officer good money for this. It's an investment.

Now, the gang creates doubles of the MagicalKey they have. They obfuscate its serial number, so it cannot be traced back to them. They use it subtly at first to avoid detection. They make sure they never leave traces behind, so victims have no idea their door got unlocked.

During this time, they steal your data, they sell it, they use it to impersonate you, they use it to harm you and your loved ones.

Then, another criminal figures out on their own how to emulate a MagicalKey without even having access to one. The criminal creates a reproducible mold for this Emulated-MagicalKey and sells it to other criminals on the criminal market. Now, the MagicalKey™️ is available to any criminals looking for it. Restrictions on the backdoor are off. Your personal data is up for grabs.

This is what is going to happen if backdoors are implemented in end-to-end encryption. But don't worry they say, "it's only for the good guys!".

At least, the criminals' data will also be up for grabs, right?

Nope! The criminals knew about this, so they just started using different channels that weren't impacted. Criminals will have their privacy intact, they don't care about using illegal tools, but your legal privacy protections will be gone.

Backdoored end-to-end encryption isn't end-to-end anymore, it's just open-ended encryption. This offers pretty much no protection at all.

Ignoring experts doesn't make facts disappear

Where is the opposition to this? Where are the experts pushing against this nightmare? Everywhere.

Thankfully, opposition has been strong, despite the relentless ignorance or malevolence from authoritarian authorities repeatedly pushing against encryption.

Many people and groups have been fighting valiantly to defend our collective right to privacy and security. Countless experts have patiently taken the time to explain again and again and again how an encryption backdoor only for "the good guys" is simply impossible.

Weakening encryption to let "the good guys" enter, lets anyone enter, including criminals. There is no way around this.

Seemingly ignoring warnings and advice from the most respected specialists in the field, authoritarian officials continue to push against encryption. So much so that it has become difficult to assume good intent misguided by ignorance at this point.

Unfortunately, ignoring the experts or silencing the debate will not make the facts magically disappear.

In an encouraging development this week, Apple won a case fighting an attempt from the UK Home Office to hide from the public details of their latest attack on encryption.

This battle and all battles to protect our privacy rights, must be fought is broad daylight, for all to see and to support.

Fight for encryption rights everywhere you can

The war against encryption isn't anything new, it has been happening for decades. However, the quantity of data, personal and sensitive data, that is collected, stored, and shared about us is much larger today. It is essential we use the proper tools to secure this information.

This is what have changed, and what is making encryption and end-to-end encryption even more indispensable today.

Mass surveillance will not keep us safe, it will endanger us further and damage our democracies and freedoms in irreparable ways.

We must fight to keep our right to privacy, and use of strong end-to-end encryption to protect ourselves, our friends, our family, and yes also to protect the children.

How can you support the right to encryption?

Use end-to-end encryption everywhere you can.
Talk about the benefits of end-to-end encryption to everyone around you, especially your loved ones less knowledgeable about technology. Talk about how it is essential to protect everyone's data, including the children's.
Use social media to promote the benefits of end-to-end encryption and post about how it protects us all.
Write or call your government representatives to let them know you care about end-to-end encryption and are worried about dangerous backdoors or chat control proposals.
Support organizations fighting for encryption, such as:

Finally, have a look at our recommendations if you want to start using more tools protecting your privacy using end-to-end encryption.

This is a long war, but the importance of it doesn't allow us to give up.

We must continue fighting for the right to protect our data with end-to-end encryption, we owe it to ourselves, our loved ones, and the future generations.

The Dangers of End-to-End Encryption

Anita Key — Fri, 11 Apr 2025 15:58:03 +0000

The Dangers of End-to-End Encryption

Photo: Flavio / Unsplash

In the digital age, nothing is more important than convenience and easy access to data. Unfortunately, there has been an alarming trend among technologists to implement End-to-End Encryption (E2EE) in their applications, to the detriment of all the important work being done by countless organizations, including the best and brightest intelligence agencies and big tech companies.

April Fools!

This article was published on April 1st, 2025.

Privacy Guides supports strong encryption as a cornerstone of digital security and personal freedom. End-to-end encryption ensures that your communications remain yours, which is a principle worth preserving.

Security-focused developers and misguided "advocates" have long attempted to convince those involved in privacy and security that E2EE is an advanced security measure designed to protect your sensitive data, and Privacy Guides has stood by for far too long not setting the record straight.

In this article, we are going to explore how these "protections" actually endanger you and pose critical threats to society at large. Threats that are so grave that numerous government agencies around the world insist that we immediately limit or eliminate E2EE entirely, before our world as we know it falls apart.

Privacy Guides is acutely aware of these serious concerns, and believes privacy should always be a conditional right, used responsibly.

E2EE hampers legitimate government surveillance

Every day, intelligence agencies carry out perfectly legitimate surveillance activities against both their own citizens and foreigners. There is no question that these agencies are crucial to the upkeep of our national security, and it is our moral obligation to assist them in these warrantless activities, whether we know it or not.

When services like Signal or Tuta keep all of their users messages locked in an impenetrable vault, how are they supposed to keep tabs on potential criminals using their services?

The reality is that if the government is not allowed to read every message being sent, they might never encounter the one that actually warrants suspicion.

It's true that end-to-end encryption also protects the lives of journalists, whistleblowers, and human-rights activists from those few governments which are actually oppressive, but these edge-cases should not be used as an excuse to hinder legitimate governments like in the US or the UK.

E2EE encourages crime

With end-to-end encryption, criminals are granted a free pass for unlimited criminal activity. Nobody can read their messages besides them! Shocking, isn't it?

If platforms simply removed all forms of encryption from their services, we could solve cybercrime, illegal drug dealing, dangerous hacking attempts, child exploitation, and terrorism overnight... right?

There is plenty of historical precedent here. Platforms like Snapchat which don't utilize end-to-end encryption have bravely been involved in noble arrests, stopping criminals in their tracks before they had a chance to act.

Users of these platforms who aren't criminals do benefit a bit from end-to-end encryption. It protects them from identity theft, surveillance, and data breaches every day. With any sort of trade-off like this, this is certainly a factor to consider. We believe it is very clear that giving up minor protections like this is a small price to pay to potentially intercept the next dangerous joke in a group text.

It prevents helpful backdoors

Many tech companies have tried to introduce backdoors into their end-to-end encrypted platforms, only to be lambasted by the legion of completely unreasonable "privacy advocates" out there. Our stance on privacy is far more principled, and we believe there is a middle-ground to be found in the laws of mathematics.

The solution proposed by companies like Apple and agencies like the FBI is a sound one. They will protect your messages, unless they encounter something suspicious. At that point, keys to decrypt your data will be given only to the good guys, so that they can enforce the law.

This approach makes a lot of sense. By carefully controlling access to these skeleton keys, it's trivial for companies to make sure they only fall into the right hands. The notion that they might be leaked, or that someone with enough resources could replicate that access, is so far into slippery slope territory that it borders on nonsense. Let's stick with what we know about the security capabilities of these companies today, instead of imagining ridiculous scenarios where they are breached.

It harms innovation

Think about all the services you use online every day. The companies behind those services rely on collecting as much of your personal data as possible in order to constantly produce exciting new innovations. Without mass data collection, how would you get personalized ads for weeks about different new sneakers, because you bought that pair on Amazon yesterday? How else would companies emulate the real-life experience of constantly being hounded by a salesperson in a store selling you the exact thing you desperately need?

E2EE prevents companies from truly knowing their users, stifling these massive advances in advanced user profiling!

Big tech companies monetizing your personal data in ways that you don't need to understand nor consent to is what makes the internet such a magical place. If your private chats are protected with E2EE, companies won't be able to serve you the moment you even think about a new lawnmower. What do you think about that?

It's challenging for developers

Another way E2EE slows down innovation even in the digital security realm is its complexity. Implementing robust cryptographic libraries and user-friendly key management systems is complicated, and software development is supposed to be a piece of cake.

The problem of digital security has already been solved: simply store that information in a database and protect that database from anyone who isn't approved to see it. Protections beyond this tend to be complexity for the sake of complexity. If we did away with the countless developer hours wasted on protection nobody really needs, we'd have more time to add longer animations and innovative features like infinite scrolling to keep users happily using their apps for hours on end.

E2EE is a slippery slope!

Constantly pushing E2EE sets up consumers with a wildly unreasonable expectation, that privacy should be the default. If people got comfortable communicating without tech companies and governments constantly peeking over their shoulder, it's impossible to imagine what they might start thinking next. Maybe they'd start to believe personal liberty is a right, instead of a privilege.

End-to-end encryption is an insidious technology that has crept its way into some of the best instant messengers, cloud storage providers, and other apps. It stands in the way of law enforcement, government security agencies, data-collecting corporations, and anyone else who might need to peek into your personal life.

It's time we took a stand against this technology and demand a true solution from our governments: Sensible regulations that allow for partial protections while keeping the option for these entities to decrypt it when necessary intact. The sense of security is all that truly matters to most people anyway.

Who needs complete privacy when you can have a half-baked version easily circumvented by the good guys? What is privacy in the first place, if not a convenient cover for wrongdoing? If we can't read all messages (just in case), how are we expected to keep society safe?

This article was published on April Fools' Day. If you've made it to the end, and you haven't noticed how we buried the real benefits of end-to-end encryption in our hyperbolic worst-case scenarios, well... surprise! 😄

If the "dangers" of E2EE upset you, maybe it is time to reflect on how crucial privacy is to everyone: You, me, whistleblowers, activists, and everyday people who just want to live their lives. Happy April 1st, and stay secure out there!

Written by: Jonah Aragon

Interview with Micah Lee: Cyd, Lockdown Systems, OnionShare, and more

Em — Fri, 28 Mar 2025 16:56:55 +0000

Interview with Micah Lee: Cyd, Lockdown Systems, OnionShare, and more

Illustration: Jonah Aragon / Privacy Guides | Photo: Micah Lee

If you don't know who Micah Lee is yet, here's why you should: Micah is an information security engineer, a software engineer, a journalist, and an author who has built an impressive career developing software for the public good, and working with some of the most respected digital rights organizations in the United States.

If you have been following software development related to data privacy and security for a while, you probably already know one of Micah's projects such as OnionShare, Dangerzone, the Tor Browser Launcher, and more recently Cyd (a rebirth of Semiphemeral). Additionally, he is also a core contributor to the Tor Project and a contributor to Hush Line.

Besides software development, Micah is a board member for Science & Design and Distributed Denial of Secrets, a former board member and cofounder of Freedom of the Press Foundation, and has been a Staff Technologist for the Electronic Frontier Foundation.

You might have already read some of Micah's articles when he worked at The Intercept, or even read his new book Hacks, Leaks, and Revelations: The Art of Analyzing Hacked and Leaked Data.

We spoke with Micah over email and are delighted that he decided to talk with us at Privacy Guides. Let's get into it!

Em: Hi Micah! We're thrilled that you have accepted to give us this interview at Privacy Guides. Thank you for taking time off your busy schedule to talk with us.

Cyd: The app to claw back your data from Big Tech

Em: Let's start with your newest project. Cyd is an application you have created in 2024 to help people backing up and deleting their tweets on X-(Twitter). This app emerged from the ashes of Semiphemeral, a great tool that was unfortunately rendered unusable when Twitter decided to shut off its API. I personally loved Semiphemeral and used it to delete thousands of my tweets before eventually deleting my whole Twitter account later on. Can you tell us more about how Cyd works despite not using X's API?

Micah:

APIs make it way simpler for programmers to interact with online services, but they're not the only way. As long as social media platforms like X still run websites, and it's still possible for you, the human, to manually scroll through your tweets and delete them, it's possible to write a program that can do this for you.

This is basically how Cyd works. It's a desktop app that includes an embedded web browser. When you add an X account to it, you login to your account in the browser, and then Cyd takes over. You can tell it that you want to delete your tweets, or likes, or bookmarks, or unfollow everyone, or save a backup of your DMs, or plenty of other things, and it does this by automating the embedded browser on your behalf. No API required.

Cyd uses open APIs when they're available and make sense. For example, if you want to quit X but you don't want your old tweets to disappear forever, Cyd can migrate them to Bluesky using Bluesky's API -- soon we'll add support for migrating to Mastodon too. But for closed platforms that suck (like X, and Facebook too, which we're adding support for right now), we're forced to do it the hard way.

Em: Talking about openness, recently this year you have decided to make Cyd open source. This is fantastic news! What did you take into consideration before making this decision and what kind of contributions or feedback are you hoping to receive from the community?

Micah:

I'm extremely happy that Cyd is now open source. I've open-sourced most code that I've ever written, so it honestly felt kind of weird starting out making Cyd proprietary.

My biggest concern with making it open was that I want Cyd to be a sustainable business, where some of the features are free and some of the features are premium and cost money -- enough so that me, and eventually other people working on it, could get paid a decent wage. And as an open source app, it would be easy for someone to fork it and remove the bits of code that check if you've paid for premium access.

But after talking it through with some other people who are very experienced open source devs, I decided that this isn't that big of a deal, and that the benefits of being open source far outweigh the costs.

Now when you use Cyd, you can now confirm that it doesn't have access to your social media accounts or any of the data in it. Having an open issue tracker on GitHub is great too, because people in the community can open issues, post comments, and track the progress of features they're looking forward to. Also being open source means we have the ability to accept grants and donations, in addition to selling premium accounts. You can check out our Open Collective page at https://opencollective.com/lockdown-systems.

I'm hoping that members of the community will discuss features we're making, or even contribute code directly to our project. Right now, Cyd is only available in English, but we're also hoping to translate it into many different languages going forward, so I'm hoping that people will eventually chip in it to help translate Cyd to their native languages.

Em: Having access to Cyd in multiple languages would really be wonderful. Likewise for multiple social media, when additional ones will be added later on. But at the moment, Cyd definitely seems to be focusing on X. You have personally been on the receiving end of Elon Musk's vengeful whims before when your Twitter account got banned in 2022 for criticizing him. I would say this qualifies as a badge of honor. Do you think you could still be on his radar with Cyd focusing on data deletion for X even though X has shut off its API? Have you taken any specific measures about this?

Micah:

I think it's actually more likely that I'll be on Elon Musk's radar because of my recent work with the Tesla Takedown movement than with Cyd... Right now, Musk is spending all of his time purging the US government of critics and consolidating executive power under Trump. So maybe he's too distracted on his fascism project to care about what we're doing with deleting tweets?

But that said, Musk is litigious and we're definitely concerned about legal threats. We've consulted lawyers and we're trying to be as safe as possible.

Lockdown Systems: The new organization developing Cyd

Em: Cyd is a project of Lockdown Systems, a new organization you have created with colleagues just a few months ago. Can you tell us more about the structure of this organization and who else is involved?

Micah:

We're still finalizing the paperwork, but Lockdown Systems is a new worker-owned collective! At the moment there are five of us:

me
Jen, a former SecureDrop engineer who was the technical editor of my book and, for several years, my Dungeons & Dragons dungeon master
Saptak, a talented human-rights-focused open source developer who I work with on OnionShare
Yael, an investigative journalist friend who, among other things, broke a story with me about how Zoom had lied about supporting end-to-end encryption just as everyone started using it during the pandemic
Akil, a talented newsroom engineer I worked closely with at The Intercept

Most companies are owned by investors who only care about profit. They don't care about the workers, and they definitely don't care about the end-users of the software they make. This is why it's so common for tech companies to end up spying on their users and selling that data: it's an additional way to make a profit for their investors.

We're different. Lockdown Systems is owned by its workers, and we don't have outside investors. We have all agreed to the explicit goals of: ensuring the well-being of our members; making tools that help fight fascism and authoritarianism; and prioritizing impact over profit.

We make decisions by coming to consensus, and everyone in the collective gets paid the same wage. Even though I started Cyd, I don't have more say than anyone else.

Em: That is such a great organizational structure for software development. Lockdown Systems really has an impressive team of skilled and dedicated people. Presently, it seems from the website and GitHub page that Lockdown Systems is focusing on developing and growing Cyd only. Are you planning on using Lockdown Systems mainly for Cyd or are you envisaging other applications getting added to Lockdown Systems in the near (or far) future?

Micah:

So far, Cyd is our only product. There are many features we plan on building, and we also need to get it the point where it can fund our continued work. Most likely, this will be our main project for the near future.

That said, we're definitely open to branching out. We make software that directly empowers individuals, helping them reclaim their autonomy and privacy. So if we see an opportunity to build something that will directly help people who are facing fascist threats -- whether it's supporting abortion access, keeping immigrants safe, helping communities organize mutual aid, etc. -- we will absolutely do it.

Em: If one day some generous millionaire (let's keep it at millionaire, we all know what happens at billionaire) decided to give Lockdown Systems a huge budget bump no string attached, how would you like to grow the organization with this money?

Micah:

One cool thing about being a member of a collective is that if this happened, the whole collective would brainstorm together and we'd come up with ideas that are far better than what I could come up with alone. But that said, I definitely have some thoughts.

Right now, everyone is working part time, between about 10 and 30 hours a week each. If we had the resources, many of us would work on Cyd full-time, and we'd be able to offer benefits like health care and retirement contributions. We could also increase how many people are part of the collective, and build out new features at a much faster rate.

In my mind, future Cyd will be a single app (possible available on mobile devices, not just desktop) where you can have total control over all of your data that's currently stored by tech companies (X, Facebook, Instagram, TikTok, LinkedIn, Reddit, Bluesky, Mastodon, Discord, Slack, Telegram, Amazon, Airbnb, Substack, and on and on). You can backup all your data and then have choice over where you want the rest of it: you can delete everything, or you can choose to keep your online presence that you're proud of. You can easily cross-post to multiple platforms, and also automatically delete your older posts from the corporate platforms, while keeping them live on the open ones. Or, however else you choose to do it.

If we had a bigger team to pay for more labor, there's a lot that we could get done.

Em: In the meantime, I imagine one million $1 donations could also help. If our readers would like to support the development of Lockdown Systems, they can make a donation on this page.

Em: Our community is likely familiar with this great application included in so many security and privacy-focused projects, including Tails, Qubes OS, Whonix, and Parrot OS. What motivated you to create OnionShare more than 10 years ago, and what do you think is the best way to use it now?

Micah:

I made OnionShare in 2014 while I was helping journalists report on the Snowden documents. The big motivation was a border search: Glenn Greenwald's partner, David, traveled from Berlin, where he was visiting Laura Poitras, back to his home in Rio de Janeiro. He was carrying an encrypted hard drive, on an assignment for The Guardian. During his layover at Heathrow airport in London, UK authorities detained him and searched him.

None of this was necessary. Using the internet, encryption, and Tor, it's possible to securely move documents around the world without putting anyone at risk at a border crossing. In fact, I was already doing something similar with journalists I was collaborating with on Snowden stories myself. To send someone secret documents, I'd first encrypt them using PGP, and then place them in a folder on my laptop. I'd start up a web server with a simple directory listing for that folder, and then make that web server accessible as a Tor onion service.

While this wasn't too hard for me, an experienced Linux nerd, to set up, it would be very challenging for most people. I made OnionShare basically as a user-friendly way for anyone to be able to securely share files, peer-to-peer, without needing to first upload them to some third party service like Dropbox.

Today, OnionShare has more features. It's basically like a graphical interface to do cool things with Tor onion services -- you can send files, but you can also turn your laptop into an anonymous dropbox so people can upload files to you, and you can quickly host onion websites and spin up temporary chatrooms too. And there are Android and iPhone apps!

The last time I used OnionShare myself was last week. On my personal newsletter, I'm writing a series of posts exploring the Paramilitary Leaks, 200 GB of data from the American militia movement, obtained by an infiltrator name John Williams. While working on one of my posts, John used OnionShare to send me some additional documents.

Other projects and thoughts

Em: You have been a prolific writer as a journalist for The Intercept, your own Blog, and in January 2024 you released a book called Hacks, Leaks, and Revelations: The Art of Analyzing Hacked and Leaked Data. What is this book about, and who is it written for?

Micah:

I spent many years reporting on hacked and leaked datasets, starting with the Snowden archive. Since then, I've seen the amount of hacked and leaked data grow exponentially. And at the same time, journalists and researchers -- the people who really need to dig through this data and find the good stories -- don't even know where to start.

So that's what my book is, an interactive guide to downloading and exploring datasets. It doesn't require any prior knowledge, but it does get pretty technically, including two chapters teaching Python programming. If you're following along, near the beginning of the book you'll encrypt a USB hard drive and then download a copy of BlueLeaks to it -- hundreds of gigabytes of hacked police documents from the middle of the Black Lives Matter uprising in 2020. You'll use this dataset, along with several others, as examples as you learn how to make sense of data like this.

You should definitely buy the book if you're interested and you can, but information wants to be free, so I also released the whole book under a Creative Commons license. You can read the whole thing online at hacksandleaks.com.

Em: I can see how much of a valuable skill this is to learn for journalists and researchers in this day and age. Even if nothing compares to having a physical paper copy (in my opinion), it's wonderful that you share your book online for people who, for various reasons, cannot order a copy. You have worked or still work with the Electronic Frontier Foundation, Freedom of the Press Foundation, Science & Design, the Tor Project, and Distributed Denial of Secrets. Your contribution and commitment to digital rights is undeniable. From your experience, what are you envisioning for the future of digital rights activism?

Micah:

I don't have all of the answers, but I do think that it's important for digital rights activists to meet the moment. Fascist politicians are gaining power around the world. The gap between the ultra rich and everyone else is wider than it's ever been before. Elon Musk has openly bought the US government, and the Trump-supporting oligarchs control all of our critical tech infrastructure. Climate change deniers and anti-vaxxers are the ones in charge right now, at least in the US. Things are pretty bad.

Whatever we do, we should have the goal of shifting power away from the fascists and billionaires and towards everyone else. We need alternative platforms that are not only open and democratic, but also just as easy to use as the corporate walled gardens. We need digital rights, not to mention digital security, to fully integrate itself into the rest of the mass movements going on now, whether it's to save the planet from climate change, to protect immigrants getting sent to gulags, or to stop the genocide in Gaza.

Em: Absolutely, and digital rights advocates and organizations undeniably have a crucial role to play in these movements. Finally, is there anything else you would like to share with us that we haven't discussed yet?

Micah:

If you want to support Lockdown Systems and you work for an organization that might be interested in offering Cyd as a benefit to their employees, check out Cyd for Teams! If we can get organizations on board this will go a long way to making sure we can continue to get paid doing this work: https://docs.cyd.social/docs/cyd-for-teams/intro

Em: Thank you so much Micah for taking the time to answer our questions today! The new projects you are working on are fascinating, and so important in the current landscape. I'm excited for more people to discover Cyd and Lockdown Systems, and will myself be following their evolution and expansion enthusiastically.

Consider supporting Micah Lee's projects

If you would like to follow Micah Lee's work and support his projects, consider:

Privacy Means Safety

Em — Thu, 27 Mar 2025 18:55:13 +0000

Privacy Means Safety

Photo: Georgy Rudakov / Unsplash

Privacy is a human right that should be granted to everyone, no matter the reason. That being said, it's also important to remember that for millions of people around the world, data privacy is crucial for physical safety. For people in extreme situations, privacy can literally mean life or death.

Many of us have experienced moments when our privacy concerns have been minimized or even completely dismissed.

This general hostility towards data protection is dangerous. Yes, dangerous. Data privacy isn't a trivial matter.

There are many circumstances where inadvertently or maliciously exposed data can put someone in grave danger. Worse, sometimes this danger might not even be known at the time, but might become incredibly important later on.

We should never downplay the serious risk of exposing someone's data, even if this isn't a situation we personally experience, or even understand.

Content Warning: This article contains mention of sexual assault, violence, and death.

Leaked data can have grave consequences

This isn't a hypothetical situation. There has been many tragic events where people have been harmed and even killed because data about them was leaked, stolen, or otherwise revealed to someone hostile.

Children

The data of children is something our society should be much more invested in protecting, yet most new legislation proposed or passed to supposedly protect the children are doing the complete opposite, endangering everyone's data, including the children's.

As for the data protection we already have, they are insufficient to protect most people's data, also including the children's.

In 2020, the Irish child and family agency, Tusla, was fined €75,000 for a breach of the General Data Protection Regulation (GDPR). Investigation revealed three instances where data about children had been negligently disclosed to unauthorized parties.

In one case, the location and contact information of a mother and child was revealed to an alleged abuser. In another, the agency neglectfully provided the address of a child and the mother's phone number to a man accused of child sexual abuse.

Such data leaks should never be tolerated. Sadly, much stronger fines will be required to stop organizations from being so dangerously careless.

In 2018, an incredibly unfortunate 12-year-old gamer and his mother were both likely traumatized for life by a violent swatting attack when the child's home address was exposed online. The outcome of this horrible attack could have ended much more tragically. The story doesn't explain how the child's address was found.

Swatting attacks have become such a problem in the United States that the Federal Bureau of Investigation (FBI) recently created a national database to help track and prevent such attacks.

Victims of stalkers

Stalking victims are incredibly vulnerable to any data leak. People in such situation can often be gravely endangered by data broker services, data breaches, information they might have shared online recently or decades ago, and information shared about them by friends and family.

Unfortunately, this kind of horrifying situation isn't rare.

The danger to victims of online stalkers should never be minimized. Stalking and harassment are serious crimes that should be reported and severely punished. Overlooking these offenses is being ignorant to how quickly the consequences of such crimes can escalate.

In 2019, a 21-year-old Japanese pop star got stalked and sexually assaulted by a man who found her location from a picture she posted online. The photo had such high definition that the perpetrator was able to see and identify a specific train station that was visible through a reflection in the singer's eyes.

The aggressor also gathered information about the victim's home by examining the photos she posted from her apartment to determine the exact unit location. He then went to the train station he identified from the photo, waited for her, and followed her home.

In 2023, a podcast host and her husband were killed by an online stalker. Despite having requested a protection order against the murderer, and despite blocking his phone number and social media accounts, after months of intense harassment online, the man eventually found the podcaster's home address, broke in, and fatally shot her and her husband.

Victims of domestic violence

Victims of domestic violence are at an elevated risk of severe or even fatal repercussions when their data gets leaked or shared. People in this extreme situation often have to take extreme measures to protect data that could allow their abuser to find their new location.

Things as banal as exposing someone's license plate, or posting online a photo taken in a public space could literally get a person in such situation killed.

Moreover, some abusers are weaponizing subject access requests in an attempt to find the location of the victims fleeing them.

It is imperative to ensure that data access legislation cannot be misused in such a dangerous way. Data legally shared with a subject should never lead to the harm of someone else.

In another instance, a woman who was raped by a former partner was unable to safely receive counseling care because the notes from her counseling sessions could have been shared in court with the perpetrator.

Data privacy regulations should protect such sensitive data from being shared without explicit and free consent from the patient.

Healthcare seekers

People seeking essential healthcare in adverse jurisdictions can be prosecuted when their private communications or locations are intercepted.

In 2023, a mother from Nebraska (US) was arrested and criminally charged after she helped her 17-year-old daughter get an abortion.

The woman was arrested partly based on the Facebook messages she exchanged with her daughter discussing medication for the abortion. Police obtained a copy of the private Facebook conversation by serving a warrant to Meta, which the company quickly complied with.

Whistleblowers and activists

Whistleblowers and activists are at especially high risk of harm, particularly if they have publicly opposed or exposed oppressive regimes or criminal groups.

Governments around the world, especially more authoritarian ones, have been increasingly monitoring social media to track, identify, and persecute critics, activists, and journalists.

Authorities have also been mandating direct collaboration from service providers to arrest activists. In 2021, a French climate activist was arrested after Proton Mail was legally compelled by Swiss laws to log and share the activist's IP address with authorities.

In 2017, a 25-year-old working for the American National Security Agency (NSA) as a contractor was arrested after she was identified as the whistleblower who leaked a report about Russian electoral interference in the United States.

The whistleblower had mailed the classified document to The Intercept anonymously. However, when the news organization tried to confirm the authenticity of the document with the NSA, the agency was able to determine which printer was used to print this copy, and from there deanonymized Reality Winner. The technique used to track the document was the reading of almost invisible printer tracking dots that many laser printers and photocopiers produce on all printed documents.

This year on March 7th, community activist and whistleblower Pamela Mabini was shot and killed just outside her home in South Africa. She was an activist working with the Maro Foundation, a nonprofit organization dedicated to fighting poverty and gender-based violence.

Mabini's murder has sparked a debate on the importance of protections offered to whistleblowers exposing criminals to justice. Following the activist's death, organizations have been calling to fast-track the Whistleblower Protection Bill to bring more protections to those fighting for justice in South Africa.

Trans and queer activists

Trans and queer activists are at elevated risk of harassment online in today's political climate. In 2022, 28-year-old trans activist Clara Sorrenti was victim of a swatting attack after police believed a fake report about violent threats made by her aggressor.

She was arrested at gunpoint by the police, handcuffed, had her electronic devices seized, and her apartment searched for eight hours for non-existent evidence. The aggressor who made the false threats had provided her name and home address to police.

Journalists

Journalists around the world can become vulnerable to attacks even from governments when they report on oppressive regimes. This kind of situation can be extremely dangerous, considering the almost unlimited resources state-backed attackers can have to identify, track, and persecute their victims.

In 2018, the prominent journalist and critic of Saudi Arabia's government Jamal Khashoggi was murdered. Despite being based in the United States, the journalist traveled to Istanbul's Saudi consulate in Turkey to pick up official documents. Khashoggi was killed inside the consulate a few days later on October 2nd.

Investigations revealed that people close to Khashoggi had their devices infected by NSO's Pegasus spyware. This likely allowed the attacker to gather information about Khashoggi traveling outside the United States.

Many other journalists, politicians, and human rights activists have been targeted by state-backed spyware such as Pegasus.

In 2022, Human Rights Watch reported that two of their staff members and at least 18 other activists, researchers, or journalists working on Middle East issues had been targeted by a phishing campaign coming from a group affiliated with the Iranian government. The entity succeeded in stealing emails and other sensitive data from at least three human rights defenders.

Targeted harassment

Another danger of leaked data that shouldn't be minimized is targeted harassment. Targeted harassment can have devastating consequences ranging from silencing their victims, to suicide, to death by swatting attack.

A well-known example of targeted harassment is Gamergate. Gamergate was a loosely organized harassment campaign targeting women in the video game industry. It started in 2014 when Zoë Quinn's ex-partner published a blog post with false insinuation about Quinn, a video game developer.

Quinn was subsequently subjected to an incredibly intrusive doxxing campaign, and even received rape threats and death threats. Attackers were able to steal an insecure password and break into one of Quinn's account, which resulted in horrible consequences. The harassment campaign later expanded to target others who had defended Quinn online.

In another case, targeted harassment resulted in one death and a five years prison sentence. In 2020, Mark Herring started receiving requests asking him to give up his Twitter handle, which he refused. Herring's "crime" was to have been quick enough to secure the handle "@Tennessee" shortly after Twitter came online.

Over weeks, harassment escalated from sustained text messaging to random food delivery to his house. After Herring's harasser posted his home address in a Discord chat room used by criminals, someone used this data to direct a swatting attack at Herring's place. Police surrounded his home and demanded he crawl under a back fence, despite his health. After crawling under the fence, 60-year-old Mark Herring stoop up then collapsed from a heart attack, and died soon after.

Mistaken identity

What is more, everyone can get victimized by exposed data, even people who are not online and even people who are not a whistleblower, a journalist, an activist, a victim of domestic violence, or someone who has committed the "unthinkable crime" of securing a cool Twitter handle.

In 2017, 28-year-old Andrew Finch was shot and killed by police during a swatting attack in the United States.

The attack was conducted after the perpetrator had an argument online over a multiplayer first-person shooter game. The perpetrator, who was later sentenced, threatened another player he was upset with to "swat" him. The perpetrator then enlisted another man to call the police and conduct the attack on the player, with the home address the player provided. This address turned out to be the previous address of the player, which was now Andrew Finch's address.

When police arrived at Andrew Finch's home and surrounded the place, Finch, completely unaware of what was happening, barely had the time to comply and get outside when the police shot and killed him at the front door.

The man who conducted the swatting attack for the perpetrator got sentenced to 20 years in federal prison.

In 2021, an Australian 15-year-old girl was mistakenly targeted and later doxxed with her real information after she had been wrongly identified online as someone who had participated in a racist social media video posted on Facebook.

A few hours after her name was shared online, the girl started to be inundated by hateful messages and unspeakable threats from all around the world. Her phone number and home address were eventually shared online. Her family received hateful messages from strangers as well.

During the ordeal, her mother had to be hospitalized for heart disease. The girl, who had absolutely nothing to do with the racist video that spawned the attacks, contemplated suicide due to the violence of the harassment. She and her mother no longer felt safe.

Digital traces of the personal data that was exposed during the attacks will likely remain online forever, even if the girl and her family were completely innocent and unrelated to what triggered the cyber-swarming.

The 26-year-old American who incorrectly identified the Australian girl and shared her name and social media accounts online later apologized for his mistake.

How data finds its way to an aggressor

Targeted research, attack, and spyware

For targeted attacks, aggressors will often use simple techniques to find a victim's data from what is already leaked online, or openly shared on social media. For more sophisticated attacks, perpetrators might use criminal methods such as impersonation for SIM swap attacks. When attackers have more resources, such as a state-backed attackers, more sophisticated processes might be used, like device infection with NSO Group's spyware.

Maliciously stolen or negligently leaked

Data can be stolen maliciously in all sort of ways, but even more often and common, data is leaked online from banal negligence.

Once data is leaked online, it will likely become accessible to anyone looking for it eventually. Additionally, any data breach happening now has the potential to endanger someone years down the line. Perhaps it's a home address that has not changed in years, a phone number used for a decade, a legal name, a photograph, or even a medical file.

Unfortunately, the data broker industry thrives on bundling up all this data together in neat packages to be sold to anyone looking for it, making any attacker's job much easier.

Unencrypted data

When the data leaked or stolen is well encrypted, the risk is reduced. If the leaked data cannot be decrypted easily, this will greatly mitigate the damage done by a breach. Conversely, unencrypted leaked data will always inflict maximum damage.

This is why we should demand that all the services we use implement strong, end-to-end encryption wherever possible.

Sometimes, the data endangering someone isn't leaked negligently or stolen maliciously, but simply shared by a friend or a family member oblivious to the danger.

This is a cultural problem we all need to work on.

Despite all the technological protections we can put on data, and despite all the regulations we can ask organizations to comply with, if our culture doesn't understand the danger of sharing the data of others, we will fail to protect the most vulnerable people in our society.

Protecting data for everyone's safety is a societal, communal, and individual responsibility

Protecting data isn't simply a matter of preference, although it can absolutely be. But for so many people around the world, it is vital to understand how crucial data privacy is.

As explicitly demonstrated above, data protection can literally mean life or death for people in vulnerable situations. Beyond that, it is unfortunately also true for anyone unlucky enough to get mistakenly targeted when their data is shared.

In all of these situations, data privacy means safety.

We must demand that governments, corporations, and organizations of all kinds do better to improve data protection practices and technologies.

As a community, we also have a responsibility to protect the most vulnerable people from harm caused by data leaks.

And finally, as individuals, we share this duty of care and must all work on improving the way we protect our own data, but even more importantly, the data of everyone around us.

Privacy means safety, for everyone.

Resources in the United States & Canada

If you or someone you know is in one of the situations described above, these additional resources may help. Make sure to take appropriate measures to protect your privacy if your situation is sensitive. If you are in a high risk situation, you might want to access these resources using Tor or Tails.

Suicide & Crisis Support Line 988 Lifeline Phone number: 988 (US & Canada)

Trans Peer Support Trans Lifeline Hotline Phone number US: 1-877-565-8860 / Canada: 1-877-330-6366

Stalking Victim Support US: SafeHorizon / Canada: The Canadian Resource Centre for Victims of Crime

Domestic Violence Victim Support US: The National Domestic Violence Hotline Phone number: 1-800-799-7233 / Canada: Canadian resources by situation and province

Reproductive Rights & Healthcare US: Planned Parenthood / Canada: Action Canada for Sexual Health & Rights

Journalists and Whistleblowers US: Freedom or the Press Foundation Guides & Resources / Canada: Canadian Association of Journalists

Protesters The Protesters' Guide to Smartphone Security

Correction (Mar. 27): This article was updated to correct a typo in a date. The previous version wrongly described the arrest of a French climate activist happening in 2012, when these events actually happened in 2021.

The Future of Privacy: How Governments Shape Your Digital Life

Em — Tue, 25 Mar 2025 20:38:17 +0000

The Future of Privacy: How Governments Shape Your Digital Life

Photo: ev / Unsplash

Data privacy is a vast subject that encompasses so much. Some might think it is a niche focus interesting only a few. But in reality, it is a wide-ranging field influenced by intricate relationships between politics, law, technology, and much more. Further, it affects everyone in one way or another, whether they care about it or not.

I routinely read articles discussing changes in politics on the advocacy side of data privacy. Then, I read articles talking about changes in regulations on the legal side of data privacy. And then, I see all the articles and guides presenting new tools and privacy features on the tech side of data privacy. Of course, all of this is linked together.

Let's talk about how politics, law, and technological features are intertwined, all at once.

Privacy laws are always one election away from getting better, or worse

Each change in government can have a serious effect on data privacy legislation. Privacy is a politically charged field. For example, authoritarian regimes might want to remove or weaken privacy rights to exert strict control over their population. While democratic governments generally bring more freedom and protections to its citizens, including privacy rights. It's important to keep in mind who in the past has bettered citizen rights and protections, and who has actively worked to undermine civil rights.

Each time a new government takes power, its values will be put forward and influence legislation in place, or legislation not in place yet. While the Western world has benefited from some improvements in data privacy law for the past few years, we must consider these gains are fragile and protections could get removed or lessened at any time.

Unfortunately, it seems there is currently a political push towards deregulation, mass surveillance, and a focus on corporate gains. This is extremely worrisome for the future of privacy rights, human rights, and individual liberties.

Following politics and advocating for better privacy rights and legislation is essential in improving access to privacy tools and features around the world. Privacy is never politically neutral.

The tools you use might depend on government funding

Many privacy tools we use depend at least partially on government funding or on other tools which depend on government funding. This is especially true for open-source nonprofit organizations needing some (usually) more stable income, in addition to donations.

Which privacy and security tools could be impacted

One notable example of a privacy-related project receiving government funding is the Tor Project. If this source of funding were cut off, the impact on Tor could be quite detrimental, not only to the Tor Project but to all projects relying on Tor as well. Many privacy-focus software are built around the Tor network. To name only a few, whistleblowing software such as Hush Line and SecureDrop both utilize the Tor network to harden privacy. Briar, Cwtch, and SimpleX, are examples of messaging applications also using Tor to add a layer of security and privacy to communications. Tor is critical infrastructure in the world of data privacy.

Another important project receiving government funding is Let's Encrypt. Let's Encrypt is a nonprofit Certificate Authority providing TLS certificates to websites. It is run by the Internet Security Research Group (ISRG), which receives funding from the Sovereign Tech Agency, supported by the German Federal Ministry for Economic Affairs and Climate Action. The ISRG also receives funding from the Open Technology Fund (OTF), which receives the majority of its funding from the United States government, through the U.S. Agency for Global Media.

In current events, last month an executive order in the United States from the Trump administration led the National Science Foundation (NSF) to freeze grant reviews. This is currently impacting many important projects in the tech world, including the Python Software Foundation (PSF). The repercussions of this freeze could be devastating for many open-source projects, in privacy and beyond.

Government funding should support civil liberties and protections

Governments funding nonprofit projects and organizations working on improving human rights, civil liberties, and technological security and safety is a good thing. This can bring an important source of stable income to nonprofit projects that could not stay afloat solely from donations.

However, this dependency can become precarious when governments aren't working for the good of the people anymore, and when organizations rely too heavily on such support, making them vulnerable to change in power. Such a change of regime can have devastating repercussions on the privacy tools we use.

On the good side of regulatory influence, there are regulations like the General Data Protection Regulation (GDPR). Saying the GDPR revolutionized the world of data privacy would not be an overstatement. While many privacy regulations pre-date the GDPR, in the Western world none had the scope nor the grit the GDPR has.

The GDPR is a data privacy regulation that was adopted by the European Union (EU) in 2016 and became effective in May 2018. Its scope encompasses all the EU member states as well as all the countries part of the European Economic Area (EEA), which together count 30 countries to this day. The United Kingdom also uses an amended version of the GDPR post-Brexit.

However, the reach of the GDPR isn't limited to Europe. Every organization based outside the EU that is offering goods or services to, or is monitoring the behavior of, individuals located in the EU must comply as well. This means that most organizations operating worldwide, regardless of where they are located in the world, must comply with the GDPR.

As is often the case with data privacy laws, it took a few years before Data Subjects (your legal designation under the GDPR) noticed any concrete changes. One change that has become prominent in the past few years, and is likely a direct product of the GDPR, is data deletion features within apps and accounts.

An important right granted by the GDPR to Data Subjects is the Right to Erasure (or the Right to be Forgotten). Other legislation such as the California Consumer Privacy Act (CCPA) calls for a similar right, the Right to Delete. This and similar rights have existed before, but through the GDPR and its enforcement it has affected technology in a much broader and impactful way.

Slowly since 2018, applications requiring accounts have started to implement data deletion and account deletion features within the account itself. A probable reason for this is that due to the GDPR, and a now growing number of privacy regulations from various states in the United States, organizations are obligated to respond to Data Subject requests to get their personal data deleted. Managing this can be quite cumbersome for organizations. The burden of answering and implementing each data deletion request manually is often not worth the value of the data itself. Organizations with enough resources have simply added it as an internal product feature. This makes data deletion requests manageable by each Data Subject themselves (at least partially), freeing the organization from legally having to answer each individual request. When implemented properly, this is what we can call a win-win situation.

Request to delete

Unfortunately, not all applications have integrated automatic deletion features internally (yet). Additionally, some applications and accounts will allow you to delete information only partially this way.

If you wish to exercise or have questions related to your Right to Erasure or Right to Delete, first consult your local privacy regulation to check if you have this right as a Data Subject, Individual, or Consumer. Then, you can contact the organization's Privacy Officer with your request. You can usually find information about an organization's designated Privacy Officer by reading its privacy policy or privacy notice. In any case, it never hurts to ask.

Chat Control wants to break end-to-end encryption

If you are not European, please bear with me. First, everyone outside of Europe should care about what is happening in Europe, regardless. But even if you don't care, you should know this kind of mass surveillance proposition will inevitably leak west, and if adopted will affect us all globally.

What is Chat Control

In 2021, the EU approved a derogation to the ePrivacy Directive to allow communication service providers to scan all exchanged messages to detect child sexual abuse material (CSAM). Although this first derogation was not mandatory, some policymakers kept pushing with new propositions.

A year later, a new regulation (CSAR) was proposed by the European Commissioner for Home Affairs to make scanning messages for CSAM mandatory for all EU countries, and also allow them to break end-to-end encryption. In 2023, the UK passed a similar legislation called the Online Safety Act. These types of messaging mass scanning regulations have been called by critics Chat Control.

Why is Chat Control horrible for privacy, and for children

Such legislation might sound like a noble cause at first, but consider this: Scanning all messages exchanged for any reason treats everyone like a criminal, no matter what. This is not hunting criminals, this is mass surveillance. Not only is this horrifying for privacy rights, but it also endangers democracy. Once a system to mass monitor all written communications is implemented to (supposedly) stop CSAM, new topics to detect, block, and report could be added anytime, and by any future governments. There is nothing that would prevent much less reasonable topics from being added to the list to be filtered out at a later date.

Chat Control would hurt everyone, including the children. Not only would mass scanning of all messages be ineffective at reducing CSAM, but it would endanger the children even further by also scanning their communications. Because yes, children also communicate online. Parents also communicate sensitive information about their children online, with trusted family or doctors. All this data would get scanned and collected, only one breach away from being made public.

Protecting the children is a pretext regularly used to implement abusive regulations undermining individual liberties and protections. Do not get fooled by this demagogic stratagem. Chat Control is the opposite of protecting the children.

Chat Control would only lead to destroying the end-to-end encryption messaging features that are protecting us and the children so well already. Criminals exploiting children would simply move to underground channels, unbothered.

Who opposes Chat Control

Thankfully, opposition from experts and advocates alike has been strong. To name only a few, Meredith Whittaker, president of the Signal Foundation which develops the messaging app Signal, has taken a clear stand against Chat Control. The Electronic Frontier Foundation has also firmly opposed Chat Control legislation. In the UK, the Open Rights Group has led powerful campaigns to fight against the Online Safety Act. In Europe, privacy advocacy organization noyb and former Member of the European Parliament Patrick Breyer have both been fervent defenders of privacy rights raising relentless resistance to Chat Control.

Harmful policies such as Chat Control are a direct example of how politics can affect laws that can cause unimaginable damage to the privacy-preserving technologies we use every day.

Age Verification wants to collect your sensitive data

Another potent example of the protecting-the-children stratagem to undermine privacy rights is Age Verification legislation. In the past few years, this idea of controlling which online content should be accessible to children has raised new proposals around the world.

Age Verification policies generally start with the premise that some content should not be accessible to children online. Again, this could seem like a reasonable idea at first. Nobody would debate that children should be shielded from some type of content. Sadly, we have all witnessed how horrifying the internet can be at times. However, both the premise and methodology to achieve this goal are wrong.

Who will decide what content should be walled online?

First, even putting aside the fact that there is plenty of disturbing content accessible outside the internet (newspapers, television, movies, radio, advertising, etc.), who would be the deciders of which specific content can be accessed by children or not? This can be extremely problematic, to say the least.

There is no objective measure to decide on this, and what might be deemed appropriate by one might not be by another. More importantly in the context of our discussion, what one government might judge appropriate might be very different from the next or previous administration.

This is again a dangerous slippery slope opening the door wide to authoritarian policies.

Age Verification undermines privacy and security

Secondly, how can age be verified online? Of course by collecting more data, on everyone. Age Verification policies don't affect only the children, they affect everyone who wants to access content online. If a website is deemed to display content that should not be accessed by children, the only way to enforce this rule would be to ask for some form of official identity verification from all adults who want to access it.

Proponents of these regulations often refer to "age assurance processes" and suppose these processes to be undoubtedly secure. Anyone familiar with data security will understand how naive this approach is. I will not go into the details here, but you probably can already see how having each private website (or third-party processor) collect such sensitive information from each visitor is horrendous for privacy rights, and data security as well. Of course, these websites or third-party "age assurance processors" will unavoidably become a large treasure trove for thieves, and their sensitive data will be inevitably leaked or stolen sooner rather than later.

Age Verification is one of the biggest privacy threats online. Continuing in this direction could ultimately lead to the end of pseudonymous browsing. Additionally, this could also mean the end of your official ID having any value at all. After all, what unique identification value does a piece of ID keep after it has been leaked in a thousand different data breaches? Maybe even one day bought on a darknet market by a curious teenager in need of accessing some website...

Age Verification is already here, sadly

Regrettably, this is not a hypothetical scare. Age Verification legislation has already passed in Australia, in the UK, as well as in many U.S. states. It is also on the table federally in the United States, Canada, France, Norway, and Europe.

There is some tenacious opposition to Age Verification policies from digital rights and free speech advocates. Unfortunately, there is also a strong push in support of Age Verification from the rapidly growing "age assurance" and identity verification industry, and from many governments worldwide moving towards a surveillance state.

Again, government values are deciding on digital features that impact our data privacy in disastrous ways. If you want to take a stand against Age Verification, you can join the Stop Online ID Checks campaign from the nonprofit organization Fight for the Future.

The future of privacy

There's a lot to be worrying about in today's privacy landscape. Unfortunately, recent political tendencies in the Western world make it difficult to stay optimistic. The trend toward authoritarian regimes and surveillance capitalism is bad news for the future of privacy around the globe.

There is no question that privacy is intrinsically intertwined with politics, and can therefore never be politically neutral. The latest decisions taken by the new U.S. administration running full speed into deregulation and defunding, growing pressure in Europe to break end-to-end encryption in favor of a surveillance state, and invasive age verification policies to censor the web and collect even more data on every netizen is admittedly frightening.

But one thing frightens me even more than all of this. One thing that could end privacy rights, forever. This threat to privacy is never far and always looming.

This threat is giving up.

Despite all the gloom menacing privacy rights, privacy will never be dead as long as we stand up to defend it. Governments might have the power to remove our privacy rights on paper and proclaim privacy features illegal. But the people have the power to keep pushing for better privacy rights and to keep developing even more robust and more accessible privacy tools.

We must continue to advocate loudly for privacy rights and all human rights every chance we have. The fight for better privacy rights is only over when we give up.

Do not give up.

Privacy is Also Protecting the Data of Others

Em — Tue, 25 Mar 2025 20:38:17 +0000

Privacy is Also Protecting the Data of Others

Illustration: Em / Privacy Guides | Photo: J W / Unsplash

In privacy, we talk a lot about how to protect our own data, but what about our responsibility to protect the data of others?

If you care about privacy rights, you must also care for the data of the people around you. To make privacy work, we need to develop a culture that normalizes caring for everyone's data, not just our own. Privacy cannot solely be a personal responsibility, data privacy is team work.

Whatever measures and tools you use to protect your own data, you would never be able to protect it fully without the collaboration of others.

In this context, the people around you might be your family or your friends, but also includes your boss, your doctor, your therapist, your school, your government, and any other person or organization that has control over some of your data.

Conversely, you are also in control of other people's data.

Even if you are not a boss, a doctor, or a therapist yourself, you probably have some photos of your friends, a list of contact information, and copies of sensitive conversations exchanged in private messages with your family. All of this data is under your guard too.

Once you have control over someone else's data, you become its guardian.

Data protection is a communal responsibility

Now to be clear, this isn't necessarily in relationship with the law, although it can be part of it. In this context, I am referring more to ethics. Do we have a moral obligation to care for and protect others to at least the same level we wish to be protected ourselves?

As a connected society, we constantly exchange information with each other. This information is now mostly stored on digital mediums, and can be very easily duplicated and shared elsewhere. Actually, on a technical level, it's even difficult not to constantly involuntarily create duplicates of this data and send it elsewhere.

This is why we must increase our vigilance about protecting the data of others.

Considering the quantity of data that ends up in everyone's possession, data has become a communal responsibility.

We must develop a culture that normalizes data privacy

Privacy is a human right, and a good starting point to protect any human right is legislation. Legislation is undeniably an aspect of data privacy that is in constant evolution, and we can hope that privacy laws will only get better over time. Well, let's not just hope, let's also work to make sure it does.

That being said, laws simply aren't enough.

To truly improve data privacy rights, we must integrate them into our whole culture. This might sound like an over-ambitious endeavor, but culture is flexible and evolves with people's needs.

In the past few decades, our culture and customs have begun to shift against data privacy. Some of us are old enough to remember a time when everyone didn't have a camera in their pocket. At that time, it would have been considered unacceptable in most places to suddenly point a recording camera at a stranger in the street and start filming them without any explanation and without their consent.

Now this kind of disrespectful behavior is a common occurrence, because everyone has the tool to do it. Our society evolved with technological tools, but we neglected to course-correct our culture for it.

We have reached a point where we need to develop a culture of individual responsibility towards each other's data.

This means caring not just for our own data, but caring for everyone's data, whether it's the data of our friends, our family, our employees, our patients, or even complete strangers in the streets, or online.

This will take a lot of time and effort, but we owe it to the next generations to start now.

The principles we should consider in relation to privacy

Our society already has adopted or improved many ethical principles in the past decades that are intimately linked to data privacy.

Some of these principles and values have become much more prevalent in our culture recently, consent being one great example for this.

Consent in privacy is incredibly important. What one person might feel comfortable sharing publicly might be completely different from another person, for example. Privacy cannot be established on a fixed basis without considering individuality and circumstances.

Someone might be happy sharing their name on social media, and someone else might safeguard this information and only use pseudonyms. One person might feel safe sharing their home address online, yet another person could be killed for doing this.

This is why informed and explicit individual consent (with true choices) should always be the center of such decisions, for any type of personal information.

Other principles we must integrate in our culture of data privacy include empathy (my threat model isn't your threat model), trust and respect (secure this data properly if you must collect it), safety (consider someone could get severely harmed by a data breach), and individual liberties (sharing data must be a personal choice, even if there's no danger, it's still valid even if it's just a preference).

Of course, these are only a few principles indispensable to build a culture of data privacy, but since most people are already familiar with these we'll start here.

How we can start building a better culture around data privacy

So, what concrete actions can we take right now to improve our culture around data privacy? What can we do today at the individual level to start better protecting the data of others?

Here are a few practices you can adopt in your daily life to improve the data of the people around you. However, I insist you not just demand others do this for you, but do this for others too. Re-shaping our culture needs to start with ourselves:

Do not post photos of people online without their prior consent. Especially if there are children involved! Before sharing photos of others online, always ask for their consent first.

Be very careful when taking pictures during a protest. There's a lot of nuance to this because it's also important to show protests and make them known (that's usually the goal!), but in some circumstances people might be put in danger if their faces are shown online associated with certain causes.

Be mindful and make sure no one is singled out without consent in your pictures if you post them online. When possible, try to blur/block the faces of the people you couldn't ask for consent.

Blur license plates

When taking photos in the streets and posting them online, be mindful to blur license plates. This might sound extreme but imagine a situation where someone is a victim of domestic violence and their abuser sees their car parked at a shelter, or at someone's place. This information could literally get someone killed. Always keep in mind different people have different threat models.

Safeguard contact information

Never share the contact information of someone with someone else (or something else) without their prior explicit consent. This includes email addresses, phone numbers, legal names, locations, photos, and especially home addresses. This information in the wrong hands could literally get someone killed. Always ask first!

Additionally, be vigilant when importing your contact list in a new application. This could get it shared further than you intended. Ideally, always keep your contact list in an end-to-end encrypted application only.

If someone trusted you with a file (photo, music, video, PDF, text file, etc.), always ask for consent before sharing this file with someone else.

Additionally, always keep this file only locally or stored in a secure end-to-end encrypted service. If this person gives you consent to share this file, ensure that metadata has been removed from it. This person might not be aware of the metadata on this file.

Keep confidences secret

If someone trusts you enough to share something personal with you, do not betray that trust by talking about it with someone else, and especially not on unencrypted services such as Gmail or Twitter's DM. In doing so, you would expose this secret to even more unintended recipients. Respect people's trust in you. Do not share confidences.

If you have private conversations on social media, be mindful not to spread this information elsewhere. If you delete your account, be mindful to also delete the information of others you have stored in your private messages. If someone wants to share sensitive information with you, always invite them to move to an end-to-end encrypted messaging service instead.

Safeguard and delete intimate pictures you received

If someone trust you enough to send you intimate photos of themselves, take this responsibility extremely seriously. If they use an end-to-end encrypted service, do not move the photos out of there. If you do, you could inadvertently upload them to an unencrypted service and compromise the security of these pictures.

If your relationship with this person ends, you should delete all intimate pictures you have received. This is extremely important for their safety, and also possibly for yours. Things could get very problematic legally if your copies were to get accidentally leaked or stolen. No matter how difficult this might be emotionally, do the right thing and delete these pictures fully.

If you are still unconvinced about this one, maybe have a look at Ted Lasso season 3, episode 8 which has a great story demonstrating the dangers related to this.

Avoid taking screenshot of people's posts

Each time you take a screenshot of someone's post to repost it somewhere else, you are effectively removing this person's ability to delete their content later. This is horrible for privacy and for consent. Instead, use links to other people's posts. That way, if they decide later to delete their content, the link will simply not work anymore, but their right to deletion will remain intact.

Notify guests if you are using a smart speaker

If you are using a smart speaker device in your home such as Amazon's Echo (Alexa), Apple's HomePod (Siri), Google's Nest, inform your guests about it when they enter your home. These devices have the capacity to record all conversations, and there has already been instances of accidental privacy invasion reported about this. Even if you don't mind yourself, offer your guests to unplug your smart speaker while they are visiting you. The same is valid for any voice assistant on your phone.

Do not use Windows Recall (or anything similar)

If you are a Microsoft user, make sure to disable Windows Recall from your computer. If it's enabled, this application will continuously take screenshots of your computer, including the faces of anyone video-chatting with you on Signal, the email content of anyone contacting your through Tuta Mail, the secrets of anyone chatting with you on Matrix. Windows Recall completely defeats the protections of anyone using end-to-end encryption to contact you. This is a huge breach of trust! If you somehow use this feature, at least be mindful to disable it each time you communicate with others.

Don't use Meta's Ray-Ban "AI" glasses!

Don't use "smart" glasses recording people.

Just don't.

Ever.

This is extremely creepy.

Never buy nor use this.

If you encounter someone in the street wearing this, run away.

This is only a start, but together we can do this

Improving our culture around data privacy will take time and effort, but we have to start now. The best place to start is with yourself.

Remember:

"Be the change you wish to see in the world."

Be the data protector you wish to see in the world.

Privacy-Respecting European Tech Alternatives

Jonah Aragon — Wed, 19 Mar 2025 20:18:17 +0000

Privacy-Respecting European Tech Alternatives

Illustration: Jonah Aragon / Privacy Guides

There is a growing sentiment that the US shouldn't be relied upon for the technologies that many people and businesses use every day. Lately, the US has been unilaterally cutting off access to critical technologies to European countries, prompting calls for "radical action" to bolster European tech stacks from EU lawmakers.

At Privacy Guides, we generally value technical guarantees over matters like jurisdiction. There is simply no alternative to privacy technologies like strong end-to-end encryption when it comes to protecting your information.

That being said, the United States certainly does not have a monopoly on the best technologies, and many of our favorite recommended tools come from Europe and all over the world. Tools from the European Union also generally benefit from much stronger data protection laws, thanks to the EU's General Data Protection Regulation (GDPR).

If supporting the European tech industry is something that is important to you, here's a non-exhaustive list of some of our favorites. We have many more recommendations throughout our website if you are interested in learning more about privacy-respecting tech alternatives!

Email Services

Many people and businesses are tied to Google's Gmail or Microsoft's Outlook products, but there are far more secure and private alternative email providers out there!

Tuta

Based in Hanover, Germany, Tuta is an email service with a focus on security and privacy through the use of encryption. Tuta has been in operation since 2011.

Free accounts start with 1 GB of storage.

More Info

Proton Mail

Based in Geneva, Switzerland, Proton Mail is an email service with a focus on privacy, encryption, security, and ease of use. They have been in operation since 2013.

The Proton Mail Free plan comes with 500 MB of Mail storage, which you can increase up to 1 GB for free.

More Info

Office Suites

Of course, email isn't the only thing offered by solutions like Google Workspace and Microsoft 365. Many people use their entire suite of productivity tools to manage their businesses and collaborate with others.

Luckily, there are plenty of alternatives that incorporate strong encryption and can even be self-hosted, which will not only decrease your reliance on the traditional Big Tech companies, but keep your data far more secure as well.

CryptPad

Developed and hosted by XWiki in Paris, France, CryptPad is a complete online office suite with applications including Documents, Rich Text, Spreadsheets, Code/Markdown, Kanban, Slides, Whiteboard and Forms.

CryptPad is a private-by-design alternative to popular office tools. All content on this web service is end-to-end encrypted and can be shared with other users easily.

More Info

We recently did a full review of CryptPad, which you should definitely check out if you might be interested in switching!

Nextcloud

Nextcloud comes from German startup Nextcloud GmbH, and offers a complete cloud drive alternative to Google Drive or OneDrive.

Nextcloud is a suite of free and open-source client-server software for creating your own file hosting services on a private server you control.

More Info

LibreOffice

LibreOffice is developed by The Document Foundation based in Berlin, Germany. It's a free and open-source office suite with extensive functionality.

Web-based editors aren't for everyone. If you need a full-fledged office suite that runs locally on your computer, LibreOffice is a fantastic alternative to Microsoft Office.

More Info

Search Engines

One of the most frequently used tools on the internet is the venerable search engine. Switching from Google to an alternative is one of the biggest impact approaches to improving your privacy that you can make.

Startpage

Headquartered and developed in the Netherlands, Startpage is one great alternative to Google you could consider:

Startpage is a private search engine. One of Startpage's unique features is the Anonymous View, which puts forth efforts to standardize user activity to make it more difficult to be uniquely identified. The feature can be useful for hiding some network and browser properties. However, unlike the name suggests, the feature should not be relied upon for total anonymity.

Homepage

It is worth noting that since 2020, Startpage has been a subsidiary of American company System1. Their operations and employees remain in the Netherlands, and you can choose to utilize only European servers if you wish.

Web Browsers

Web browsers are historically very tricky to build, and the three major browser engines, Chromium, Gecko (Firefox), and WebKit (Safari) are all primarily developed by American companies. This is a space that could certainly use improvement.

Mullvad Browser

One of our recommended browsers is spearheaded by Swedish VPN company Mullvad, although it's worth noting that its development is somewhat reliant on American non-profits Mozilla and the Tor Project, being a Tor Browser fork.

Mullvad Browser is a version of Tor Browser with Tor network integrations removed. It aims to provide to VPN users Tor Browser's anti-fingerprinting browser technologies, which are key protections against mass surveillance programs. It is developed by the Tor Project and distributed by Mullvad, although it does not require the use of Mullvad's VPN.

More Info

Mapping and location apps like Google Maps can track your every move, and that data is used by tech companies for a wide variety of purposes, including for military and defense. The best mapping apps for your privacy can be used completely offline:

Organic Maps

Based in Estonia, Organic Maps is an open source, community-developed map display and satnav-style navigation app for walkers, drivers, and cyclists. The app offers worldwide offline maps based on OpenStreetMap data, and navigation with privacy — no location tracking, no data collection, and no ads. The app can be used completely offline.

More Info

OsmAnd

Based in the Netherlands, OsmAnd is an offline map and navigation application based on OpenStreetMap, offering turn-by-turn navigation for walking, cycling, driving, as well as public transport. It is open-source and does not collect any user data.

More Info

Password Managers

KeePassXC

KeePassXC is a community fork of KeePassX, a native cross-platform port of KeePass Password Safe, with the goal of extending and improving it with new features and bug fixes to provide a feature-rich, cross-platform, and modern open-source password manager.

More Info

We recently published an article on securely using KeePassXC with a YubiKey!

Proton Pass

Proton Pass is an open-source, end-to-end encrypted password manager developed by the Swiss company Proton AG, the team behind Proton Mail. It securely stores your login credentials, generates unique email aliases, and supports and stores passkeys.

More Info

Instant Messengers

Switching off of WhatsApp, Facebook Messenger, or iMessage in favor of a more private instant messenger is an excellent way to safeguard your chats.

Element

Element is based in the United Kingdom, which is of course no longer in the European Union. However, it is a trusted messaging platform by the French government, and the German military, among many other organizations in Europe and around the world looking for sovereignty from Big Tech messaging platforms like Slack and Google Messages.

Element is the flagship client for the Matrix protocol, an open standard for secure decentralized real-time communication.

Messages and files shared in private rooms (those which require an invite) are by default E2EE, as are one-to-one voice and video calls.

More Info

SimpleX

Another open-source option from the United Kingdom, SimpleX chat has very strong security features, and can be entirely self-hosted anywhere in the world if you prefer the assurances a custom server can bring.

SimpleX Chat is an instant messenger that doesn't depend on any unique identifiers such as phone numbers or usernames. Its decentralized network makes SimpleX Chat an effective tool against censorship.

More Info

Briar

Briar is an open source project not legally incorporated in any jurisdiction, although it has received funding from European initiatives like NGI and the NLnet Foundation, and includes many Europeans in their voluntary board and team.

Briar is an encrypted instant messenger that connects to other clients using the Tor Network, making it an effective tool at circumventing censorship. Briar can also connect via Wi-Fi or Bluetooth when in local proximity. Briar’s local mesh mode can be useful when internet availability is a problem.

More Info

More Services...

Looking for more? Here's a short (and non-exhaustive) list of other recommendations of ours which are based in Europe:

VPN Services: Mullvad and Proton VPN
DNS Providers: dns0.eu, Mullvad DNS, and Quad9
Calendars: Tuta and Proton Calendar
Notes Apps: Joplin and Crypt.ee
Pastebins: PrivateBin
Linux Distros: openSUSE

If you're in Europe and looking to build or host your own European technology, there are also plenty of alternatives to the typical American IT providers. Topics like cloud computing platforms, web analytics services, and content delivery networks are currently out of scope for what we cover here at Privacy Guides, but European Alternatives is one great resource for finding more services like these.

At the end of the day, we trust all of our recommended privacy tools to keep you safe from prying eyes, but there are many valid reasons you may prefer to stick to the European market.

KeePassXC + YubiKey: How to set up a local-only password manager

Em — Fri, 14 Mar 2025 00:50:26 +0000

KeePassXC + YubiKey: How to set up a local-only password manager

Illustration: Privacy Guides | Graphics: Yubico | Logo: KeePassXC

If you are looking for a good remote password manager you can use from anywhere, there are plenty of excellent options to choose from. However, if you prefer to only store your passwords locally, KeePassXC is what you need. In this tutorial, we will set up KeePassXC to work with YubiKey as an additional factor to secure your local-only password database.

KeePassXC summary

KeePassXC is a free, open-source, and desktop-only password manager. The community-driven project was first released in 2012 and is a fork of both the KeePass Password Safe application and KeePassX, which is no longer actively maintained.

In addition to having its code available for all to see, KeePassXC also went through an independent security review in 2023.

Because it does not automatically sync with any remote cloud service, KeePassXC works offline by default. This offers additional protections for your privacy, and potentially for your security as well, depending on your specific situation.

Platforms

KeePassXC can run on Linux, macOS, and Windows computers. There is no direct option for a KeePassXC application on mobile. The KeePassXC team suggests using KeePassDX or KeePass2Android on Android phones, and Strongbox or KeePassium on iPhones.

Database cloud backup

KeePassXC is local-first and will not automatically back up your password database in the cloud. This can be both an advantage for security and privacy, and a disadvantage if something were to happen to your device.

To prevent losing access to your passwords, it is recommended to regularly back up your encrypted database .kdbx file in a remote cloud storage of your choice, or on an encrypted external drive or USB stick.

When copying this file to a third-party cloud service, it will remain fully encrypted and only get decrypted locally on your device. That being said, it's still always best to select an end-to-end encrypted cloud storage whenever possible.

Feature overview

This tutorial only covers the basic installation to get you ready using KeePassXC locally, with a main password secured with a YubiKey. However, KeePassXC offers a lot of features you might also want to have a look at.

In addition to the features we will set up here, KeePassXC offers the following:

What's new with KeePassXC 2.7.10

On March 4th, KeePassXC released its most recent update. This update includes the capacity to import Proton Pass databases, to generate passphrases using mixed case (a mix of uppercase and lowercase), and many other useful features.

Requirements and preparation

Operating systems

This tutorial was completed using macOS, but your experience shouldn't be much different if you are using Linux or Windows.

For this tutorial you will need:

Computer running Linux, macOS, or Windows
Internet connection
Ability to install software on this computer
One or two YubiKeys (ideally two)

Setting up KeePassXC

Step 1: Download and Install KeePassXC

Go to KeePassXC's download page and download the application version for your operating system. If the website doesn't detect your system automatically, you can change it on the top menu, or click on the "See more options" yellow button for previous versions.

Verifying signatures

For ideal security, you can verify the authenticity and integrity of the file you just downloaded by verifying the file's signatures. To do this, follow the instructions from the website to guarantee the file you downloaded was created by the KeePassXC Team and has not been tampered with.

Complete the process for your respective OS to install and open the application once verified.

On macOS, you will be prompted with a warning message saying "“KeePassXC.app” is an app downloaded from the Internet. Are you sure you want to open it?", click "Open".

KeePassXC blocks screenshots by default

Interestingly, KeePassXC has a security feature that blocks screenshots and recordings of the application window on macOS and Windows.

This is a great feature to prevent accidentally sharing your decrypted password database information during a meeting presentation, for example.

Thankfully for writing this tutorial, there is a way to disable it temporarily, but you should definitely keep it on.

Step 2: Adjust the settings

Once you have installed and opened KeePassXC, before creating a database for your passwords, click on the "Settings" gear button on the upper-right, on the toolbar.

From there, you will see many options you can adjust to your preferences. The default settings are already good, but you might want to tweak a few things to your specific usage.

Keep a previous version backup (recommended)

Scrolling down to the "File Management" section, you might want to enable the option to "Backup database file before saving". This will ensure you always have a backup of the previous version of your database, in case you accidentally delete important information for example.

You can store this backup in the same or a different directory. You can change this backup's name or keep the default that will append .old to your database filename.

Add icons specific to each service (optional)

If you want to use icons specific to each service for your password entries, you can go to the "Security" subsection on the left-side menu, then in "Privacy" at the bottom enable "Use DuckDuckGo service to download website icons". This isn't enabled by default. Then click "OK" on the lower-right.

Offline only?

Do not enable this if you wish to use KeePassXC offline only. You will still be able to use different default icons for you entries instead of downloading specific icons from the internet.

Step 3: Create a database

A database in KeePassXC is an encrypted file that will contain all the passwords you register.

You can use multiple separate databases with KeePassXC. For example, you could have a database for work, a database for your family, and a database for your personal accounts. All stored in separate files with separate main passwords. In the application, each database can be opened in its own tab.

To create a new database, from the Welcome section click on the "Create Database" button on the lower-left.

If you want to create a secondary database, you can also click on the dropdown Database menu on the application menu bar, then select "New Database".

Importing an existing database

If you already have a password database file in the format .kdbx, you can import it from the Welcome page by clicking on "Import File" on the lower-right.

You will see a window pop up with "General Database Information". Pick a name and description for your database and click on "Continue" at the bottom.

For the second step, an "Encryption Settings" section will pop up. From there, you will be able to change the settings to your preferences. If you are not familiar with encryption algorithms, simply keep the defaults on and click "Continue" again.

For the next step, a "Database Credentials" section will pop up. From there, you will be able to choose a main password to lock your entire password database.

At this step, it is very important to choose a password that is unique, complex, and long. This is the password that will protect all your other passwords. It should be easy to remember for you, but it must be unique and long. Ideally, pick a passphrase.

Generate a main password (optional)

If you do not feel inspired, you can use the "Generate password" dice button on the right to help you pick a strong password.

No matter if you invent or generate your main password/passphrase, make sure to remember this main password well. You cannot rely on your password manager for this one.

This step isn't over yet!

This is where you will be adding your YubiKey to further secure your database. Keep the "Database Credentials" application window open and continue with the step below

Securing your database with a YubiKey

To add a YubiKey to secure your KeePassXC database, you will first need to prepare your YubiKey(s) for it, if it's not already ready to use with a Challenge-Response application.

Using a YubiKey will not add authentication per se (read more)

Technically speaking, adding a YubiKey to your KeePassXC database isn't a second factor of authentication because KeePassXC isn't a service, therefore it cannot "authenticate" you.

However, adding a YubiKey to secure your KeePassXC database will make decryption of your database more secure by enhancing the encryption key of your database.

The Challenge-Response will remain the same each time you decrypt your database, however, it will change each time the database is updated (each time there is a change to it, such as adding an entry, removing an entry, adding a note, etc.). Note that the previous versions of your database could get unlocked with your main password + your key's previous Challenge-Response, however.

If your key's Challenge-Response were to become compromised, you could update your database (by adding or changing an entry for example), then fully delete all previous versions of your database. This would effectively make all previous Challenge-Response obsolete to unlock your current database.

You can read more on this in KeePassXC's documentation.

Step 4: Prepare your YubiKey(s)

Because you cannot register two YubiKeys for this type of application, you should first make sure that you either have a secure backup for this Challenge-Response, or that you have cloned it to two YubiKeys, or more. This is important in case you were to lose your YubiKey.

If you do have two YubiKeys, we have a guide on how to reset your YubiKeys entirely and set up multiple keys as a backup which you may be interested in.

If you only need to learn more about the Challenge-Response YubiKey application, jump to this section of the tutorial directly.

Step 5: Add your YubiKey

Once your YubiKey's Challenge-Response slot has been properly configured and backed up, return to the KeePassXC's "Database Credentials" window, and click on the "Add additional protection" button in the middle.

This will open a new section with "Key File" and "Challenge-Response" options. Scroll down to "Challenge-Response". Plug in your YubiKey in your computer's port (only plug one key at the time), then click on the "Add Challenge-Response" button.

YubiKey or OnlyKey

You can also use an OnlyKey to secure your KeePassXC database in the same way.

You should see your YubiKey's model and serial number listed, and also which YubiKey slot you have stored your Challenge-Response in. Once the correct key is selected, click on "Done" at the bottom.

A window will pop up to ask where you want to save your password database. Name your database file and save it in a secure directory on your computer. You will then be asked to touch your YubiKey.

Touch the gold part of your YubiKey to save your database file. You will have to touch your YubiKey each time you save this database, and the file will be saved each time you make changes to it.

Important! Unlocking your database

Each time you unlock your KeePassXC database, make sure to first plug in your YubiKey and verify that the "Use hardware key" checkbox is checked. Then, enter your main password and touch the gold part of your YubiKey when prompted.

If you do not plug in your YubiKey first, an error will be triggered, and you will be unable to unlock your database.

Using KeePassXC

Using KeePassXC is quite simple and resembles most other password manager applications. The biggest difference is that your passwords will remain stored locally, unless you decide to back up your password database to a cloud service of your choice.

All the options to manage and use your entries credentials will be located on the toolbar at the top.

Locking the database

At all time when the application is open, you can click in the "Lock Database" padlock button on the toolbar to lock your database. You can also adjust the settings to lock your database each time you minimize the application window (this is disabled by default).

Your database will already lock itself automatically when your laptop lid is closed, the session is locked, or if your switch user (unless you disabled these options manually in settings).

Step 6: Create a password entry

To create a new entry for a password, click on the "Add a new entry" plus-shaped button on the toolbar.

From this section, you will be able to register a "Title", "Username", "Password" (or generate one), "URL" (this is important if you use the browser extension), "Tags", "Expires" date, "Notes", and more.

Keep your YubiKey plugged in when changing your database

When adding/removing entries or changing your database in any other way, make sure your YubiKey is plugged in. You will have to touch it each time you save changes to your database.

Before saving your entry by clicking "OK" on the lower-right, explore the options on the left-side menu.

For example, in the "Advanced" section you can add additional attributes and store attachments, in the "Icon" section you can select an icon to represent your password entry (or download one from the web), in the "Auto-type" section you can enable/disable Auto-type, and in the "Properties" section you will see additional metadata for this entry.

Once you have set up all the information you need for this password entry, click "OK" to save it to your database. You will be prompted to touch the gold part of your YubiKey to complete the operation. You should now see your entry listed in your database.

Each time you need this information, you can select an entry and click on the "Copy username to clipboard" character-shaped button, or the "Copy password to clipboard" key-shaped button, or the "Copy URL to clipboard" earth-shaped button on the toolbar.

The data will stay in your computer's clipboard for 10 seconds then will get cleared (unless you changed this from the default setting). Once copied, paste this information in the appropriate field for your service.

Accidental deletion danger!

Be careful not to mistakenly click on the dangerous "Delete Entry" trash-shaped button left to the "Copy username to clipboard" button on the toolbar!

You would have to touch your YubiKey to confirm deletion, but remain careful. If you click on it accidentally, do NOT touch your YubiKey to confirm!

If this accident happened to you, you might see your entry has been moved to a "Recycle Bin" directory on the left. Right-click on your entry and select "Restore Entry" at the top of the entry menu. Touch your YubiKey when prompted. You should now see your entry back in the "Root" directory on the left-side menu.

Step 7: Back up your database

There are many ways to back up your KeePassXC database:

Automatic local backup

If you enabled this setting on Step 2, you will see a second file getting saved in the same directory with the same name but with an appended .old to it when you make a change to your password database.

This is the previous version of your database. If you delete a password entry by mistake for example, you can easily restore it with this secondary database backup file.

When your database is unlocked, you can click on the dropdown "Database" menu in the application menu bar (not the toolbar), then select "Save Database Backup".

You will have the option to rename this file and choose a different location. Then, you will be prompted to touch your YubiKey to confirm.

Manual backup from copying the database file

Another way to keep a backup of your password database is to simply copy the database .kdbx file somewhere else.

You can copy this file to another local directory, an external drive (ideally encrypted), or a secure cloud service of your choice (ideally an end-to-end encrypted one). Even if your database will be encrypted, it's always better to choose secure cloud services that offer solid end-to-end encryption.

Entry history

Within your database, KeePassXC also maintains a history of changes made to each of your entries. You can read more about this feature from KeePassXC's documentation.

Step 8: Install the browser extension (optional)

When you need to use KeePassXC to fill credentials in a browser or an app, you can always copy the entry field you need manually, as explained on Step 6. But if you prefer, to facilitate filling credentials for web-based services, you can take advantage of KeePassXC's browser extension.

To install the extension, go to this page from the KeePassXC website and click on your browser's category.

This means that for any Firefox-based browser, you can click on the Firefox logo, and for any Chromium-based browser, you can click on the Chrome logo. Some browsers might not be supported, however.

Privacy warning

Keep in mind that although browser extensions can be very convenient, they can also introduce some risk to your privacy.

Even if the KeePassXC browser extension only runs locally, it does need to collect some information for its functionalities, and any additional extension installed has the potential to introduce a new attack surface.

Additionally, the more unique your combination of hardware, software, and browser extensions is, the more you are vulnerable to browser fingerprinting. Always be mindful to consider your specific threat model when installing new browser extensions.

Once you have installed the extension for your browser, go back to the KeePassXC application and click on the "Settings" gear button on toolbar. Click on "Browser Integration" on the left-side menu and check the box for "Enable browser integration" at the top of the section.

From this section, check the box for the browser(s) or browser type(s) you have installed the extension on. You can also enable the option "Search in all opened databases for matching credentials" if you are using multiple databases. Then click "OK" on the lower-right to save these options.

Make sure your KeePassXC database is unlocked, then restart your browser.

If you encounter an error while running the extension

You don't have to use the extension

If you are not able to make the KeePassXC extension work with the browser you use, you can still use KeePassXC by manually copy-pasting your entries' credentials. It can even be a more secure and more private way to use it.

After installing the extension and enabling it from the KeePassXC settings, you might encounter an error where the KeePassXC icon in a credential field is marked with a red "X", a red "!", or a padlock icon.

If this happens, try the following:

Make sure your KeePassXC application is open, and your database is unlocked.
Check if your YubiKey is plugged in your computer's port.
Verify that your browser is compatible and does not use protections that could block the extension from working.
Follow KeePassXC's instructions to connect your KeePassXC database to your KeePassXC browser extension.
Look for possible solutions from KeePassXC's troubleshooting guide.

Filling credentials using the extension

The database is connected but the logo is greyed out

If you do not have an entry for this website, or if you have not registered a URL (or the correct one) for this entry, your will see the KeePassXC logo greyed out. This simply means your database could not find any credentials matching this website's URL.

Once configured and connected properly, you should see a green KeePassXC logo in the credential fields, when you have a corresponding entry in your database.

Click on the green KeePassXC logo to populate all credential fields automatically.

Congratulation! You're in!

You are now logged in, thanks to KeePassXC!

Consider supporting KeePassXC

KeePassXC is a free and open-source project built by the community. If you use and love this application, it's always a great idea to support the project if you can.

Here are a few ways you can help keep KeePassXC thriving:

For more information on KeePassXC and its many features, you can consult the official Documentation and FAQ or even have a look at KeePassXC's code on GitHub.

Unless credited otherwise, all screenshots from: Privacy Guides

How to Reset Your YubiKey and Create a Backup

Em — Thu, 13 Mar 2025 15:29:25 +0000

How to Reset Your YubiKey and Create a Backup

Photo: Yubico

If you are not familiar with it already, a YubiKey is a physical security key produced by Yubico that can be used for various authentication and security purposes. One common usage is to use it as a second factor of authentication for a service or product. This tutorial explains how to reset a YubiKey to factory defaults and create a near copy of it for backup purposes.

The biggest security advantage to using a physical security key is that it's something you have that cannot be accessed remotely or easily emulated.

The biggest security disadvantage of using a physical security key is the risk of losing it. This is why you should always get two physical security keys, to use the second one as a backup.

There are many brands of physical security key, but this tutorial is specifically for YubiKey, one of the most recommended brands.

To follow this tutorial, you will need to have two YubiKeys from either the series 5, 5 FIPS, 4, or 4 FIPS. Both these keys should not be currently in use with any of your accounts, as described in Step 1.

Danger! Reset is irreversible!

Do not skip Step 1 below! If one or both of your YubiKey(s) are registered with any account before starting the reset, you must first remove the key(s) from this account's settings.Once a YubiKey application is reset, this operation is irreversible and previous settings will be lost permanently. Be very careful about this!

Why would you need to reset your YubiKey?

Resetting your YubiKey isn't something you should be doing regularly.

If you use your key with a lot of services, it can be a laborious and even dangerous task, for example if you forget to remove an account and get permanently locked out once your key is reset. However, there are a few situations where you might want to do this:

You accidentally "doxxed" yourself

When using a security key regularly, it isn't rare to accidentally touch your YubiKey and inadvertently trigger its Challenge-response in an inappropriate field. If this happens in the wrong field, this information could get stored in a service provider's log files for example.

Perhaps you also just "doxxed" yourself by unintentionally texting your key's Challenge-response to a puzzled recipient in a personal unencrypted social media Direct Message (true story).

The privacy risk of this is low but, depending on your situation, leaking your YubiKey's One-Time Password (OTP) Challenge-response in a plain text field could technically create a link between accounts. This is because despite the second part of the string changing every time, the first 12 characters are static, meaning this part always remains the same. This static part is the Public ID of your YubiKey. When resetting your YubiKey, you can change this static part.

Your key is compromised

Another situation that could make you want to reset your YubiKey is if you are in a very high risk situation and a sophisticated malicious actor had physical access to your key, especially if your key's firmware is older than 5.7. If this person or group were able to physically accessed your key with older firmware, under some rare conditions, they could have cloned it.

If you are at risk and this happens to you, you would first need to revoke access to all the services you've used your compromised key with.

Then, to re-register a key with your services, the safest course of action would be to get an entirely new set of keys. But if this isn't possible, a second option could be to reset your key and re-register it with new credentials.

You need to set up a backup

This is the most common situation we will be focusing on. You might need to reset your YubiKeys' applications simply to create a clone of it so that you have a backup.

Keeping a backup of your key is especially important for usages such as setting up a YubiKey as a second factor of authentication with KeePassXC, for example.

Some services will allow you to register two or more different keys to authenticate your account, but other services might only allow you to register one. This is when you want to make sure your have a backup of this key.

Requirements and preparation

For this tutorial you will need:

Two YubiKeys (from series 5, 5 FIPS, 4, or 4 FIPS)
Computer running Linux, macOS, or Windows
Internet connection
Ability to install software on this computer

It is recommended to follow this tutorial from a desktop computer.

Step 1: Remove your keys from all accounts

First, make sure you are not using these two YubiKeys with any account, service, or product. The importance of this cannot be stressed enough. You do not want to realize next month you are permanently locked out of an account because you reset your key and forgot it was set up with that account.

If you are using these keys with any account, remove the keys from the setting of each account and test multiple times that you are able to log in without it. Ideally, start with fresh keys.

YubiKey's applications can be reset independently

Depending on your situation, you might want to reset one of your YubiKeys' application and not all.

Except for the YubiKey Bio Series Multi-protocol Edition (which we don't cover in this tutorial), each YubiKey application can be reset independently without affecting the others. You could for example reset your OTP slots without affecting your FIDO2 settings, and vice versa. For this tutorial, we will reset every application. Skip the ones you do not need to reset.

Step 2: Download and install the Yubico Authenticator

Go to this Yubico website page, click on the link for your specific Operating System, then download and install the Yubico Authenticator application on your computer.

Step 3: Open the Yubico Authenticator and plug in your keys

Open the Yubico Authenticator application. If you can, insert both your YubiKeys in your computer's ports. If you can't insert both keys at once, insert your main YubiKey first, then for each step unplug your main key once you are done, plug in your spare key, and repeat each step.

From the "Home" section, you can see your keys' serial number, firmware version, as well as which applications are installed on your key. You can also set labels for each key and change the interface's color to make it easier to see which key you are configuring.

If you don't see the menu options

If you do not see the menu on the left (Home, Accounts, Passkeys, Certificates, Slots), make the Yubico Authenticator window wider or click on the 3-bar button on the upper-left. If you do not see the menu on the right (Device, Application), click on the 3-dot button on the upper-right.

Resetting your YubiKey to factory defaults

Disabling applications

From the "Device" menu, you can click on "Toggle applications" to enable or disable applications independently. Note that disabling a YubiKey application doesn't reset it, all credentials and settings will be preserved.

Step 4: Delete your YubiKey's One-Time Password (OTP) application

This step will not reset your YubiKey's OTP application to exact factory defaults, but it will emulate a factory reset very closely once you have added new credentials in the following sections.

4.1. From the Yubico Authenticator

Click on the "Slots" button in the left-side menu. You will see 2 slots listed there labeled as "Short touch" and "Long touch" slots. If these slots are configured already, under the label you will see "Slot is configured". Click on each configured slot.

4.2. Delete credential

This will open a new menu on the right. Click on "Delete credential" (if you cannot see this option, it could be because your program window isn't big enough, scroll down to see more options).

A "Delete credential" message will pop up with a warning, click "Delete" on the lower-right.

Verify that you see both slots labeled with "Slot is empty" in the Slots section.

Step 5: Reset your YubiKey's FIDO2, OATH, and PIV applications

Compatibility:

This step might not work fully with models older than YubiKey 5 and 5 FIPS Series

5.1. Reset OATH

From the Yubico Authenticator, in the "Device" menu on the right, click on "Factory reset". On the "Factory reset" popup section, click on "OATH". You will see a checkmark appear over "OATH", then click on "Reset" on the lower-right.

Danger! This step is irreversible!

Reset cannot be reversed! Make sure you have properly unpaired all your accounts from this key before clicking "Reset".

5.2. Reset FIDO2

From the "Device" menu, click on "Factory reset" again. This time click on "FIDO2". You will see a checkmark appear over "FIDO2", then click on "Reset" on the lower-right.

You will be prompted to unplug your YubiKey from your computer. Unplug it, wait for the Status message to change with "Reinsert your YubiKey" then plug it in again.

When prompted to "Touch the button on your YubiKey now", touch the gold part of your key.

You will see a confirmation message saying "FIDO application reset". You can now click on "Close" on the lower-right.

5.3. Reset PIV

From the "Device" menu again, click on "Factory reset" again. This time click on "PIV". You will see a checkmark appear over "PIV", then click on "Reset" on the lower-right.

Reset your spare key too!

If you inserted both of your keys at once, click on your spare key on the left-side key menu. Repeat the 3 steps above for your spare key. If you inserted only one key at the time, insert your second key and repeat this process.

Step 6: Reset your YubiKey's OpenPGP and YubiHSM Auth applications

Compatibility for YubiHSM Auth

The YubiHSM Auth application is only available for YubiKeys with firmware version 5.4 or higher. Use the Yubico Authenticator to determine your YubiKey's firmware version.

To reset the OpenPGP and YubiHSM Auth applications of your YubiKey, you will need to install a Yubico CLI program called ykman CLI and use a terminal application.

You can install ykman CLI using a package manager such as pip or brew, or by downloading the package from the Yubico developer's website:

6.1. Install ykman CLI

From any OS, using the pip package manager:

Open a terminal application and type:

pip install --user yubikey-manager

For Linux users

Yubico makes the ykman CLI Python program files available on its website and on its GitHub repository. Consult the documentation provided to ensure you have all the programs required for the installation. Certain third-party package maintainers might also offer ykman CLI (also called YubiKey Manager CLI) for several Linux distributions other than Ubuntu.

From Linux (Ubuntu), using the Yubico developer's website:

On this page, download the latest tar.gz file and decompress it. Run the ykman Python program using the command line from the directory you have installed it in.

From Linux (Ubuntu), using Yubico's yubico/stable PPA type:

Open a terminal application and type:

Terminal

sudo apt-add-repository ppa:yubico/stablesudo apt updatesudo apt install yubikey-manager

From macOS, using the Homebrew package manager:

Open a terminal application and type:

brew install ykman

From macOS, using the Yubico developer's website:

On this page, download the latest mac.pkg file, then double-click on it to complete the installation.

From Windows, using the Yubico developer's website:

On this page, download the latest win64.msi file, then double-click on it to complete the installation.

6.2. Navigate to the application directory

You might need to navigate to the application's directory first:

Installation path

If you have chosen a different installation path from default, you will need to navigate to this installation path instead.

From macOS, in the terminal navigate to:

cd /Applications/Yubico\ Authenticator.app/Contents/MacOS/

From Windows, in the command prompt navigate to:

64-bit Systems:

"C:\Program Files\Yubico\YubiKey Manager CLI\ykman.exe "

32-bit Systems:

"C:\Program Files (x86)\Yubico\YubiKey Manager CLI\ykman.exe "

6.3. Reset the applications

To make sure you reset both keys properly in this step, only plug one key at the time in your computer. Complete all the operations, unplug your main key then plug in your spare key and repeat.

Once your main key is plugged in, in the terminal or command prompt type this line:

ykman openpgp reset

When prompted with this warning, type Y:

"WARNING! This will delete all stored OpenPGP keys and data and restore factory settings. Proceed? [y/N]:"

You should see this confirmation message:

"Reset complete. OpenPGP data has been cleared and default PINs are set."

Security warning

This operation will set default PINs for your YubiKey's OpenPGP application.

If you need to use this application later, you will need the default PINs. After reset, you should set up a new unique PIN and Admin PIN for this application, as explained on Step 11.

You can see more setting commands for this application in Yubico's documentation.

From the terminal, type this line:

ykman hsmauth reset

When prompted with this warning, type Y:

"WARNING! This will delete all stored YubiHSM Auth data and restore factory setting. Proceed? [y/N]:"

You should see this confirmation message:

"Reset complete. All YubiHSM Auth data has been cleared from the YubiKey."

Reset your spare key too!

Don't forget to unplug your main key, plug in your spare key, and repeat the process from Step 6.3 to reset your spare key as well.

The ykman CLI program

You can use the ykman CLI program to do a lot more with your YubiKey. If you want to explore this program further, you can consult Yubico's documentation.

Setting up and backing up of your YubiKeys

Now that you have a set of two freshly reset YubiKeys, we will set up your main key while creating a backup of each application that allows it to your spare key. The goal here is to create a spare key that you can safely keep as a backup, in the unfortunate event that you were to lose your main key.

Keep in mind that your accounts and services will be only as protected as your least secured key. Make sure to protect both keys well.

Step 7: Secure your keys

Before starting to use your keys, Yubico recommends changing the default PIN, PUK, and Management Key from their factory values. If you are using a YubiKey from the 5 FIPS Series with firmware 5.7 or later, changing this is required to enter the FIPS approved mode.

7.1. From the Yubico Authenticator

On the left-side menu, click on the "Certificates" button. You will see a section for various certificates in the center and in the right-side "Manage" menu, buttons to "Change PIN", "Change PUK", and "Management key".

7.2. Change the default PIN

Click on the "Change PIN" button and a section will pop up. Enter a new PIN that is between 6 and 8 characters long, then click "Save".

7.3. Change the default PUK

Click on the "Change PUK" button and a section will pop up. Enter a new PUK number that is between 6 and 8 characters long, then click "Save".

7.4. Change the default Management key

Click on the "Management key" button and a section will pop up. Enter or generate a "New management key" with a maximum of 64 characters. You can also change the encryption algorithm to "TDES", "AES128", "AES192", or "AES256" and add a pin protection by clicking on "Protect with PIN". Then click "Save".

Secure your spare key too! Don't forget to repeat all of these steps for your spare key!

Step 8: Create and register each key's OTP

First, you will need to set up your keys' OTP and register them with YubiCloud. For security reasons, this setup cannot be cloned on your spare key. For services using OTP, you will need to register both of your keys which each service or product.

Add both keys

Each time you secure a new account with your YubiKey, make sure to add both keys right at the start. This will save you the complication of going back to add your spare key to your accounts later on.

8.1. From the Yubico Authenticator

Click on the "Slots" button in the left-side menu. You will see 2 slots listed there labeled as "Short touch" and "Long touch" slots, both slots should be empty after the reset.

Click on the first "Short touch" slot, then on the right-side menu, click on the "Yubico OTP" button in "Setup". A "Yubico OTP" section will pop up with three text fields.

8.2. For the Public ID field

The Public ID of your YubiKey will be the first 12 characters of your key's OTP string. This is the static part that could technically create a link between your accounts if you leak it somewhere inappropriate.

You can click on the "Use serial" star button on the right to generate a ModHex string from your key's serial number, or you can type your own manually.

If you decide to manually type your Public ID

Remember the string must be 12-characters long
You must only choose characters comprised within: bcdefghijklnrtuv
Because this string remains constant, to increase your privacy, favor a random string that isn't recognizable or specifically interesting. For example, resist the temptation to choose something irresistibly cool like "vvbetterdude" or "vvfiercenerd".

8.3. For the Private ID field

The Private ID of your YubiKey will also be 12-characters long but will not show in your key's OTP string. This Private ID can be used to store a private identity that can be accessed by a remote validation server holding the AES key used to encrypt the OTP.

You can click on the "Generate random" circle-arrow button on the right to generate a random ID, or you can type your own manually.

If you decide to manually type your Private ID

Remember the string must be 12-characters long
You must only choose characters comprised within: abcdef0123456789
If you want to increase your privacy, again favor a random string that isn't recognizable or specifically interesting. For example, resist the overwhelming temptation to choose something unbearably cool like "c0de1337cafe" or "bada55babe42"

8.4. For the Secret key field

The Secret key of your YubiKey's OTP is a 32-character long random string. Again, you can click on the "Generate random" circle-arrow button on the right to generate a random Secret key, or you can type your own manually. If you decide to use your own Secret key, characters must be comprised within the allowed abcdef0123456789.

To remove automatic carriage return

Automatically once you have filled all the fields, the option "Append" will get a checkmark. This means that each time you trigger your key's OTP, a carriage return will be added so that you will not have to press Enter each time. If you do not wish this to happen, you can click on "Append" to disable it.

8.5. Save your OTP credentials

On the drop-down menu next to Append at the bottom, click on "No export file" and select "Select file". This will allow you to save this information locally and create a backup. You will need this information to register your keys later in Step 8.7.

Caution! Safeguard this file properly!

This text file contains sensitive information in plain text. Make sure to pick a location to store it that is secure and encrypted. For example, do not store this file in a cloud service that isn't end-to-end encrypted. Ideally, only keep this file offline on an encrypted drive.

Once all the information is filled, click on "Save" at the lower-right. The file you save will have the following coma-separated format:

[serial_number],[public_id],[private_id],,[secret_key],[date],

8.6. Set up the OTP credentials for your spare key

To set up the OTP for your spare key, go back to the "Slots" section and click on your spare key listed on the upper-left key menu. If you were only able to plug one key at the time, unplug your main key and plug in your spare key. Repeat Steps 8.1 to 8.5 with your spare key. Make sure to select a different file name for Step 8.5 to not overwrite your main key's credential file.

8.7. Register your keys

Now you will need to upload your keys' OTP credentials to the YubiCloud validation service. To avoid confusion, unplug one of your key and only keep one key plugged in at the time during the registration process.

Go to Yubico's validation page from a secure browser. Open the credentials file you have saved on Step 8.5 and copy each field in the corresponding section.

For the "OTP from YubiKey" field, click on the text field and touch your key's gold part to generate it. Then click on "I'm not a robot", solve the annoying CAPTCHA, and click on "Upload".

On the next page, you should see "Yubico OTP key upload" and under it the confirmation: "Success!" and "Key upload successful".

Under you key's Public ID, you will see 3 steps validating your key. This can take some time, be patient and do not close this page.

Once your key's OTP credentials are fully uploaded to YubiCloud's validation server, you will see a "Try it out" green button appear. Click on it.

On this testing page, you can verify that your key's OTP slot works properly. Click on the "Yubico OTP" text field and touch the gold part of your key. You should see a small popup message on the lower-left confirming "OTP is valid". Try it a few times, then you can close this page.

Finally, unplug your main key, plug in your spare key, and repeat this step using your spare key's saved credentials. It's important to register both your main and spare keys.

Step 9: Create and clone your key's Challenge-response

For use with KeePassXC

This step is not necessary for all services, but is important for some services and products that will only allow you to register one key. For example, this is important if you wish to use YubiKey as a second factor to unlock your KeePassXC password database.

9.1. From the Yubico Authenticator

If you can, insert both your main and spare keys at once, and start configuring your main key on the upper-left key menu.

Click on the "Slots" button in the left-side menu. You will see 2 slots listed there labeled as "Short touch" and "Long touch" slots.

Verify configuration

If you have configured your keys' OTP in the previous step, the "Short touch" slot should now be labeled with "Slot is configured" and the "Long touch" slot should be empty.

Click on the "Long touch" slot, and on the right-side menu click on the "Challenge-response" button in "Setup". A "Challenge-response" section will pop up with a "Secret key" text field.

9.2. Generate a Secret key and save it

Click on the "Generate random" circle-arrow button on the right to generate a key. Before clicking save, you must copy this Secret key at least temporarily somewhere safe. This is how you will be able to clone your key's Challenge-response to your spare key.

Caution! Safeguard this Secret key properly!

This Secret key can be used to clone your YubiKey's Challenge-response on any other keys.

If you only want to create one spare key, only copy this Secret key to a local text file and delete it fully once the configuration is completed and tested.

If you want to keep it to create more spare keys later on, make sure to choose a location to store it that is secure and encrypted. For example, do not store this Secret key in a cloud service that isn't end-to-end encrypted. Do not store this Secret key in the same password manager you will unlock it with. Ideally, only keep this Secret key locally, offline, on an encrypted drive.

Click on "Require touch" if you wish to have to touch your YubiKey each time your key's Challenge-response is solicited. This is recommended as it will limit your key's Challenge-response being triggered unintentionally. Then, click on "Save" on the lower-right.

9.3. Clone your key's Challenge-response to your spare key

Back to the "Slots" section, click on your spare key in the upper-left key menu. The click on "Long touch" and on "Challenge-response" again. Make sure you have selected your spare key this time.

In the "Challenge-response" text field for your "Secret key", instead of generating a random one, paste the Secret key you have copied from your main key in the previous step. Click again on "Require touch" to enable it if you wish (optional), then click "Save". You should now see both your spare key's "Short touch" and "Long touch" labeled as configured.

Make a note of which application is in each slot

Although you can swap your YubiKey's slots, make a note of which application you have set up in which slot. If later on you need to delete an application to configure a different one, you want to make sure you delete the right one.

Step 10: Register and copy your key's OATH-TOTPs, Passkeys, Static passwords, and OATH-HOTPs

YubiKey only has 2 configurable slots

You can only set up 2 YubiKey slot applications at the time.

If you have already configured the 2 slots for the Yubico OTP and Challenge-response applications, and want to keep it that way, you will have no space to add a Static password or OATH-HOTP codes.

In this case, you might want to skip the optional Steps 10.3, 10.4, and 10.5. You will still be able to add OATH-TOTP codes and Passkeys, because these applications are not stored in slots.

10.1. Register and copy OATH Time-based One-Time Password (OATH-TOTP) codes

To copy the OATH-TOTP authentication codes to your spare key, you will need to use the same QR code your were provided when originally registering an account on your main key.

When you add a new account to your YubiKey's OATH-TOTPs, keep a copy of the QR code provided by the service or product to be able to register it again with your spare key. Ideally, register both keys at once. Make sure to secure this QR code properly, as it could be used to register it with any other authenticator.

If you have already registered an account

If you have already registered an account and have not kept the QR code for your spare key, you can deregister your main key from this account and start the process over to add an authenticator app to this account. This time, use the QR code provided to register both keys at once, or securely keep a copy of the QR code to add it later.

Once you have registered a new OATH-TOTP code on your main key, you will not need to provide another time-based one-time password to this account when registering your spare key. You will only need to configure your spare key's OATH-TOTP code in the Yubico Authenticator application.

If you successfully completed the setup for both your main and spare keys, the OATH-TOTP code generated should be the same on both keys. You will be able to see all the OATH-TOTP codes registered on your keys from the Yubico Authenticator. For this, click on the "Accounts" button on the left-side menu.

To keep your accounts secure, delete the copy of the QR code you have kept once you have completed the registration setup for a new OATH-TOTP account on both your main and spare key (unless you need to keep a backup for other purposes).

Additionally, always make sure to note and secure well any account recovery information provided when adding a second factor of authentication. This is important to avoid getting locked out permanently of services or products.

10.2. Register and copy Passkeys

To copy your Passkeys to your spare key, simply repeat the same setup process that was used to register the Passkey to your main YubiKey. To see a list of all the Passkeys stored on your key, in the Yubico Authenticator click on the "Passkeys" button on the left-side menu.

From the "Passkeys" section, you can also click on the "Set PIN" button the on right to set up a password protection for your Passkeys.

10.3. Optional: Delete YubiKey's slot(s) to install other application(s)

If you are not using the Yubico OTP and/or Challenge-response applications installed and copied in the previous steps, you might want to delete one or both slots to install either the Static password or the OATH-HOTP application instead. YubiKeys only have 2 slots, so you cannot use them all at once.

To delete a slot, click on the "Slots" button on the left-side menu, then select the slot you wish to delete. On the right-side menu, scroll down the "Setup" menu and click on "Delete credential".

You will be prompted with a warning message, then select "Delete". Be careful however, once deleted, there will be no way to restore the credentials you had stored there unless you have noted it elsewhere.

10.4. Optional: Setup and copy Static passwords

To set up the Static password application on your key, you must first allocate a slot to it. Click on the "Slots" button on the left-side menu, select the slot you wish to use, then click on "Static password" in the right-side menu.

A section will pop up with a text field, click on the "Generate random" circle-arrow button on the right to generate a Password. You can click on "Append" to deselect the carriage return if you prefer it removed from the end of your Password. This means you will have to press Enter manually to confirm each entry.

By default, the "Keyboard MODHEX" will be selected, but you can select a different "keyboard" if you prefer. This will change the type of characters used in your random Password.

Before confirming, copy this Password in a secure local text file temporarily. Then click "Save". Back to the "Slots" section, click on your spare key in the upper-left key menu. Then click on the same slot you have used with you main key and select again "Static password" on the right. When prompted with the text field again, paste the Password you have copied (make sure to select the same "keyboard" type). Then, click on "Save".

If you forgot to note your Static password

You can trigger your Static password from your main key by opening a secure local text file and touch the gold part of your YubiKey. If you have configured your Static password in the "Short touch" slot, only touch the key for a second. If you have configured it in the "Long touch" slot, touch your key for about 3 seconds until a string is generated (make sure not to trigger a different application). You can then copy this Static password string to your spare key.

10.5. Optional: Setup and copy OATH HMAC-based One-Time Password (OATH-HOTP) codes

To set up OATH-HOTP 6 or 8 digits counter-based codes on your YubiKeys, you must first allocate a slot to it. Click on the "Slots" button on the left-side menu, select the slot you wish to use, then click on "OATH-HOTP" in the right-side menu.

An "OATH-HOTP" section will pop up with a "Secret key" text field. Enter a unique and secure Secret key of your choice.

Make sure the Secret key you choose has:

A maximum of 32 characters
An even number of characters (ex: not 31, but 32 will work)
Only uses characters comprised within: letters from a to z, numbers from 2 to 7

If you are asked for an Access code

If you type a Secret key that is longer than 32 characters, you might encounter a bug where an "Access code" window will pop up, even if your key doesn't have any access code set up. If this happens, verify that your Secret key has 32 or fewer characters, and an even number of characters.

Keep a secure copy of this Secret key in a local text file. You will need it to register with the validation server for each account, and for your spare key.

You can click on "Append" to deselect it if you prefer the carriage return not be included at the end of your Secret key. This means you will have to press Enter manually to confirm each entry. Select either "6 digits" or "8 digits" for your OATH-HOTP codes, then click "Save".

To configure your spare key for the OATH-HOTP counter-based codes, you will need to repeat this step with your spare key and use the same OATH-HOTP Secret key and OTP length as your main key's configuration.

Step 11: Generate and copy an OpenPGP key and subkeys to your YubiKeys

Default PINs

If you have reset the OpenPGP application on Step 6.3, you will need both default PINs to set up new ones. After a factory reset of the OpenPGP application, the default PIN is "123456", and the default Admin PIN is "12345678".

11.1. Secure your YubiKeys' OpenPGP application with a new PIN and Admin PIN

To secure this application after a reset, you should first set up new unique PINs for it. To do so, you will need to use the ykman CLI program you have installed on Step 6.1 from a terminal application.

First, navigate to the application directory as described on Step 6.2.

To change the first default PIN, type the following command in the terminal:

ykman openpgp access change-pin

When prompted, enter the default PIN: 123456.

Then, enter a new unique 6-127 digits PIN, and confirm this new PIN.

Your terminal should confirm with the message "User PIN has been changed." Note this new PIN somewhere secure where you will find it back easily, you will need it for the next steps.

To change the default Admin PIN, type the following command in the terminal:

ykman openpgp access change-admin-pin

When prompted, enter the default PIN: 12345678.

Then, enter a new unique 8-127 digits PIN, and confirm this new Admin PIN.

Your terminal should confirm with the message "Admin PIN has been changed." Note this new Admin PIN somewhere secure where you will find it back easily, you will need it for the next steps.

Secure your spare key as well!

Unplug your main YubiKey and plug in your spare YubiKey. Repeat these steps to secure your spare key as well.

11.2. Open or install the appropriate GPG application for your OS

Use the pre-installed software (Linux), or download and install a third-party software such as GPG Suite (macOS) or GPG4Win (Windows) to generate and manage an OpenPGP key.

Security recommendation

Yubico strongly recommends to generate OpenPGP keys on an offline system, such as a live Linux distribution.

11.3. Generate an OpenPGP key externally

Open a terminal application and type the following command:

gpg --expert --full-gen-key

When prompted to select the type of key you wish to generate, enter 1 for "RSA and RSA (default)".

When asked "What keysize do you want?", type 4096. Type 4096 as well for the subkey.

Follow the instructions to choose an expiration date for your OpenPGP key, and confirm with Y.

When prompted with "GnuPG needs to construct a user ID to identify your key", enter the name and email address you wish to use with this key. Finally, enter a comment you want associated with this key (optional), and confirm with O for Okay.

Once confirmed, a dialogue box should pop up from your GPG software. Create a passphrase to protect your OpenPGP key.

Go back to your terminal application, and type this command to find your OpenPGP key's ID:

gpg --list-keys --keyid-format=long

If you have multiple keys already stored on your computer, this command will list all of your keys.

Only look at the last "key block" listed, and note its key ID. Each "key block" starts with a pub line, followed by a uid line(s), with potentially one or more sub lines (for subkeys).

Your OpenPGP key ID will be a string of numbers and uppercase letters on the pub line, after the "rsa4096" key type, and separated by a / character as follows:

pub rsa4096/[key_id]

Note this [key_id] for the next steps.

11.4. Add subkeys

You do not need to have any of your YubiKeys plugged in yet for this step.

You might not need to add each subkey type

For this step, we will add one subkey for each of the 3 YubiKey OpenPGP application slots: Signature key, Encryption key, and Authentication key.

Depending on your usage, you might only need a specific type and not the others. Pick and choose what you need and ignore instructions for the others, if they're not relevant to you.

In a terminal application, type:

gpg --expert --edit-key [key_id]

This will start a gpg program prompt in your terminal. From there, type:

addkey

When prompted with "Please select what kind of key you want" type 8.

You will be asked to toggle on or off some subkey options. Here, we will generate all 3 subkeys at once, but adjust this step to your required usage. You might also need different encryption algorithms for different subkeys (see options available from the previous gpg program question).

To generate subkeys separately

To add a Signature subkey: Toggle E to disable encrypt.

To add an Encryption subkey: Toggle S to disable sign.

To add an Authentication subkey: Toggle S, then toggle E, then toggle A to keep only Authenticate enable.

To generate all 3 subkeys, type A to enable Authenticate as well (Sign and Encrypt will already be enabled). On the line above the options, you should now see "Current allowed actions: Sign Encrypt Authenticate".

The type Q to confirm your selection (Finished).

You will then be asked to choose a keysize, type 4096.

Select an expiration date again (it should be the same as the main OpenPGP key). Confirm with Y then Y again.

When prompted by your GPG software, enter your OpenPGP key's passphrase, then click "OK".

Once the gpg prompt is back in your terminal, exit the program by typing quit, then save the changes with Y.

For more options on subkeys

You might want to consult Yubico's documentation for more information on OpenPGP keys and subkeys.

11.5. Backup your OpenPGP Private Key and subkeys

Security warning

Be careful to store your PGP Private Key securely. This information is very sensitive and should never be shared or stored on an unencrypted volume. For better security, store it externally offline on a fully encrypted USB stick.

If it is reasonably secure to store your private key and subkeys locally on your current device, type the following lines in your terminal (replace [key_id] with your specific key's ID).

Change de default path

Unless you change the path, this command will create a backup of your private key located in the directory you currently are in your terminal.

If you wish to store your private key backup elsewhere, navigate to another directory or add a specific path before the backup_private_key.asc. For example: /Volumes/[secure_volume]/[secure_directory]/backup_private_key.asc

gpg --armor --output backup_private_key.asc --export-secret-key [key_id]

You will be prompted by your GPG software to enter your OpenPGP key's passphrase, enter it then click "OK".

To also keep a copy of your subkeys, type the following line:

gpg --armor --output backup_private_subkeys.asc --export-secret-subkeys [key_id]

You will be prompted by your GPG software again to enter your OpenPGP key's passphrase, enter it then click "OK".

11.6. Move your OpenPGP key and subkeys to your YubiKeys

Insert your YubiKey in your computer's port, then type:

gpg --edit-key [key_id]

This will show the details for the OpenPGP key (sec) you just created and its subkeys (ssb).

In the terminal gpg prompt, type the command:

keytocard

When prompted with "Really move the primary key? (y/N)" type Y.

If you encounter an error

If you encounter a problem at this step, you might want to exit the terminal gpg program with quit, unplug your YubiKey from your computer, plug it in again, then start Step 11.6 over.

Assuming you have created all 3 subkey types in the previous step, when prompted with "Your selection?", type 1 to move the Signature subkey to your YubiKey:

Terminal

gpg> keytocardReally move the primary key? (y/N) yPlease select where to store the key: (1) Signature key (3) Authentication keyYour selection? 1

Your GPG software will pop up and require you enter your OpenPGP key's passphrase. There will then be 2 more popups requiring you enter the OpenPGP application's Admin PIN you have just setup on Step 11.1. You will be asked for your Admin PIN twice.

Back to the terminal gpg prompt, type key 1 then keytocard again. This time select 2 to move the Encryption subkey to your YubiKey:

Terminal

gpg> key 1---- [key_information] ----gpg> keytocardPlease select where to store the key: (2) Encryption keyYour selection? 2

Again, enter your OpenPGP key's passphrase and your OpenPGP application's Admin PIN when prompted by your GPG software.

Back to the terminal gpg prompt, type key 1 then key 2 then keytocard again. This time select 3 to move the Authentication subkey to your YubiKey:

Terminal

gpg> key 1---- [key_information] ----gpg> key 2---- [key_information] ----gpg> keytocardPlease select where to store the key: (1) Signature key (2) Encryption key (3) Authentication keyYour selection? 3

Enter your OpenPGP key passphrase and your OpenPGP application's Admin PIN when prompted by your GPG software.

Finally, type quit, then Y to save the changes before exiting the gpg terminal program.

11.7. Verify that all your subkeys are stored properly to your YubiKey

From the terminal, type:

gpg --card-edit

This will display the information stored inside your YubiKey's OpenPGP application.

From the information displayed in the terminal, you can see your YubiKey's serial number, version, some attributes, your OpenPGP key information, and the 3 subkey slots.

If you have completed the steps above properly, above "General key info" you should see the lines "Signature key", "Encryption key", and "Authentication key" all have information stored in it. Otherwise, instead of a string of uppercase letters and numbers you will see "[none]".

If all 3 slots are filled as expected, type quit to leave this card program.

11.8. Copy your OpenPGP key and subkeys to your spare YubiKey

To make this operation work, you will have to delete your local key and subkeys and restore them from your backups.

First, unplug your main YubiKey. For the next step, you will need your OpenPGP key's and subkeys' grip strings. Type the following command in your terminal:

gpg --list-secret-keys --with-keygrip

If you have multiple keys listed, only look at the last block for OpenPGP key and subkeys you just created.

Note carefully the Keygrip string for each key and subkeys.

For your OpenPGP key, look at the lines starting with "sec>" on the left. The Keygrip string will be just above "Card serial no".

For the subkeys, look at each block starting with "ssb>" on the left. The Keygrip string will be on the second line for each. It should look something like this:

Terminal

sec> rsa4096 2025-03-04 [SC] [expires: 2025-03-06] ABC42ABC42ABC42ABC42ABC42[key_id] Keygrip = [key_grip] Card serial no. = 0000 [yubikey_serial_number]uid [ultimate] Name (Comment) <email@example.org>ssb> rsa4096 2025-03-04 [E] [expires: 2025-03-06] Keygrip = [subkey_grip]ssb> rsa4096 2025-03-04 [SEA] [expires: 2025-03-06] Keygrip = [subkey_grip]

Send a delete command for each key and subkeys:

Danger! Make sure to delete the right key!

If you have multiple keys stored on this computer, when noting the Keygrip make sure to note the correct one for the OpenPGP key you have just created and all its subkeys. You would not want to delete another important key you need.

For safety, it is recommended to keep a backup of your other keys as well before running the deletion commands below.

You will need to send a delete command to the GPG agent in order to be able to restore and copy your subkeys to your spare YubiKey. Type the following command and replace [key_grip] with the string you have noted above:

gpg-connect-agent "DELETE_KEY [key_grip]" /bye

Once you see the "OK", type the following command for your subkeys and replace [subkey_grip] with the strings you have noted above.

Repeat this command for each subkey with their respective Keygrip string.

gpg-connect-agent "DELETE_KEY [subkey_grip]" /bye

Restore your key and subkeys:

To restore your OpenPGP key and subkeys from your backup, type the following command (add the specific directory path you used, if any):

gpg --import backup_private_key.asc

Enter your OpenPGP key's passphrase when prompted by your GPG software. Then, for your subkeys type:

gpg --import backup_private_subkeys.asc

Enter your OpenPGP key's passphrase again if prompted by your GPG software.

Copy your OpenPGP key and subkeys to your spare YubiKey:

Plug in your spare YubiKey in your computer's port. Make sure your main YubiKey is unplugged.

Repeat all the operations from Step 11.6 for your spare YubiKey. Use the same OpenPGP [key_id] you have used with your main YubiKey.

Again, verify that all your YubiKey's OpenPGP application slots have been filled properly by repeating Step 11.7 with your spare YubiKey.

You can now quit this card program, unplug your spare YubiKey, plug in your main YubiKey again, and type gpg --card-edit again to verity that both your main and spare YubiKeys have the exact same "Signature key", "Encryption key", and "Authentication key" registered.

Following this procedure correctly, each of these subkey slots should be identical on your main and spare YubiKeys. The "General key info" should also be identical between your YubiKeys, but each "Serial number" should be different.

The gpg-card program

From this command, you can change other parameters for your YubiKey's OpenPGP application if needed. To see more options, you can consult Yubico's documentation.

Troubleshooting

If you need additional help to troubleshoot, reset, setup, or copy information to your spare YubiKey, you can contact Yubico's Customer Support service from this form.

Review your configuration

Once you have fully reset and reconfigured your 2 YubiKeys, make sure that you have:

Registered both keys with the YubiCloud validation server.
Tested each YubiKey application you will use on both keys before registering them with any service or product.
Configured properly all the protections and pins available to secure your keys.
Deleted the temporary files containing secrets that you no longer need for backup purposes.
Stored your spare key in a different secure location, once it's registered with your services and accounts.

Finally, do not forget to register your freshly re-programmed YubiKey(s) with the services and accounts you had to remove it from. Do not leave your accounts unprotected!

More information

This tutorial only covers a few features and usages possible with YubiKeys, consult Yubico Authenticator's complete documentation and guides for more information.

Unless credited otherwise, all screenshots from: Privacy Guides

Toward a Passwordless Future

fria — Sat, 08 Mar 2025 16:21:29 +0000

Toward a Passwordless Future

Illustration: Jordan / Privacy Guides | Photo: Gowtham AGM / Unsplash

Passwords are annoying, vulnerable to attack, and prone to human error. The multitude of issues with passwords has cost millions of dollars and forced terrible band-aid solutions in how we handle signing up for, logging in to, and securing online accounts. I'd like to break down some of these design paradigms that have entrenched themselves in our lives and how passkeys can lead to more secure and private online accounts.

How did we get here?

Ancient Rome

Passwords are a surprisingly old concept, dating all the way back to ancient Rome. The ancient Roman historian Polybius in his Histories describes how the Roman military would pass around a wooden tablet, or tessera, inscribed with a "watchword" that would allow them to identify each other as friendly.

Prohibition

During Prohibition in the 1920s US, speakeasies, or private, unlicensed bars selling illegal alcohol, would require a spoken password to gain entry. The name comes from how quietly you had to say the password, so law enforcement didn't overhear.

World War II

The US military later used countersigns, consisting of a challenge and a password to identify allies. On D-Day, they used the challenge "flash" and the password "thunder." Thunder was used specifically because it was difficult for Germans to pronounce, since the English "th" sound doesn't exist in German. This is an example of a shibboleth, or a way of distinguishing groups of people based on cultural differences.

1960's

It wasn't long after the dawn of the electronic computer that a solution for authentication was needed. Computers in the 1950s were expensive and slow, only able to handle one problem at a time.

MIT's Compatible Time Sharing System (CTSS), pioneered by Fernando Corbató, aimed to solve this problem by allowing multiple users to do work at the same time, but they needed a way to authenticate specific users. "Putting a password on for each individual user as a lock seemed like a very straightforward solution" Corbató told Wired in an interview.

These passwords weren't designed to be very secure. Fred Schneider, a computer science professor at Cornell University, said in the same Wired article "nobody wanted to devote many machine resources to this authentication stuff."

Fernando Corbató with the CTSS | Photo: Computer History Museum

First Password Breach

The first password breach occurred not long after in 1962, detailed in a pamphlet written to commemorate the CTSS.

Allan Scherr, a Ph.D. researcher at MIT, wanted more time for his detailed simulations. He knew that the passwords were stored in a plaintext file, so he requested it to be printed offline and that was that: he now had everyone's password and all the time he could ask for.

A later incident in 1966 saw all users' passwords being printed at login due to the administrator accidentally swapping the master password file and the message of the day.

Early Attempts at Securing Passwords

Clearly there was work to be done on securely storing passwords. A paper from 1979 by Robert Morris and Ken Thompson of Bell Laboratories outlines some requirements to bolster the security of passwords on a UNIX system.

Hashing

One of which is the need for passwords to not be stored in plaintext on the system, instead recommending storing a hash.

A hash is a one-way function: you give a certain input, and it spits out data that can't be easily reversed back to the input, even knowing the algorithm that was used. But, given the same input, you'll get the same output, allowing you to compare an inputted user password to a stored one.

In order to make it hard to brute force, the hashing algorithm should be fairly slow.

Password Requirements

They recommend certain requirements on the password entry program such as the classic 6-character minimum password length to prevent easily guessable passwords.

Salting

Password salting, a technique wherein a random string of characters is added to the end of the user's password before hashing, gets a mention as well. This prevents an attacker from simply pre-computing many password hashes ahead of time, and also prevents an attacker from knowing if the same password has been used on multiple systems just from comparing the hashes.

These guidelines would remain mostly unchanged for decades, save for improved hashing and salting algorithms.

Unforeseen Consequences

What was originally a system designed for a few people sharing a computer in an academic and research setting has somehow remained almost unchanged decades later.

Password Overload

Instead of remembering a single password for your computer, you now have potentially hundreds of passwords for various online accounts. A recent survey by NordPass estimates that the average person has around 168 personal accounts, with a nearly 70% increase in just the last three years since the survey was taken. This is an untenable number of passwords for a human to remember, so we don't.

Email Requirement

With the ever-present threat of users forgetting their passwords and therefore losing access to their account irrevocably, there needed to be a way to recover the account.

By the end of the dotcom bubble, email was fairly ubiquitous, so it made sense as a fallback way of authenticating. This had the added benefit of giving companies a way of contacting (read: spamming with ads) their customers.

While it's hard to say when it started happening, major websites like eBay were requiring email addresses on signup as far back as 1999. Amazon was doing it back in 2001. People I interviewed said that email-based signup was commonplace by the late 90s.

And so the precedent of requiring personal contact information to sign up for an account was born, at least partially due to the shortcomings of passwords.

Terrible Security

Single Point of Failure

On top of the extra personal data now required for each online account, email acts as a one-stop shop for attackers looking to hack your accounts, either by getting into your email account itself or by sending you convincing password reset emails that send you to a phishing page that looks exactly like the real page.

With the advent of AI, phishing attacks have only gotten cheaper and easier.

Laughably, we're told to "look for typos" or "just feel out the vibes man" in order to defend against these attacks. What hope did we ever have?

This intersects a bit with how I think email is a terrible, outdated protocol that needs to be replaced, but that's a blog post for another day.

What's followed as a consequence of the tech industry's refusal to adapt to the security landscape is an unprecedented cybercrime industry, stealing an estimated $44.2 million in 2021 through phishing scams. These are people whose only contribution to society is draining grandma's bank account, and they're absolutely raking it in.

Service Provider Negligence

But even if you do everything right and never fall for a phishing email, you can still be compromised due to the negligence of any one of the hundreds of service providers you rely on. Passwords need to be stored on a server somewhere, and if a service provider doesn't hash and salt them properly, a data breach will leave your account vulnerable.

Even if the service provider does everything right in terms of storing the password (which you have absolutely no way of verifying), in the event of a data breach the attackers will still have a hash of your password to attack.

There's typically also a period between the server receiving your password from the encrypted HTTPS tunnel and storing it securely as a hash where it handles your password in plaintext in order to compare it with what it has on file. Any vulnerabilities in the hardware could be catastrophic.

If you think this sounds like minor nitpicking, consider that in 2019, Facebook realized it had accidentally been storing hundreds of millions of user passwords in plaintext.

Human Error

Even ignoring all of that, passwords rely on randomness to be secure, but they also rely on humans to generate them.

Humans are very bad at generating random numbers. We're so bad at it that it's possible to uniquely identify you based on your pattern of "random" numbers.

That doesn't even matter though, since passwords, by requiring the user to type them whenever they want to log in and requiring the user to remember them, encourage minimum randomness and minimum length.

Most of us, even IT experts, reuse passwords because we are so heavily incentivized to do so by how they fundamentally work.

The strategy historically has been to shame people for using bad passwords whenever their account gets hacked, which has prevented us from seeing the fundamental issues with the way we authenticate and instead making it every individual's responsibility to somehow fight the incentives of the system they rely on.

Imagine if every time you connected to a website with HTTPS, you had to come up with your own encryption key. Would that be a secure system?

Band-aid Solutions

A common theme with passwords, and frankly many other things in the tech world, is stapling band-aid solutions on top of them to try and make them fit a modern use case they were never meant to serve.

Password Managers

Password managers solve the issue of forgetting your passwords by acting as a secure repository for of all your passwords. You can even conveniently have them autofill your information for you on the login screen. They can generate strong passwords for you as well.

Single Point of Failure

Essentially, password managers try to eliminate the human error element of passwords. But in doing so, they introduce more attack surface: you now have a repository of all your login credentials conveniently located on your device, so if your device is compromised, all your accounts are also compromised.

So a user with a password manager has to worry about passwords being guessed, potential compromise of their email, or compromise of their password manager.

Security isn't Enforced

Not to mention that many of the protections of a password manager are optional. A user isn't required to generate secure passwords, many will just continue using the same passwords they always have.

Poor Phishing Protection

Although some argue autofill protects against phishing attacks, really it doesn't since as soon as it doesn't autofill, a user will simply copy and paste their password into the field. A proper anti-phishing mitigation would make it nearly impossible to authenticate with the wrong website. Autofill can introduce its own set of vulnerabilities as well.

Salting and Hashing

Salting and hashing themselves I would consider band-aid solutions, as they were stapled on top of the existing system as security concerns grew. They rely a lot on the service providers implementing them properly and even still there are gaps in security as I previously mentioned.

Two-Factor Authentication

Because of the risk of compromise with passwords, most websites implement some form of two-factor authentication.

Email 2FA

By far the most common is email 2FA, which on top of all the problems with using email as an authentication method stated before, usually only happens the first time you log in to a website on each device (until you clear your cookies that is).

SMS 2FA

SMS 2FA is also common. This method is vulnerable to SIM swap attacks in which an attacker tricks your carrier into swapping your phone number onto a new SIM card under their control. SMS is also completely unencrypted, lacking even transport encryption.

The SS7 system underlying SMS is inherently vulnerable to interception. The idea of using SMS as a security tool is, frankly, laughable.

OTP

That brings us to OTP or One Time Password. This 2FA method relies on two things: a shared secret between you and the website called a "seed", and a "moving factor".

The moving factor changes, allowing you both to generate a temporary password based on the seed that you need to type in on login.

There are two main approaches to OTP.

HOTP

Hash-based Message Authentication Code OTP, or HOTP, increments the moving factor each time you successfully log in.

TOTP

In Time-based OTP or TOTP, the moving factor is time. The generated passwords will be valid for only about 30 to 60 seconds. The amount of time they're valid for is called a time step.

Of the two, TOTP is newer and considered more secure since the passwords are constantly expiring.

Issues

While a massive step up from SMS 2FA in terms of both privacy and security, they're still lacking in phishing resistance.

If you are sent to a fake login screen and put in your HOTP or TOTP password, the attacker can simply put that in to the real login screen. At least with TOTP there's a somewhat limited timeframe they can do it in, but these days phishing operations are fully automated, so it really doesn't matter.

Also since both you and the website are storing the same seed, any breach of either your device or the servers will leave you compromised. You could store your secret on a separate device or on a separate app on your phone, but this leaves the risk of either not having your phone with you to log in to your accounts or losing your TOTP codes due to the file getting corrupted or a bad update. Overall, OTP is better than SMS 2FA but still leaves a lot to be desired.

Shoulder Surfing

Another oft-forgotten issue with passwords is that someone could just watch you type it in and hack your account that way. Most password fields replace the characters in your password with stars or dots to combat this, but they usually still give you the option to show your password in plaintext anyway. The screen isn't the only way you can leak your password either, someone filming or watching you type it in a keyboard or on your phone screen would have your password with little effort. A human doesn't even need to be present, AI models can now work out your password just by listening to you type it.

All of these are attempts, with varying success, at fixing the individual flaws with passwords rather than designing a solution from the ground up with security in mind. They add complexity, more steps in the process where either you or a service provider can screw something up.

Passkeys: The Password Replacement

Passkeys are FIDO credentials tied to a specific app or website that let you sign in with the same method you use to unlock your device, be that biometrics or a PIN.

As long as you can remember your phone password, you can log in to your accounts. This frees you up to set a secure password on your device, since that's the only password you'd need to remember.

You may have heard of passkeys from Apple or Google and assumed they're some proprietary feature, but they're based on FIDO standards and the word "passkey" is meant to be a common noun like "password," not tied to any platform or company.

No Personal Info

You also won't need to use a username or email when logging in with passkeys, although currently most implementations still require it. Passkeys can fully replace every aspect of logging in.

That means no email to send phishing attacks to or hack, and no SMS to be SIM swapped.

Phishing Resistance

Passkeys operate using public-key cryptography just like how HTTPS works, so your private key isn't stored on the service provider's server, completely eliminating data breach issues with passwords. They were designed from the ground up to be phishing resistant and secure.

Privacy

Since a unique key pair is generated for each account, you don't have to worry about being identified between accounts either. Hopefully soon you won't need to pay for that email aliasing service just to not be tracked across accounts.

Protection Against Losing Your Account

You can even generate multiple passkeys per account in case you lose one somehow. Essentially this replaces the need for a recovery method; you can just add as many as you need, and they'll be available on all your devices anyway so losing your phone won't lock you out of your account.

Anti-Shoulder Surfing

Passkeys fight shoulder surfing by allowing you to use biometrics on your device to sign in. Even in the event someone got your device password, they would still need the actual private key associated with your account, either through physical possession of your device or some other compromise of your password manager. Since the private key stays in your possession and is never sent anywhere unencrypted, the risk is minimal.

Fully Syncable

Passkeys can be synced across devices and in the cloud as well, so you don't have to worry about losing them. And they'll be E2EE. Many password managers support passkeys, including Apple's and Google's built-in ones, so you can likely start using them right now.

Try It Out

You can test out passkeys at webauthn.io. Even if your passkeys aren't synced to the device you're currently using, you can still login via a QR code, allowing your phone to act as a sort of wireless security key.

Barriers

The main barrier to passkey adoption currently is lack of support from websites and apps. They either don't support passkeys at all, or still force you to sign up with a password, email, etc. with no way to delete them. I encourage you to contact any website or apps that don't have passkey support and request it, with the ability to signup and login without ever setting a password.

The UK Government Forced Apple to Remove Advanced Data Protection: What Does This Mean for You?

Em — Fri, 28 Feb 2025 17:29:36 +0000

The UK Government Forced Apple to Remove Advanced Data Protection: What Does This Mean for You?

Illustration: Em / Privacy Guides | Photo: Edward Eyer / Pexels

On February 7th this year, Joseph Menn reported from the Washington Post that officials in the United Kingdom had contacted Apple to demand the company allows them to access data from any iCloud user worldwide. This included users who had activated Apple's Advanced Data Protection, effectively requesting Apple break its strong end-to-end encrypted feature.

Sources familiar with the matter told the BBC and the Washington Post that UK's Home Office served a technical capability notice to Apple under the UK Investigatory Powers Act. Details are scarce about exactly what happened between the UK government and Apple because neither Apple nor the Home Office have publicly commented on the notice.

However, last week apparently in response, Apple has completely removed the opt-in Advanced Data Protection feature from the UK. As of the 21st, Apple users located in the UK cannot activate Advanced Data Protection (end-to-end encryption) for their iCloud Drive, iCloud Backup, Photos, Notes, and more.

This is terrible news for anyone in the UK, and a frightening omen for everyone worldwide.

Why is end-to-end encryption so important?

End-to-end encryption is a crucial technology for digital privacy and security. When data is encrypted end-to-end, this means that only the sender(s)/owner(s) and intended recipient(s) (if any) can access it.

For example, if data stored on Apple's servers is end-to-end encrypted, this means that even Apple could not read this data. If a government wanted to scan all the end-to-end data stored by Apple, it would be impossible to do because even Apple does not possess the keys to decrypt (read) this data.

In the same line, if a criminal were to steal end-to-end encrypted data from Apple's servers, they would not be able to decrypt it either. End-to-end encryption is the best defense against unauthorized access, including data stolen by criminals or negligently leaked by organizations with poor security.

Any proposition to implement a "backdoor" to end-to-end encryption is tragically misinformed. While it might at first sound appealing and a fair way to grant access to supposedly benevolent entities only, this approach is incredibly naive and misguided.

Governments have repeatedly tried to propose these delusive policies, but it is simply impossible to add secret access to end-to-end encryption that would only be accessed by the intended groups no matter how good the intention. This is as absurd as poking a hole in a bowl and demanding only apple juice leak through it but not water or any other liquid. It's just impossible.

End-to-end encryption with a backdoor is simply not end-to-end anymore. As Signal Foundation's President Meredith Whittaker said so well: "Encryption is either broken for everyone, or it works for everyone. There is no way to create a safe backdoor."

The only way to keep the benefit of end-to-end encryption with all the protections it offers is to keep it thoroughly and strictly end-to-end, for everyone.

Why some governments want to break encryption?

Some governments have been pushing really hard to demand access to end-to-end encrypted data from tech companies. While the ground for this might seem reasonable at first, it fails to consider how the technology works. Encryption isn't magical, it is mathematical.

American cryptographer Bruce Schneier explains this clearly, "it’s a restriction enforced by mathematics—cryptography—and not policy."

No matter how good a reason a third-party might have to decrypt a single piece of end-to-end encrypted data, if there is a way to access it by an unauthorized entity, then it offers no protection at all against any other accesses, whether legal or criminal.

Besides the this-is-actually-mathematically-impossible argument, let's say we were to remove end-to-end encryption protections entirely for everyone everywhere (which a backdoor would effectively do). The other problem governments and law enforcement seem to fail to understand is that citizens' rights and safety should be the priority.

Removing the lock on everyone's entry door possibly could make it easier for law enforcement to catch some criminals, it's true. But this would also expose everyone to home invasion, theft, vandalism, physical harm, and worse.

The price of removing the locks on everyone's doors is too high. Similarly, the price of removing the locks on everyone's digital doors is also too high.

Moreover, these governments always seem to assume that they, all well-intended benevolent governments of course, are assuredly reasonable and will only use this access to monitor the worst of criminals. Even if that was undoubtedly true now, these supposedly benevolent governments fail to consider these conditions might not always stay true.

What is a benevolent government today might very well turn into an authoritarian nightmare tomorrow.

Once implemented into the system, the tools for mass surveillance can quickly turn against its own citizens and victimize its most vulnerable population. This threat is always only one change of government away.

Why did Apple remove this feature from the UK?

Apple first introduced Advanced Data Protection in 2022. At the time, there was already in a potential conflict with the UK's forthcoming Online Safety Bill, which despite strong opposition became law in 2023 and is now the Online Safety Act.

Although attacks on encryption coming from governments aren't new, policymakers in favor of mass surveillance have recently increased the pressure on tech organizations to implement and normalize systemic monitoring, even in democratic countries. This is an extremely dangerous threat to privacy rights and human rights around the world.

The giant Apple has long complied with law enforcement around the world and offers extensive documentation to facilitate legal processes. However, when law enforcement requests access to data protected by end-to-end encryption, Apple does not have access to this data, by definition.

The only way for Apple to provide law enforcement with access to end-to-end encrypted data would be to either lie to customers and secretly break the encryption, or remove the feature entirely. Apple chose the latter this week.

This is horrifying news for anyone located in the UK losing access to this great protection. Moreover, it sets a dangerous precedent for other controlling governments to follow suit.

It's difficult to fully judge the situation while the notice process is shrouded in secrecy, but Apple could have certainly put more pressure against it. If there is a big tech company who can afford to fight back in defense of privacy rights it's certainly Apple. Especially with all the privacy promises Apple gave to its users.

At the risk of quoting Bruce Schneier's excellent essay twice in this article: "The companies need to resist, and—more importantly—we need to demand they do."

Each time a large organization like Apple gives in to oppressive requests, it increases the chance of these requests multiplying.

Which Apple applications are affected?

At the moment, it's not possible for anyone located in the UK to activate Apple's opt-in Advanced Data Protection (ADP) feature anymore.

For UK users who have already activated ADP instructions should follow soon, but it's probably a good time to look for alternative options (see below).

With ADP enabled, Apple users can benefit from end-to-end encryption on many more Apple applications. These applications include: iCloud Backup (including device and message backups), iCloud Drive, Photos, Notes, Reminders, Safari Bookmarks, Siri Shortcuts, Voice Memos, Wallet Passes, Freeform, and potentially some third-party app data. If you cannot use ADP anymore, you will lose end-to-end encryption protections for these applications.

Some Apple services that aren't part of ADP will remain end-to-end encrypted in the UK (for now). Regardless, considering the political climate, it's likely a good idea to start moving to alternatives that are perhaps less likely to get compromised or removed in the near future.

Apple's applications that still benefit from end-to-end encryption to this day in the UK include: Passwords and Keychain, Health data, Journal data, Home data, iMessage (only if iCloud Backup is disabled!), Payment information, Apple Card transactions, Maps, QuickType Keyboard, Safari, Screen Time, Siri information, Wi-Fi passwords, Memoji.

What does this mean for people in the UK, and the rest of the world?

For people in the UK, this is of course bad news and a very disappointing development. If this regional ADP block is maintained, it is a huge drawback for any Apple user's privacy rights, and a loss of data security as well.

For people outside the UK, this is a loud warning alarm. The UK government isn't the only one that has repeatedly tried to undermine encryption and privacy rights. While this might sound obvious for some authoritarian regimes, it's sadly also true for other governments considered open and democratic.

This push for mass surveillance seems to have gained even more force in the past few years, as end-to-end encryption features make their way more frequently into the market.

For anyone who cares about human rights, privacy rights, and democracy worldwide, it is essential to push back hard against these legal proposal to undermine encryption.

Likewise, it's not too late for UK residents to also push back and make themselves heard by their government by loudly opposing new (and old) legislation undermining encryption.

Systemic surveillance should never be normalized. Human rights can be lost, but they can also be won back with strong opposition.

What to do about it?

But what about concrete actions? What can a concerned netizen of the world do right now?

Here are a few things that might help you protect your data better from now on, and find alternatives to the end-to-end encryption features you might have lost:

What to do if you are living in the UK

Support and follow the Open Rights Group's campaign to save encryption.
Support the petition organized by Open Rights Group to tell your representatives you care about Apple's end-to-end encryption.
Replace iCloud Drive with an end-to-end encrypted cloud service.
Backup your Apple device(s) locally only and encrypt your backups.
Stop syncing your photos with iCloud. Either use a recommended end-to-end encrypted cloud service to sync it, or only keep your photos locally.
Replace Apple Notes with another end-to-end encryption note application.
Replace Safari with a privacy-respecting browser.
If you can, disable Siri entirely.
Go through all your Apple devices' settings, and be mindful to disable each option that could send data to Apple's servers if you do not want this data to potentially be scanned by a government or other entities.
Look for more privacy-respectful alternatives to Apple's products by browsing our recommendations section.
Continue to fight for privacy rights and encryption rights every chance you get! The battle isn't over.

What to do if you are living in or outside the UK

Get information from and support organizations defending encryption rights like:

Global Encryption Coalition (you can even join the coalition!)
Amnesty Tech
Center for Democracy & Technology
EFF
Fight for the Future
Privacy Guides 💛

Use end-to-end encryption everywhere you can:

If you are an Apple user outside the UK, activate Advanced Data Protection on your devices.
Regardless of where you are and which device you use, use end-to-end encryption features everywhere you can.
If you cannot find a cloud service you trust, you can locally encrypt your data before uploading it to a cloud service of your choice.
Look for other privacy-respectful alternatives browsing our recommendations.
Fight for privacy rights and encryption rights every chance you get!

Bad-Faith Arguments in the Privacy Community

Jonah Aragon — Fri, 28 Feb 2025 14:59:16 +0000

Bad-Faith Arguments in the Privacy Community

The Privacy Guides community is one of the best privacy-related communities on the internet, and I think we have generally done a good job at promoting a positive and respectful environment where people can learn and grow.

Unfortunately, as a public forum we are not immune to the small minority of individuals who feel empowered to spread anger, hostility, and divisiveness by their anonymity and general lack of consequences on the internet.

From now on, we are going to be strict about requiring all posts in our communities to be made in good faith.

We will consider the following questions when reviewing posts:

Is the poster presenting their criticism as informed or factual, when it's actually a matter of personal opinion, or worse, misinformation or false?
Has the poster failed to provide reasoning for their criticism, and demonstrated an unwillingness to learn or discuss the topic?
Is the poster writing something as if it is true and informed, when they're actually just speculating?
Is the poster simply spreading negativity instead of actually trying to improve something?
Is the poster engaging in ad hominem attacks against us or our community?

If these answer to any of these questions is yes, the post will be removed and the poster will be asked to revise their statement. We will suspend posters who repeatedly engage in bad faith arguments.

For almost everyone here, you won't see any negative impacts of this new policy. It is simply designed to allow us to remove the small number of people who occasionally join to spread unproductive negativity in the privacy space, at the expense of legitimate projects making the world a better place. Hopefully you will notice improvements in discussion quality overall.

To give an example, there are two specific behaviors we want to discourage with this new policy.

The constant use of words like "shilling," "fanboys," etc. to describe people who have a difference in opinion to your own is not acceptable.
To "shill" something is to promote something you have an employer relationship or some other actual conflict of interest with. To accuse someone in our community of being a planted shill without any evidence, simply because they like something that you dislike, is both a serious accusation and a bad-faith argument.
Even the use of terms like these informally to describe people who like a certain product more than others is disrespectful, and sows uncertainty and distrust within our community, so it will no longer be tolerated.
A very small portion of GrapheneOS community members continually attempt to derail any conversations mentioning GrapheneOS with irrelevant details and confrontational attitudes.
This is not a reflection on the GrapheneOS project itself, but unfortunately this has become a repeated situation with certain community members of this specific project more than anyone else, so we have to call it out.
Making unfounded accusations against Privacy Guides community members of harassment towards GrapheneOS simply because they presented their criticism of the project is not a good faith argument. Similarly, presenting unverified statements from the GrapheneOS community as factual has led to misinformation being spread in the past. It is critical to always differentiate between opinions/beliefs and factual information.
Privacy Guides community spaces are not GrapheneOS discussion forums, and the drama from their community is not automatically on-topic in ours. Please do not make new topics in our forum that simply link to drama posts from the GrapheneOS community. A good rule of thumb is that unless a post from GrapheneOS is specifically talking about GrapheneOS-specific, privacy-related functionality and not about other projects/software/etc., it is probably off-topic here.

Biometrics Explained

fria — Fri, 28 Feb 2025 14:59:16 +0000

Biometrics Explained

Illustration: Jonah Aragon / Privacy Guides | Photo: Jair Lázaro / Unsplash

Biometrics are a convenient and secure way to authenticate our devices. Many of us use and trust the biometrics of our devices without much thought, but are they really secure? With so many options, which ones are the best?

Fingerprint sensors

One of the most recognizable types of biometric authentication has to be the fingerprint reader. The idea is that everyone has a fairly unique fingerprint, so we should be able to distinguish between your fingerprint and someone else's reliably.

There are three main types of fingerprint: loops, whorls, and arches. Fingerprint sensors categorize your finger into these groups before using other details to uniquely identify your fingerprint. You might think that you could count the number of arches/whorls/loops, but there can be many people with the same configuration and number of these. Also fingerprint sensors won't be able to see your entire fingerprint most of the time, they are designed to work at weird angles and with a partial scan, so it's not viable to use the whole fingerprint for authentication.

Image Credit: University of Houston

Finger minutiae data is used to identify a fingerprint as unique. This data consists of the points on your fingerprint where lines split, abruptly end, individual dots, etc. Two people can have the same number of arches, loops, and whorls, but they won't have the exact same configurations of minutiae. (1)

It's theorized that the reason humans have fingerprints in the first place is to enhance our sense of touch.

Image Credit: Rutgers University

Using these details for identification gives several advantages over trying to read the whole fingerprint. It allows the device to use less processing power, as well as providing some flexibility in case your finger is smudged or at a strange angle. The sensor doesn't even need to see your whole fingerprint. You might notice some fingerprint readers are very thin and might be located in a convenient place like a power button; finger minutiae is what allows them to still operate securely.

There are three main ways we accomplish this in consumer devices: optical sensors, capacitive sensors, and ultrasonic sensors.

Optical

An optical sensor works by taking a picture of your fingerprint and turning it into data. They are the cheapest and least secure option. Since optical sensors capture two-dimensional images, an attacker may gain access by simply taking a picture of your fingerprint.

Image Credit: clockit.io

Many devices implement one of these sensors under the display.

Optical sensors can struggle in the presence of bright sunlight, which is an issue on a mobile device that you take around with you and use wherever you are.

Capacitive

Capacitive sensors measure the electrical conductivity of your finger. These are much more secure than optical sensors since they can't be fooled with an image. They're also tough to fool with prosthetics as different materials will have different electrical properties.

Image Credit: Bayometric

Capacitive sensors won't work if the tissue is dead, since dead tissue loses all electrical charge. So morbid worries about someone using your dead body to unlock your phone can be assuaged.

Conveniently they also don't require a light source under them to work, although they will struggle in the presence of moisture.

Ultrasonic

Ultrasonic fingerprint sensors use sound to create a detailed 3D representation of your fingerprint using ultrasound waves (sound waves with a frequency greater than 20khz). It's a similar concept to what's used to map the ocean floor: sound is emitted from transducers and bounces off your skin. By measuring the time it takes for the sound to reach the microphones, your phone can create a detailed map of the ridges and valleys in your finger.

Image Credit: Yipeng Lu

This is the most expensive type of sensor, but it produces the most accurate readings with the highest reliability. It doesn't matter if your finger is a bit dirty or wet, it will still work unlike optical or capacitive sensors.

Ultrasonic sensors can't be fooled by 2D images.

One downside is that you lose the protection against dead tissue that capacitive sensors offer, but this is not relevant for most people.

Additional considerations

Fingerprint unlock will inherently be vulnerable to someone forcing you to put your finger on the sensor to unlock your device, so keep this in mind when threat modeling.

They also won't work with gloves and sometimes screen protectors can interfere, so make sure that the sensor is uncovered and making direct contact with your actual finger, or otherwise using an OEM-approved covering.

Fingerprint authentication will protect you against someone filming you surreptitiously while typing in your password or shoulder surfing. This is an especially relevant attack if your threat model includes thieves as a common attack is watching you type your passcode in and then stealing your phone.

Face unlock

Many devices come with the capability to unlock them using your face. The implementations of this technology can vary wildly between manufacturers since a secure implementation requires a lot of special hardware, so many OEMs choose to cheap out. All forms of face unlock are more likely to allow a twin or sibling into your device since their face is more similar to yours than a random person off the street, so keep that in mind in your threat model.

2D camera-based

Every phone already has a camera, so why not use it for face unlock?

If you're relying on a plain 2D image, then there's always the possibility that it could be fooled by a regular photo. Someone getting in to your phone because they have a picture of your face is a security nightmare scenario and the only thing stopping it is the whims of whatever algorithm was programmed into your phone.

This form of face unlock is also less likely to work in low-light conditions than infrared variants.

2D infrared-based

The next step up in security is an infrared sensor. This requires dedicated hardware to be built into the device, which eats up space and adds cost. But what you get in return is a form of face unlock that's more reliable in low-light conditions and more resistant to photographs.

3D mapping

The potential of this technology truly shines when 2D face unlock is combined with an infrared flood illuminator. These are able to shine thousands of invisible infrared dots on your face and record the distance of each one, creating a 3D map of your face. As you can probably imagine, this tech takes up quite a bit of space and adds yet more cost to the device, as well as likely being the main reason for the "notch" on iPhones. This drawback is well worth it though. According to Apple:

The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is less than 1 in 1,000,000 with a single enrolled appearance whether or not you're wearing a mask.

They put the odds for Touch ID around 1 in 50,000 for comparison.

3D face unlock is immune to 2D images and requires a 3D reconstruction of a face before it has a chance of being fooled.

Additional considerations

You'll likely want an implementation with some protection against another person pointing your phone at your face to unlock it. iOS allows you to enable a setting where you need to be looking at the phone before it will unlock (called "Require Attention for Face ID"), look for a similar feature when shopping for a device.

Some devices allow for unlocking with a facemask. This is less secure than without a facemask, so keep that in mind when enabling this setting.

Iris sensors

A spy movie classic but newcomer in the consumer electronics field, iris sensors offer authentication via the unique properties of your eyes. The Apple Vision Pro is the most notable example with its Optic ID.

It uses near-infrared light to reveal highly unique patterns independent of the pigmentation of your eyes. Apple estimates the likelihood of a random person being able to unlock your Optic ID at less than 1 in 1,000,000, similar to Face ID.

The extremely short distance this technology operates at makes it very difficult for someone to unlock your device without you noticing, and you can simply close your eyes to prevent someone from forcing you to unlock it.

Algorithm

Because biometric systems need to translate the physical properties of your body to data, they rely on an algorithm to determine if their reading matches closely enough.

Android has guidelines on how OEMs should implement biometrics and how they can test them for security. If you're performing your own security research, you should look here for guidance on testing methodology.

There is also independent research into the security of biometric systems. This combination of external and internal rigor helps ensure the security of these systems, although more well known brands like Apple and Google will receive more scrutiny than lesser-known ones.

Typing biometrics

Companies like TypingDNA claim to be able to identify users by how they type.

The stated use case is 2FA and continuous authentication for employee devices. Likely you'll only encounter this technology on work devices, especially since this type of biometrics will be affected by the type of keyboard you're using. It only really makes sense to authenticate on a specific device that you'll be using continuously and typing on a lot, such as a work laptop.

It could also be used on websites to uniquely identify you, so type in a text editor program then copy/paste into the browser window to avoid this specific type of fingerprinting.

Gait biometrics

Possibly the most insidious of the biometric systems in widespread use is gait recognition. Yes, you can be uniquely identified just by how you walk.

Camera

This technology can work using only 2D footage and doesn't even require close proximity or high resolution sensors like other forms of biometrics. Combined with the huge network of cameras deployed in most cities, you can potentially be identified and tracked around even with a fully covered face.

This type of biometric can work without your consent and when other identifiable features such as face and fingerprints are hidden. It's also very difficult to impersonate someone else's gait.

There are two approaches for extracting biometric data from video.

Model-based

This approach attempts to model the human body in order to track the different parts of it. A well-known example of this approach is the Microsoft Kinect, which only consists of a fairly low-resolution camera. It simplifies the human body into a stick figure, which you can see in footage of the Kinect in action. It then uses the distances and joint angles of the model for gait recognition.

Image Credit: Alireza Bilesan, Saeed Behzadipour, Teppei Tsujita, Shunsuke Komizunai, and Atsushi Konno

Model-free

Model-free approaches don't try to model the human body but instead use the whole motion of human silhouettes. This gives a few advantages: it works regardless of camera quality, and it takes significantly fewer resources.

Image Credit: Yousef, R.N., Khalil, A.T., Samra, A.S. et al.

Accelerometer

Accelerometers such as those found in your smartphone can also be used for gait recognition. These need to be worn on a person's body, so they can't be used from long distance like camera-based approaches.

Accelerometers work by measuring the accelerations in 3D space in X, Y, and Z coordinates. They tend to also utilize gyroscopes, which measure the orientation of a device.

Floor sensor

It's possible to identify individuals using sensors in the floor that measure the pressure of your steps as you take them. There are already companies offering software/hardware installations for tracking customers within a store using this technology.

Scanalytics floor sensors capture up to 100% of foot traffic through your buildings and spaces. Capturing individual footsteps and the paths they form, we are able to monitor and analyze complete space movements and usage.

Floor sensors are especially concerning since they're completely invisible to you.

Radar

Radar works by transmitting a signal and measuring how long it takes for that signal to return, allowing you to measure how far an object is from you. In addition, if an object is moving relative to the sensor, the reflected waves will be a different frequency than when they were transmitted due to the Doppler effect. This can be used to determine the speed of an object and whether it's moving toward or away from you.

Using a continuous wave (CW) radar that's constantly emitting a signal, it's possible to measure the movements of all the different parts of your body during your gait to identify you uniquely. This is called a micro-Doppler signature. These sensors can even be sensitive enough that they can pick up breathing and heartbeats of humans trapped in rubble during rescue operations.

GaitMetrics is a company claiming to offer mmWave gait recognition technology.

It is also possible to identify the intruder’s unique radio gait IDs and capture them in a database. Any intruder with an unknown radio gait ID detected within the premises will trigger an alarm, and the intruder’s location will be tracked down.

They claim it can uniquely identify individuals as well as penetrate walls, a worrying combination.

What makes biometrics private?

Local Storage

As with most things, keeping everything on your device is the key to private biometrics. A secure and private biometric authentication system should store any biometric data fully on-device and further, shouldn't make it accessible at all, even to the user. Biometric data is so incredibly sensitive and uniquely identifying that it needs to be treated with the utmost care. For example, apps on your phone don't have direct access to your fingerprint or face data, they must use an API to use biometric authentication.

On the other end of the spectrum we have companies like IDEMIA which boast about their Augmented Vision, designed to take video data from the myriad surveillance cameras littering every US city and track you around everywhere you go. It combines facial recognition, object recognition, plate reading, and much more to create an Orwellian surveillance apparatus that stores all your data in some server somewhere, fully accessible to their customers (or any hackers that want a treasure trove of surveillance data). They also have a product called Mobile Biometric Check that allows cops to use their phone camera to take a picture of your fingerprints and compare them to a database. This is the exact opposite of responsible biometrics.

Secure Element

All forms of biometric authentication rely on proper hardware such as a secure element in order to be secure. The secure element provides a secure and tamper-resistant place to store your biometric data separate from the rest of the system, so it can't be easily extracted. Examples include Apple's Secure Enclave and Google's Titan M series of chips. You should avoid devices that lack a secure element; they won't be able to properly implement secure biometrics without one.

Final thoughts

Like all technology, biometrics aren't inherently good or bad. They're used to secure our devices and make authentication smooth and easy, but they're also used for mass surveillance. Especially now with the rise of AI, we've started to leave the realm of scientifically rigorous usages and into the realm of digital snake oil, with companies like Cursor Insight launching their MotionScore product.

Our patent-pending AI technology identifies hidden patterns in signatures and online or mobile user interactions. These patterns can reflect behaviors and personal characteristics relevant to creditworthiness and reliability.

It should go without saying that making decisions about whom to give a loan to based on... how they sign their name or some other mystery movement data is ludicrous, laughable if it wasn't affecting real people's lives. Now more than ever we need to be educated about the biometric technology that we use and that's used against us. The EFF is a great resource that documents and fights against abuses of biometric technology.

Many of the same technologies used for mass surveillance are also used for helpful purposes. It's up to us to ensure responsible use of technology going forward.

Choosing the Right Messenger

Dan Arel — Fri, 28 Feb 2025 14:59:16 +0000

Choosing the Right Messenger

Illustration: Jonah Aragon / Privacy Guides | Photo: Unsplash

One of the most common questions users have when it comes to privacy is about messaging services. It seems almost all of them mention some level of privacy or encryption to entice the user to sign up for their service, but how can you be sure you’re using the most secure, privacy respecting platform?

The answer actually lies in one’s threat model, which is often an ignored step in choosing all privacy related apps and services, meaning a lot of users limit their internet and communication experience because they believe they need Edward Snowden level privacy settings.

The truth is, each user needs to decide what their privacy goals are. Is your goal to stop corporations from tracking you, targeting you, and profiting from your data? Or, are you are trying to hide communications from the government or law enforcement, which is common for journalists and activists who want to protect their sources or communications from government eyes?

Once you understand your goals you can start to look at messengers and their upsides and downsides, and it’s important to remember, there is no perfect solution. Each service, no matter how secure can be compromised, because at the end of the day, you’re dealing with other humans who can screenshot, copy, or forward your messages to parties you did not intend to see them. So, it’s also important to know who you are messaging, verifying their keys, and ensuring that you place the utmost trust in them with the content you are sending.

If your goal is to simply avoid corporate tracking and the harvesting of your data from your communications, you can eliminate apps such as Facebook Messenger and WhatsApp, both services owned by Facebook and while offering encrypted messaging (optional in Messenger), Facebook reads your non-encrypted messages, and WhatsApp has fallen victim to security breaches.

For this type of user, your options are much more wide as you may be more willing to share your email address or phone number at signup and can be less concerned with metadata (we will get to that shortly), and you want to look for a messenger that simply isn’t scanning your content or behavior to sell it.

If your goal is to evade more massive state-sponsored surveillance programs, the aforementioned apps are out of the question, but so are many others.

This is because when it comes to these apps, and other like it, you don’t own the encryption keys, the service does, so they are able to decrypt your messages, for their own use, or for the use of government officials who request it. This is something important you’ll want to remember as you choose the messenger that is right for you.

Even Apple’s iMessage, which is encrypted, while more secure than Facebook’s offerings, still control the keys and can access your messages if necessary. Apple does also collect data based on your behavior, so while using iMessage isn’t the same as handing your data over to Facebook, you’re still messaging with a variety of privacy vulnerabilities. On Android, you’re using SMS messages which are even less secure and can be easily hijacked by someone with just enough know-how.

Metadata

One important aspect of messaging apps you need to be sure of is what kind of metadata it exposes, what is encrypted and what isn’t.

Wire, a popular encrypted messenger app has always been criticized for its decision not to encrypt user metadata, such as the date and time of registration, IP geographical coordinates, and the date and time of creation, creator, name, and list of participants in a conversation.

Metadata can be used to place you in a certain location, speaking to a certain person and can be used against you by law enforcement, even if they have no idea and no access to what the conversation was about.

Apps such as Signal, or Wickr encrypt metadata, making the conversations between two or more parties more secure and harder to track individual users with.

When it comes to avoiding corporate data mining, your metadata won’t be as useful, especially if you’re using a service that is not profiting from your data to begin with. For those avoiding state-sponsored surveillance, metadata can be a killer.

Encryption

This article will not get into the complexities of the best kinds of end-to-end encryption (E2EE), but ensuring your messenger has it, that must be discussed.

The popular messaging app Telegram has come under fire the most for this. Telegram says on their homepage that, “Telegram messages are heavily encrypted and can self-destruct.” Yet, this statement is only partially true. Yes, you can set your messages to self-destruct, a great privacy feature for some, and yes, they do offer encryption, but what they don’t tell users is that encryption isn’t turned on by default.

In an interview with Gizmodo, Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union said that, "There are many Telegram users who think they are communicating in an [end-to-end] encrypted way, when they’re not because they don’t realize that they have to turn on an additional setting," he continued to say that while he’s happy they offer the encryption, it’s not useful if it’s turned off.

Apps such as Signal, Keybase, and Wickr offer E2EE by default. Less popular but quickly growing apps such as Element, offer E2EE but like Telegram, have not made it a default setting, though the Matrix.org team has said that default encryption is on their road map.

Ensuring your conversations and metadata are E2EE is one of the best practices you can have when choosing a messenger.

Registration Process

When it comes to your goals and threat model, you will need to decide how much, if any, information you’re willing to give this company on signup. Do they require a phone number and or SIM card? Do they require an email address, or do they allow completely anonymous signups, and how anonymous is anonymous? Are they storing that info (remember the metadata) unencrypted?

Giving up your phone number or email won’t be a big deal for many, as any good privacy policy will state they won’t use it for any purpose other than those you’ve granted permission for. Yet, for those avoiding state-sponsored surveillance, you may have a regularly changing number, no number, or would rather not risk giving that information up. The same goes for email.

So, you will want to find a service that fits this need. While Signal is currently testing signup without a phone number, currently you’re unable to do so. Element, Wickr, many XMPP services, don’t require anything but choosing a username.

Source Code

Open source may be the most used phrase in all of privacy and security, and for good reason. It’s really helpful to be able to review the source code of the product you’re trusting. Experts can look for backdoors, leaks, and other bugs. Organizations that opt to open source their code are showing good faith effort to increase trust between them and the user.

Yet, open source can also limit your options, again, depending on your threat model and goals. Signal, Wire, and Keybase all offer open source repositories of their applications, and sometimes even the server software itself.

Open source also doesn’t mean secure. This is often misunderstood, and people hear open source and assume it must be good. Look at the apps code you want to use, you don’t need to be able to check it, but are others? An open source app that no one follows, or contributes to is no more or less secure than a closed source app.

Wickr, Threema, and others are closed source. They don’t offer the ability to check the source, but that doesn’t immediately rule them out either. When the Electronic Frontier Foundation (EFF) had a comparison chart for messenger apps, it gave Wickr 5-stars. This doesn’t mean it’s perfect for someone like Snowden, but for those avoiding Facebook and Google, it could be a usable option.

It’s also important to remember there’s no way to check that someone is always using the source code in their repository in the app or server you’re downloading from the Apple Store or Google Play. When it comes to this, reputation becomes a key player in your decision, as does trust, which we will get to next.

If you’re unsure what to do here, it’s always a safe bet to stick with open source that has a large contributor base and strong reputation. It’s always best to use open source options when they are available and only recommend closed source when there isn’t a usable open source option. This is generally a good way to pick a messenger app as well.

Ownership & Trust

An often overlooked, but increasingly important part of choosing a secure messenger is, who owns the company that’s providing your service? What would the gain or lose from selling your data, and who does the company answer to?

Wire recently lost a great deal of trust and standing in the privacy world because they quietly sold their company and moved it to the US. They also changed parts of their privacy policy, making it harder for users to tell when Wire would share customer data. They did all of this while never updating their current users of such changes, either to the change of the privacy policy, or the move to the US.

Wire also took in more than $8 million in venture capital funding. So now, users wanted to know more about who owned their data and what jurisdictional rights were changing with the move from Europe to the United States?

These are questions we must ask of all services. Wire now has investors to answer to who will want a return on their millions of dollars.

Signal on the other hand is a non-profit which does not rely on investors and instead relies on donations, sponsorships, and grants. Because of their non-profit status in the US, they must also be highly transparent about not only where the money comes from, but how they spend it. So, users can see where this money goes, and who it’s going to.

Matrix.org (the service Element uses) runs a similar business model as Signal, located in the UK instead of the US, they reply on donations, partnerships, and grants. Matrix.org is heavily supported by New Vector, a venture capital backed company, however, Matrix.org as a non-profit is transparent about its spending, income, and influences.

Not all services are non-profit, and that should not rule them out immediately. You can also follow their funding goals. Wire lost credibility because instead of simply relying on user signups, they wanted to be the next Skype for Business and wanted to build a larger enough user base to get the attention of investors. Meanwhile, apps such as Wickr, while for-profit, is transparent about taking limited investors to become sustainable on subscriptions.

This can take some time, because it’s important to know who the investors are, and what the organizational goals are. Will they eventually need to resort to data harvesting to sustain itself, if they do, and you decide to leave the platform, will you leave behind data you don’t want them to get their hands on?

Making Your Choice

Now it’s time to choose a messenger and no one can do that for you. Popularity will need to play a role here, there’s no point in joining the new up and coming messenger service if you don’t have a single contact using it as well. One reason Telegram has been so popular is they have managed to convince more than 100 million people to sign up. If you sign in today, you’ll likely see a group of your friends in there. Signal isn’t as far behind, and others are catching up.

You’ll need to decide who you trust, and who your other contacts trust, and then compare all of that with your goals and your threat model. How much information are you willing to give on signup, does metadata matter to your threat model, and is the service you’re choosing likely to sell itself to the highest bidder once enough people sign up?

The important thing to remember is there is no one size fits all for messengers, and that each user must decide what is best for them. If someone is an avid WhatsApp or Facebook Messenger user, even Telegram is a step in the right direction. Yet, if that user is concerned with more than just giving data over to Facebook, they may need to look at more secure options.

Ensure you keep your messenger apps up to date. You don’t want to discover you’ve been compromised because a bug found in version 1 was fixed in version 2, but you didn’t bother upgrading your apps.

One last piece of advice is that users need to be diligent and never become complacent in their decision. You must be willing to change services if the goals and values of your messenger of choice change in a way that no longer match yours. Look for news of sales, mergers, or acquisitions that could compromise the organization.

Dan Arel is a journalist, author, and privacy advocate. This article was originally published to Hacker Noon on November 27th, 2019.

How to Clear Your Browser History on Chrome, Firefox, and Other Browsers

Kevin Pham — Fri, 28 Feb 2025 14:59:16 +0000

How to Clear Your Browser History on Chrome, Firefox, and Other Browsers

Photo: Dimmis Vart / Unsplash

Your browsing data — such as cache, cookies, and browsing history — can accumulate over time, potentially damaging your privacy. Whether you trying to free up storage, limit tracking, or protect yourself from digital forensics, clearing browsing data is an important first step on your privacy journey. In this guide, we will explain how to clear your browsing data on five popular web browsers: Chrome, Firefox, Safari, Brave, and Edge.

Understanding Browsing Data

Cookies are small files that a website generates and sends to a browser. They associate browsing activity to a given user session, allowing people to visit websites without logging in repeatedly. Cookies also facilitate personalization, where websites "remember" your preferences and actions. Websites utilize personalization cookies to send targeted advertisements and track your location.

Website cache data refers to offline website data that your browser stores. By preloading content like webpages and images, subsequent visits to a website becomes faster. Unlike cookies, a cache does not expire and must be manually cleared. If you are concerned about digital forensics, consider clearing it.

Similarly, your browsing history must be deleted. As its name suggest, your web browser keeps a record of all visited websites offline. Your internet service provider could still view your history; however, you might want to prevent access from someone living with you.

Clearing Browsing Data on Google Chrome

To start, launch Google Chrome. On the upper right-hand corner, click on the three-dots icon to see a list of options. Then, click on Settings

You should see the following menu.

On the left, navigate to Privacy and Security. You should see the following screen.

Click Delete browsing data. Here, you can check whether to clear your browsing history, cookies, and cached images & files. Chrome also allows you select the time range of the data marked for deletion.

After making any necessary changes, click Delete data.

Clearing Browsing Data on Firefox

Start by launching Firefox. On the upper right-hand corner, click on the three-dot icon to see a list of options. There, click on Settings.

On the left, navigate to Privacy and Security. You should see the following screen.

Scroll down to Cookies and Site Data.

You have the option of either clearing your browsing data within a time range or in selected websites. Note that the latter deletes the website's cookies and cache, not history.

Click on Clear data if you prefer the former. Like Google Chrome, you can chose what types of data to delete and its time range. After making your selection, click Clear to finalize the process.

Clearing Browsing Data on Safari

Unlike Chrome and Firefox, Safari separates history settings from its privacy settings. For the purposes of this guide, we will delete browsing history first.

After opening Safari, move your cursor to the upper left-hand corner. Click History once the title bar appears.

If you want to clear browsing history in a specified time range, select Clear History at the bottom and follow the prompt. Otherwise, click Show All History.

In this menu, you can choose websites to delete from your history. Use the search bar to find the exact name of the website. You can also navigate to a specific data and time.

Now, lets delete the cookies and cache data. Move your cursor to the title bar again and click Safari to see a drop down menu.

Then, click Settings and then navigate to Privacy. You will see this screen.

Click Manage Website Data...

Another menu will appear with a list of websites and their corresponding browsing data types. As always, you can mark specified websites for deletion. Once you are done, click Remove.

Clearing Browsing Data on Brave Browser

As a Chromium-based browser, Brave is quite similar to Chrome. To start, launch Brave. On the upper right-hand corner, click on the three-bars icon to see a list of options. Then, click on Settings

You should see the following menu.

On the left, select Privacy and Security. You should see the following screen.

Click Delete browsing data. Here, you can check whether to clear your browsing history, cookies, and cached images & files.

Under Advanced, Brave also allows you select the time range of the data marked for deletion.

After making any necessary changes, click Delete data.

Clearing Browsing Data on Microsoft Edge

Finally, we will finish this tutorial with Microsoft Edge. Start by launching the browser. On the upper right-hand corner, click on the three-dots icon. Next, click Settings.

In the settings page, navigate to Privacy, Search, and Services

Under Delete Browsing Data, click on Choose What to Clear.

Modify the time range and data to be deleted. Afterwards, click Clear Now.

Privacy Guides

A Flaw With the Security Level Slider in Tor Browser

A Flaw With the Security Level Slider in Tor Browser

Demonstration

Safest Mode

Conclusion

In Praise of Tor: Why You Should Support and Use Tor

In Praise of Tor: Why You Should Support and Use Tor

What is Tor

The Tor Network

How does it work

How Tor works using a letter and envelopes analogy

What is a Tor Circuit

The Tor Browser

The Tor Project

What Tor can do

Improve Privacy

Circumvent censorship

Why Tor is so important

Tor is vital for human rights and democracy

Tor is for everyone to use

Who uses Tor?

Tor is critical public infrastructure

Things to consider when using Tor

Tor compared to VPN protections

Who knows you are using Tor

HTTPS for non-onion websites

Be careful with files when using Tor

Addressing misconceptions

The dark web, the deep web, and the surface web

Criminals use envelopes, doors, and clothing too

Tor receives government funding

Depending on where you are, using Tor is likely safe

Tor is fantastic for your privacy, but is not magical

Misconceptions are very detrimental to Tor, and other privacy tools

Tor needs our support

How to support Tor

Onion sites you can visit using the Tor Browser

Privacy Pass: The New Protocol for Private Authentication

Privacy Pass: The New Protocol for Private Authentication

History

Pseudorandom Identifiers

Card Computers

Cryptography

Blind Signatures

How it Works

Problems

Linkability

Data Collection

Blocking VPN and Tor Users

CAPTCHAs

Privacy Pass

Origin

Attester

CAPTCHA

Client State

Trusted Device

Issuer

Private State Tokens

Private Access Tokens

Kagi

No Account Requirement

Separation of Origin, Attester, Issuer

Remove Requirement for an Extension

Future Possibilities

Easier Adoption

Carriers

VPNs

Digital Cash

Digital ID

Signal Configuration and Hardening Guide

Signal Configuration and Hardening Guide

Signal Configuration

Signal PIN

Safety Numbers

Disappearing Messages

Disable Link Previews

Screen Security

Screen Lock

Notification Privacy