I have been engrossed with the Edward Snowden affair. As an Army ADAPSO (Automated Data Processing Security Officer) in the 80's and 90's I did a lot of "Computer / Network Security and Securing" Mr. Snowden's revelations do not surprise me. But the thing that really interested me were some of the thing he is using for security. First was the email he recently sent out announcing his press conference in Russia, it was from an Email carrier called Lavabit.
LAVABIT ( http://lavabit.com/... )
We all know from Mr. Snowden's releases that Gmail, Outlook, AOL, and Yahoo are all out of the question because these companies participate in the NSA's PRISM program, so obviously Mr. Snowden needed something off-the-grid, and obviously being a careful emailer wanted something with a lot of encryption. Lavabit fits the bill! Also Lavabit has the added bonus of using Secure Sockets Layer encryption to "ensure that information could be transported securely over an untrusted network" and also has something it calls asymmetric encryption that "provides a priceless level of security" by using "public key and private key encryption to make messages unreadable without knowing a user's plaintext password." In other words, it's impossible to know the content of your email without knowing your password as well.
Also, for those who don't like selling their information to marketers, Lavabit promises not to do that either, making all of its money off of its premium account subscription model, not off the sale of their users demographic! I am sold!
TOR ( https://www.torproject.org/... )
I also noticed in the pictures of the Press Conference, in the upper right corner of his Laptop there was a TOR sticker. This means he, at least, supports TOR —short for The Onion Route—and also probably uses it as his browser of choice.
From their website Tor's benefit is that it "establishes a system through which your requests to web servers travel through three other anonymous servers around the world first. It's like changing between three cabs on your way to your destination." That makes it very hard to track web traffic, which is also why it's the browser of choice for illicit drug sellers and buyers on the Silk Road, of which I am neither. Technically, the U.S. government can get around its clever scheme. But, Snowden's approval suggests it hasn't.
The TOR Website contains the following suggestions for proper use, and includes some changes in browsing habits.
Want Tor to really work?
You need to change some of your habits, as some things won't work exactly as you are used to. Don't enable or install browser plugins, use the HTTPS version of websites, and don't open documents downloaded through Tor while online. I highly suggest you read through the help files and learn all the restriction of Tor for proper use!
Be aware ALSO that Tor does not protect all of your computer's Internet traffic when you run it. Tor only protects your applications that are properly configured to send their Internet traffic through Tor. To protect all your internet traffic you need to use a VPN.
VPN - Virtual Private Networks ( http://en.wikipedia.org/... )
I have used VPNs for year, they were created to allow companies to include dial-in users the ability to appear as if they were part of the Corporate Network and able to use corporate network resources, like servers and printers. VPNs use 256-bit packet level encryption to encrypt data over the wire. VPNs hide the CONTENTS of your TCP/IP streams from prying eyes, including your ISP, making it a favorite of software and music pirates.
Once only affordable to large Corporation, VPNs have now migrated for use by the average man. I use a paid VPN service out of the Netherlands, but their are FREE Ad supported VPN available. The one I suggest to my friend is out of Sweden, (also with very favorable privacy laws), and is called PrivitizeVPN ( http://privitize.com/ ). The thing I like best is the setup is really easy and it has great instructions. (When you suggest software to friend, you have to be willing to support it, and answer questions, I have never had a question about PrivitizeVPN, it is that easy to use, and the documentation is THAT GOOD!)
Final Thoughts
Ultimately the best protection is a social approach: the more Tor/VPN users there are, and the more diverse their interests, the less dangerous (READ: important) it will be that you are one of them. Convince other people to use Tor and to VPN their Internet connections too!
11:46 AM PT: Use a combination of Tor Browser and another free browser to surf the web like Firefox. Try to use Tor for everything. Browsing the web may be a bit slower, but it's far more secure, and I have found few problems with it.
NOTE: that using Tor Browser to log into your PayPal account trips the website's fraud protection software, so use standard Firefox with Cocoon installed instead.
Users of Tor Browser should also be aware that logging into HTTP (instead of HTTPS) websites may result in your credentials being captured by a malicious exit node.