Why beginners should pay attention to their privacy

[aysg76]

Very important topic, it's quite concerning how personal data is harvested everywhere just to be sold later. Even sold to some shady scammers or criminals on the darknet. As long as it's profitable, this will be done and selling data will get more profitable in the future.

Still have doubts that it's not an issue when your data is leaked / sold to the darknet?
Ledger's hack of personal user data resulted in people getting threats to be robbed:

This issue has been prevalent over the dark web from long time and your personal information is being sold for different illegal activities and we are aware about these issues so that's why we need to remain anonymous and there are different ways in which security is compromised and this thread throws light on it.

Ledger hack is another example that like they have your personal data outsource to third party software but it's really risky as we have seen some Employee Id being compromised of Mailchip and your data is at risk.The scammers will have full access to your mails and then start the phising scam attempt with fraud emails and you will be giving them away your funds with entering your seed phrases.So there is risk in these ways also.

I really like Bitcoin's public, pseudonymous nature and the fact, that it's up to us to protect our privacy. But at the same time we should be aware that it's crucial to protect our privacy.
Like dangerous KYC. Once linking your coins to KYC data, these transactions are tied to your name. Even mixing them afterwards doesn't change that. All transactions are stored forever in the public blockchain.
Once a criminal knows about your (high) Bitcoin balance and your physical address, it can end very badly, when the data is sold to local criminals in your area.

Mostly these things occur when your are storing your coins on exchange and they ask for these KYC norms ending up your privacy and then also they will have eyes on you putting restrictions on your account to withdraw the funds.

Not just disregard, but active encouragement. In the US at least, government agencies are not allowed to enter your premises and search your belongings or your devices without a warrant, but there are absolutely no laws preventing them from buying your data from data brokers, blockchain analysis companies, or other third parties.

The NSA related movies are inspired from these things only and they want to keep track record of everyone with surveillance and you can see most of the exchange providing them these data of the users and whole work is done by them but you know the reality.Like the last news of Binance selling data to Russian agencies was in talks.

If you can, run your own email server. If you cant, use ProtonMail. Use PGP to encrypt everything.

Proton is really cool alternative but remember the password as recovering it is hard because it's not your normal email that can be reset with anyone.

[o_e_l_e_o]

The scammers will have full access to your mails and then start the phising scam attempt with fraud emails and you will be giving them away your funds with entering your seed phrases.

Different emails for different purposes. You should absolutely not be using the same email address you use for your utility bills to be signing up to bitcoin exchanges, and you should absolutely not be using either of those email addresses to register for scammy altcoin airdrops or similar. Whenever possible, use entirely disposable email addresses you can trash after they have served their single purpose. And of course, different passwords for each one.

Mostly these things occur when your are storing your coins on exchange and they ask for these KYC norms ending up your privacy

If you are storing your coins with a third party, then you already have zero privacy there.

Proton is really cool alternative but remember the password as recovering it is hard because it's not your normal email that can be reset with anyone.

ProtonMail now offer account recovery using 12-word seed phrases. Go to Settings -> Recovery, then scroll to the bottom and hit "Generate new recovery phrase".

[348Judah]

The most disturbing part is the apparent disregard by the so-called governing bodies.

Not just disregard, but active encouragement. In the US at least, government agencies are not allowed to enter your premises and search your belongings or your devices without a warrant, but there are absolutely no laws preventing them from buying your data from data brokers, blockchain analysis companies, or other third parties.

you're right, using a centralized exchange is thesame as giving the government or any third party the search warrant to invade ones privacy at any point in time just as that will be required by the security agencies in real live, so i see using CEX as an automated warrant one gives a third party unaware to have certain control over his financial digital assets

Like dangerous KYC. Once linking your coins to KYC data, these transactions are tied to your name. Even mixing them afterwards doesn't change that. All transactions are stored forever in the public blockchain.

Exactly this. You can pass your coins through ChipMixer so no one knows where they end up, but if those coins were bought from a KYCed account then anyone with access to that data will still know you bought x amount of BTC, even if they don't know where it is now. The only safe KYC is no KYC at all.

that's the best solution, no KYC at all, if it's not worth doing well then it's not worth doing at all, atimes i ask myself that why should someone even have to see through my transactions since they can't perform any alteration to it, it's of no need to them at all except for those under their KYC surveillance, i think i will go along with the preferable option to pass through chipmixer for more privacy.

[aysg76]

Different emails for different purposes. You should absolutely not be using the same email address you use for your utility bills to be signing up to bitcoin exchanges, and you should absolutely not be using either of those email addresses to register for scammy altcoin airdrops or similar. Whenever possible, use entirely disposable email addresses you can trash after they have served their single purpose. And of course, different passwords for each one.

Yes absolutely we should be using different mails for different purposes and it should not be like that you are using the same mail you have logged on your device on all places which is risk exposure.Creating new mails isn't hard so you should be having unique one's for the work you are doing and more security features enabled on the important ones.

Speaking of password then creating one yourself and then remembering it is hard for so many mails so pasword managers are good option in these case and can be utilised effectively to assist you and generating strong password.

If you are storing your coins with a third party, then you already have zero privacy there.

Sending them on exchange or trusting any third party software is already like giving them full access for your funds and control over your privacy also.

ProtonMail now offer account recovery using 12-word seed phrases. Go to Settings -> Recovery, then scroll to the bottom and hit "Generate new recovery phrase".

Was really not aware about this so thanks for letting me know about it and have found about the same that proton mails also generate random 12 words seed for recovery and we can also download recovery file but that should be stored on safe place so in case you need to change your password you will need that file to be uploaded.



That's nice feature addition to proton recovery methods but remember still you need to safely backup the recovery phrase and don't open recovery file.But you have option to increase your security with it.

[o_e_l_e_o]

that's the best solution, no KYC at all, if it's not worth doing well then it's not worth doing at all, atimes i ask myself that why should someone even have to see through my transactions since they can't perform any alteration to it, it's of no need to them at all except for those under their KYC surveillance, i think i will go along with the preferable option to pass through chipmixer for more privacy.

A small but important correction here: If you are using a centralized exchange in which you store your coins on their wallets, then regardless of whether or not you have completed KYC, they can "alter" your transactions prior to them being made. These centralized exchanges aren't just spying on your previous and future transactions, but also determining whether or not you are even allowed to make transactions in the first place, and who you are and are not allowed to send your coins to. All centralized exchanges do this. The difference is whether they can link all that activity to your real identity via KYC, or whether they just sell your data alongside your email address and let some data broker make the link instead.

Avoiding KYC is obviously smart, but avoiding centralized exchanges entirely is even better.

[Atropol25]

Loved this! I just posted a comment about one of John Oliver's shows! 

Thank you for the input, btw!

[mumang siat]

That's why it's important for us beginners to watch things like this, considering that privacy must really be guarded for security, giving identity doesn't always need to be done openly, although sometimes some people think it's not important.

The scammers will take advantage of this privacy to carry out activities that are not needed, Thank you very much for this short video that is quite useful, you deserve to be called a master for beginners?

[aysg76]

that's the best solution, no KYC at all, if it's not worth doing well then it's not worth doing at all, atimes i ask myself that why should someone even have to see through my transactions since they can't perform any alteration to it, it's of no need to them at all except for those under their KYC surveillance, i think i will go along with the preferable option to pass through chipmixer for more privacy.

Do you think they will leave you without doing KYC? Like you can make small transactions without going through these KYC norms and most of the exchanges have daily limit for it but don't believe them that they can't alter your transaction and restrict you from making transactions.The exchange have your database and possess the keys for your funds so do you think KYC matters in that case a lot?

A small but important correction here: If you are using a centralized exchange in which you store your coins on their wallets, then regardless of whether or not you have completed KYC, they can "alter" your transactions prior to them being made. These centralized exchanges aren't just spying on your previous and future transactions, but also determining whether or not you are even allowed to make transactions in the first place, and who you are and are not allowed to send your coins to. All centralized exchanges do this. The difference is whether they can link all that activity to your real identity via KYC, or whether they just sell your data alongside your email address and let some data broker make the link instead.

Avoiding KYC is obviously smart, but avoiding centralized exchanges entirely is even better.

The exchanges have all the restrictions they can put on you like banking services asking for all the documents to prove the ownership of your funds and then sell your data to government agencies and on dark web.

1) Coinbase having restrictions on Canada users above $1000 is well known to us that for transactions bigger then it you have to disclose the recipient details to them with full documentation so is this acceptable to users without KYC?

2) Coinbase disclosing in it's SEC filing that in case of insolvency user funds can be used to pay loans so what safety you expect from these exchanges?

At the moment you think of keeping your coins on these CEX your end up your privacy so make sure to avoid them if you can.

[jerry0]

so protonmail is the best then?

[PX-Z]

This is why i have no interest in any crypto services out there that usually ask kyc, i rarely use 1 exchange and that is kucoin which i never submitted any of my personal information yet for kyc.
From the very start i only made kyc to my local exchange where i convert crypto to fiat, so far no security and privacy related incident happened to them yet.

I don't know if it's a thing for other but I always use  private mode of firefox when accessing every website mobile or desktop.
So no history or cookies and everything will be saved on those browser and websites plus an ad blocker installed. I'm also a user who wont accept the cookies banner even it's annoying already as long as they will let me browse the website without accepting it.

[n0nce]

This is why i have no interest in any crypto services out there that usually ask kyc, i rarely use 1 exchange and that is kucoin which i never submitted any of my personal information yet for kyc.
From the very start i only made kyc to my local exchange where i convert crypto to fiat, so far no security and privacy related incident happened to them yet.

I don't know if it's a thing for other but I always use  private mode of firefox when accessing every website mobile or desktop.
So no history or cookies and everything will be saved on those browser and websites plus an ad blocker installed. I'm also a user who wont accept the cookies banner even it's annoying already as long as they will let me browse the website without accepting it.

For no-KYC BTC <> fiat exchanges, consider checking out Bisq.network.

Regarding browsers' private mode, it can help somewhat, but I believe it is more helpful to use containers, disable JavaScript as well as using a proper 'wide spectrum blocker' (https://github.com/gorhill/uBlock/wiki/Blocking-mode) instead of an 'Ad Blocker'.
https://pi-hole.net/ is also something worth checking out, especially if you have a little 24/7 machine running on your network anyway, e.g. for your full node. Just spin up a little VM with PiHole in it and DNS requests to lots of ad and tracker endpoints will be blocked. No matter if these requests come from a browser, a computer program or a smartphone application.

[Maus0728]

Proud to say that I am making some progress in terms of privacy.

A few days ago, I began by uninstalling all the programs I rarely use, tweaking or disabling all the unnecessary permissions of the installed apps, removing all the messages and call histories, and fabricating all of my personal data on the accounts I had created years ago before deleting them entirely.

Currently, I am in the process of swtiching the emails I used(gmail) for the services I registered for by moving to privacy-focused email providers and setting up email aliases that will allow me to hide and receive emails without disclosing the real one.It's a pain the ass though, since you'll have to do it individually. And if I may suggest, buying a custom domain from namecheap would be ideal incase the service(simplelogin) shuts down even though it's unlikely.

I am also planning to switch to custom roms, calyxOS for Android and Linux to my computer, sooner when I have all the time to educate myself with regards to this. After that, I would happily create my own node for bitcoin to actually preserve and maintain my privacy in the long run.

I know these are just small stuff and is considered to be basic for an average bitcoin joe, but hey it's fun doing it.

[aysg76]

Proud to say that I am making some progress in terms of privacy.

I know these are just small stuff and is considered to be basic for an average bitcoin joe, but hey it's fun doing it.

Average joe needs to be concerned about his privacy in this crypto space where small breach could end up draining your whole funds and it's really good that you are taking a step forward for your privacy in removing the whole private information we share with these online services providers which can be used against us so it's better to switch to some privacy focused services to be safe.

so protonmail is the best then?

It's quite a good option if you seek privacy and security while using the online services as you see most of them asks for mails so proton is best in that case rather then your regular mails and with seed phrase recovery option it's easy to change your password and recover it and save files on your computer but read them about carefully.

[un_rank]

-prune-

Thank you for sharing your privacy journey, it gave me more clarity after reading the first post about the dangers of exposing yourself on the internet. I would be following your steps to achieve a greater level of privacy.
Do you have a suggestion of what email service I can use that supports aliases? I am just learning about it now and plan to start using it.

Great read all through. The reference to "three lettered agencies" in the first post was very amusing and detailing too.
Thank you guys

- Jay -

[Maus0728]

Do you have a suggestion of what email service I can use that supports aliases?

I am using simplelogin[1] as my email forwarding/alias services. You can also use anonaddy as an alternative depending on your preferrence. But currently, I am paying for premium on simplelogin for about $30/year.

With premium, you can have unlimited alias, mailboxes, and custom domain if you bought a personalized one from namecheap or any other domain name services. Having unlimited alias means that you can create compartmentalized emails for every services you signed up while having a sense of control to see which companies sold your personal information to third parties because you have what they call a kill switch.

Other than masking your real email account which is more concerned about privacy, I think it serves as an additional layer of security for potential hackers. If they don't know about you, they can't attack you.

Of course, you can have as much email as you want for bitcoin related accounts (if premium).

[1] https://simplelogin.io/

[Laurendaldin]

A broker called Epsilon settled for $150 million after selling data to people they knew were scammers for over 10 years. Data has been sold to domestic abusers and stalkers, allowing them to track down old victims. The video mentions a case of a murder after the victim's data was purchased for less than $50.

OMG it's sounds terrifying. I'd never thought about data selling on this angle before. Well, thanks for information. Plus one more phobia 

[Maus0728]

I would only use Degoogled Chromium if you really need to use a Chromium based browser for a specific task.

Sorry for the dumb question, but how can I install this on my Android device?

I have checked the github page and I noticed that there is a link under the custom F-Droid repository but the problem is upon clicking the link, it shows "403 Forbidden". On a sidenote, I've never done any custom build/installing on any device in my life, so I assume that installing it isn't just as simple as clicking the install button.

I just want to use this degoogled chromium to maintain the search results similar to using chrome but with an improved privacy aside from using DDG for casual(common) searches.

[NotATether]

What many people don't know is that data brokers buy and sell every piece of data about you that they can, right down to your debts and your medical conditions, and they sell it to literally anyone who wants it. A broker called Epsilon settled for $150 million after selling data to people they knew were scammers for over 10 years. Data has been sold to domestic abusers and stalkers, allowing them to track down old victims. The video mentions a case of a murder after the victim's data was purchased for less than $50.

Damn. I never thought the data garage sale was that bad.

Some serious reforms have to be made in the IT industry, preferrably at the OS level. I mean, we don't want to keep talking about this forever without being able to do anything about it, right?

[o_e_l_e_o]

Sorry for the dumb question, but how can I install this on my Android device?

No idea I'm afraid - I've never used it on Android. I get the same 403 error on both Tor and Firefox trying those links though.

I would suggest using Tor or Firefox if you can to avoid all things Chromium altogether. Otherwise, Bromite is a Chromium based android browser which gets decent reviews, although I've never used it myself. If your main goal is to receive Google search results with improved privacy then you can use Startpage as your search engine via any web browser. It searches Google on your behalf and returns identical results but without the privacy invasion.

[aysg76]

Damn. I never thought the data garage sale was that bad.

Some serious reforms have to be made in the IT industry, preferrably at the OS level. I mean, we don't want to keep talking about this forever without being able to do anything about it, right?

With the scams rising the data breaches have also grown substantially and your data is being sold on dark web with any third party we are sharing it with to be used for next illicit activities.This is only one example of the case being disclosed and there might be many same scenarios like these worth millions dollars.

Don't know if we would see improvement in IT sector but we should focus on more privacy oriented ways to secure our personal information without being sharing them on any social site we see out there as they are themselves making money from these data dumps and we don't have idea about big this is it.

I would suggest using Tor or Firefox if you can to avoid all things Chromium altogether. Otherwise, Bromite is a Chromium based android browser which gets decent reviews, although I've never used it myself. If your main goal is to receive Google search results with improved privacy then you can use Startpage as your search engine via any web browser. It searches Google on your behalf and returns identical results but without the privacy invasion.

For me also Tor works exactly the best but if you are looking for some privacy focused browser then Brave is also the good choice as it would also protect you from the Google ads we see out there solving lot of problem and little fast then Tor and in case you want to have complete privacy you can switch to the Tor window in it only and it's best in Android devices also.