Security Quest

Along with some more DeGoogling, July was all about distancing myself from the other Big Tech company that has shaped my day-to-day life for years, Apple.

Apple has worked hard to cultivate an image of security, and I certainly trust it more than I trust Google. But Apple is a mega-corporation like any other—loyal to profit above anything else, including its own customers. For years, the company has been accused of inflicting pointless proprietary tech (like Lightning charging cables) and planned obsolescence on its user base. Its “walled garden” of products is designed to trap you, your messages, your photos, your fingerprints, the last known location of your loved ones, in the iCloud ecosystem. Apple promises this system is private and secure, but it gives itself access to your data by default (you can turn on Advanced Data Protection, but not for email, contact, or calendar info stored in iCloud). And even encrypted, when the sensitive data of millions of people falls under the control of one company, it becomes an easy target for government surveillance efforts. Besides, Apple has demonstrated that it is willing to bend over backwards to make the Trump administration, and particularly ICE, happy.

My first phone as a teenager was an iPhone, and I’ve been stuck in their walled garden ever since. I won’t be buying a new smartphone for a while, so here’s what I did to protect my data, while still using an Apple product on the daily.

• I tried the Firefox app for iPhone

  • about Firefox (web browser): free, open-source, owned and operated by the nonprofit Mozilla Foundation

    • it’s been my browser of choice for years—it’s intuitive and has a much better reputation for security than its mainstream competitors (if you use Google Chrome or Microsoft Edge, I'm begging you: switch ASAP.)

  • I wanted to try my new, more-secure computer setup on the cybernetic extension of my being that is my cell phone, BUT

    • once I had the Firefox app, I couldn’t download my new extensions (like Privacy Badger)

    • one DuckDuckGo search later, I found out that all iPhone browser apps are required to use Apple’s browser engine—I couldn’t use Firefox extensions because the app isn’t actually Firefox, just Safari in a fursuit

  • so with this experiment failed, I decided to change tactics

• I downloaded an adblock for Safari

  • about 1Blocker (adblock): has free tier, closed source, owned by a private company

  • once I downloaded it, the app took me to settings and added itself as a Safari extension that blocks ads, even on YouTube videos

  • why use an adblock?

    • some ads contain tracking agents

    • the digital advertising system is enabling government surveillance

    • malicious compliance: if I have no choice but to use Safari, I’ll make sure that my time on it is worthless to Big Tech’s paying advertisers

  • I also set my default search engine to DuckDuckGo in my phone’s settings under Safari

  • this setup is working great for me so far, but I might try the Brave Browser app, which I’ve heard works okay despite being forced to run on Apple’s WebKit

• I’m trying new maps

  • I tested out Organic Maps (navigation app): free, open-source, and based on a community data project

  • you have to download a map of the area you want to travel to beforehand, so while it saves you from getting lost if you lose your internet connection, it requires pre-planning and enough storage space

    • but, I was able to download a map of the entire LA metropolitan area that has an incredible level of detail

  • it seems promising, but I want to give it more time before I recommend it

• I took my photos out of the cloud

  • I transferred my photos out of the Apple Photo app to Ente Photos

  • about Ente Photos (photo storage app): has free tier, open-source, end-to-end encryption, run by a private company, developed by a former Google employee who was uncomfortable with how his old company treated user data

  • Ente is a godsend that gave me 10G of free storage, kept my photos organized in the albums I made in Apple Photos, deleted the saved photos off my phone, and finally gave me enough space to update my iPhone (which is a security 101 tip that I’ve been unable to follow)

  • I would marry it if it was a person, highly recommend

Last month, I tried to free my data from Big Tech’s clutches by deGoogling—switching away from Google products wherever possible. Why? Because Google’s business is surveillance. Most of the tech giant’s revenue (67%) comes from auctioning off ad space in Google searches, affiliated webpages, and in YouTube videos. Advertisers are willing to participate in a competitive bidding war because they’re competing for something much more valuable than a simple ad slot on a page—direct access to you. Google uses your data (searches, interactions, digital habits, email subscriptions, location data, and movements) to build a consumer profile. Advertisers can select the type of profiles they want to target and bid for the ad spaces that those specific individuals will see.

And once you’ve been profiled, there’s no guarantee that Google will keep your information to itself. The company has a history of retracting and breaking security promises. It has turned over users’ data to ICE without warning, it’s been charged with ignoring privacy settings, and it has provided its AI models to the government in apparent violation of its own pledge to not apply AI in “surveillance violating internationally accepted norms.”

So, I decided to start the process of moving my digital assets away from the Google Workspace, formally G Suite, mostly by following this Proton guide (note: competitor site, not a neutral source). Here’s everything I did in June:

• I stopped using Google to search the web, and started experimenting with replacements

  • I tried using Startpage

    • free, semi-open-source search engine, based in the Netherlands, shows Bing and Google search results without data profiling

    • I downloaded the Startpage extension for Firefox to set it as my default search engine and used it for a few days

    • what I liked:

      • it doesn’t have AI features, and it’s ad-free by default

      • not based in the US, has a bit of insulation from subpoenas from the US government

    • what I didn’t like:

      • glitchy News tab that generated the same results for multiple pages (page 2 of results was the same as page 1), or didn’t populate pages

      • minimalist in a way that made me feel I was missing something

  • I tried DuckDuckGo

    • free, semi-open-source, based in the US, shows Bing and Yahoo search results without data profiling plus results from its own crawler, has optional AI features

    • set as default search engine in Firefox

    • what I liked:

      • very accessible, similar feel to Google without the intrusive ads and “personalized” (manipulated) search results

      • AI isn’t shoved down your throat, and you can download a completely AI-free extension

    • what I didn’t like:

      • the Bing and Yahoo presence was very noticeable, especially in the News tab

      • US-based, vulnerable to government intervention

  • I kept DuckDuckGo as my default, but didn’t remove the Startpage extension

    • while I like the idea of using a non-US software, DuckDuckGo gave me more useful results

    • I’ll keep Startpage around in case I want to do any searching I’d rather keep off of US servers

    • I recommend DuckDuckGo for the casual internet user who is not especially techy and is not being actively targeted by an authoritarian regime. It’s easy to use and provides enough protection for normal activity

• I started looking for Gmail alternatives

  • I created a Proton email address

    • end-to-end encrypted, semi-open-source, operated by a private company with a majority nonprofit shareholder (the Proton Foundation)

    • the free tier:

      • gives you encrypted email and 1GB of storage

      • you can integrate one Gmail account

        • NOTE: while Proton can’t read your emails, messages going through Gmail servers are still available to Google

      • gives you access to their Google Calendar and Docs clones, also encrypted

    • accessible, easy to use and to switch over your Gmail account

  • I migrated a personal Gmail account to Proton and started poking around their other G-Suite clones

  • I like it so far, but I think the storage will be an issue for me and I’m not ready to commit to a paid tier yet

  • I’m going to try out some other email services before I make any email recommendations

This quest started in early May with my newsletter issue on digital security. As I was researching for the issue—hunting down organizations, guides, and tools that independent researchers could use to protect their work—I found a couple resources that I immediately wanted to try. Later in the month, I had the chance to interview a few experts on the subject. I’ll be incorporating more of their wisdom in future episodes, but I summarized it all for you here. And finally, I spent some time poking around the internet and social media for more spaghetti to throw at the wall.

Here’s everything I tried:

• installed Privacy Badger

  • this is a free browser extension that blocks trackers and cookies from following you across webpages

  • developed by the Electronic Frontier Foundation, a nonprofit organization dedicated to digital privacy rights, which is probably the most trustworthy you’re gonna get when it comes to free software

  • super easy to install

  • it’s usually blocking at least two trackers but I’ve seen it go as high as 35, click the badger symbol near the top of your browser and it gives you a report of everything it’s blocking (like aax.amazon-adsystem.com and track.customer.io) and a slider where you can allow the site, or just its cookies, if you really want to

    • (The site with 35 trackers hiding on it was Tech Advisor, which also begged me to turn off my “ad blocker.” Privacy Badger doesn’t block ads, unless they’re also tracking you, so I guess Tech Advisor was just desperate to sell out my data from under me.)

  • some of my browser applications have had a hard time keeping me logged into my accounts since I installed this extension, maybe some of their non-malicious cookies are getting blocked too

  • overall, I highly recommend this extension

• installed Signal

  • after getting assurance from multiple experts that Signal is still the most secure messaging app, I decided to install it on my phone

  • easy to install and figure out how to use

  • following the advice of this Freedom of the Press Foundation article, I went into the app’s settings and set notifications to “no name or message,” so my conversations can’t be scraped off my lock screen

  • I still don’t entirely trust it, I might try Wire instead

• phone privacy settings

  • I found the privacy section in my phone’s settings and turned off location tracking for most apps (other than maps), and advertising tracking

    • here’s EFF’s guide if you want to follow along with your own device

  • then I turned off my phone’s voice assistant’s access to my apps (painstakingly, one-by-one), which prevents your apps from listening to your conversations

    • please follow this All About Cookies guide to shut off Siri’s wire-tap function

• submitted a Delete Request through California’s DROP program

  • data brokers are required to delete your information from their databases if you request it, but they don’t have to start “processing” until August

  • I had to prove I was a CA resident, which meant submitting sensitive information to the DROP portal

  • I also had to tell them exactly what information I wanted deleted, which meant entering it into the portal… I guess I just have to trust that my privacy will be respected this time

  • I’ll give an update on this once August rolls around