Security and Anonymity = TOR + VPN + 2FA + PGP

[DronVR]

Security and Anonymity = TOR + VPN + 2FA + PGP

Why is the Internet not safe?
When a user visits the site or searches for information through standard browsers (Google Chrome, Firefox and others) without additional funds, the request is first sent to the provider that distributes the Internet. The provider is subject to the laws of the country, so the sites blocked by the government do not open through regular browsers. That is, the request goes to the provider, and he is obliged to deny the user access to the prohibited resource.

But the main danger is different: the Internet and anonymity are gradually ceasing to be synonyms. Servers across the country have expanded significantly to meet the requirements for storing users' personal data, as required Federal Law No. 242 of July 21, 2014 (entered into force in 2016, text of the law by reference ) . This means that all information about our actions on the Internet is stored with the provider for a year. The authorities do not even need a court order to quickly receive this data from the provider.

Deputy Irina Yarovaya cares about the security of the Russian Federation ​

Mobile communication is also not anonymous, and from July 1, 2018, the Spring Law should come into force. Now mobile operators will have to store correspondence and recordings of conversations of all their subscribers for 6 months, and the fact of communication with a particular subscriber - 3 years.​

Although the deputy Irina Yarovaya believes that there is no reason to increase the cost of communication in the law, mobile operators shrug their hands: there is not enough capacity to carry out the grandiose anti-terrorism whim. Even taking into account the gradual increase in tariffs: MTS in March already raised prices for its services. Experts believe that the law will necessarily be postponed, and may even be revised.​

Traffic from instant messengers (WhatsApp, Viber, Telegram and others) is also stored by providers. However, the correspondence in them is encrypted, and it is assumed that those who are not supposed to read it cannot. In this regard, it has already become clear which of them are ready to give out their users and which are not. Some messengers are unsafe from this point of view.

Of the most popular messengers in the CIS Telegram causes maximum confidence. The data from ordinary Telegram chats is stored on servers and can be decrypted by the messenger, but the developer Pavel Durov assures that the messenger will not give out data to anyone under any circumstances. Encryption of secret chats is written in such a way that no one, including the developers themselves, can decrypt messages (and even if they could, - adds developer Pavel Durov - they still wouldn’t).

VPN
Reliable help for access to blocked sites and protection of transmitted information when connected to the Internet.

VPN server is a free (due to advertising) or paid service, which for 100-500 rubles per month allows you to connect to the Internet through it.

Firstly, the provider does not see where you go on the Internet, because now your computer does not access sites directly, but asks for it to be a VPN server. Therefore, you have access to sites blocked by the provider (torrent trackers, free books, "extremist materials", information about substances).

Secondly, everything that you transfer to the VPN server (and everything that it brings to you from the Internet) is encrypted, so no one in the middle of the chain can read: what you write, read where you go, what you download, your logins / passwords and bank card data - now it can only be seen by the person from whom / to whom it was sent (the site where you are sitting) and the VPN service itself.

Under VPN, your data and real location are hidden securely, but there are threats: 1) the VPN service itself (it can read your data and knows who you are) and 2) a hacker connected to the connection somewhere between you and the site you are visiting, may pretend that he is this site.

On item number 1: Do not use VPN located in the Russian Federation. Better - VPN from countries like Panama, Costa Rica, Belize.

On point number 2: Just pay attention to the browser warning about an outdated / inappropriate / missing certificate - this may mean that an attacker is “talking” to you instead of the site.

Do not use VPN with PPTP (it is vulnerable to hacker attacks), your choice is OpenVPN or L2TP / IPSec. To start, hammer in the search for "buy vpn."
Detailed instructions for connecting VPN and proper use: Windows Android iOS Mac OSX on the router

Tor browser
This is a special browser that you only need to download to use. It also provides both your anonymity (you can’t connect your network activities to a real computer), and also encrypts data - but there are differences.

Traffic is also encrypted and goes to the network not through one intermediate server, but after three. The provider and the first node (server) only know that they use TOR from your IP address, and nothing more. The second node does not know anything at all, but the third (at the exit from the TOP network) knows which site you go to and what you do there (passwords, what you write and look at, etc.) - and the site itself also knows, but they don’t know who you are.

You and TOR sites are usually from different countries. ​

​

The advantage over VPN is that it is more difficult to disclose your anonymity, but stealing personal data (what you look and write, passwords, etc.) is easier. VPN owners know who you are and what you are doing, and the TOP output nodes, the provider in the region of that node, and the site you need are just doing. Those. in comparison with VPN, more people can watch what you send to the right site, and it sends you: the TOR output node or the provider in his country may turn out to be unscrupulous - they can use your logins / passwords, for example (TOR nodes in this sense are more reliable providers - the creators of the TOR are constantly inspecting them).

By the way, your local provider does not know what you are doing, but knows that you are using TOP - and may try to block its work.
[How to bypass the TOP block: Tor browser iOS ]

2FA and PGP
We have separate articles about these methods of protection, so let us dwell on them very briefly.

2FA (two-factor authentication) - addition to your password for entering the resource, it is supported by many sites, including Hydra.

In fact, you need to enter in addition to captcha, login and password, the current code, which is constantly updated in a special application on your smartphone or tablet. This allows you to protect your account in two ways: even if someone leaves your data, he will not be able to log in without access to your phone / tablet. Of the minuses - in case of theft / loss of the device, it will be impossible to restore access to the account. However at the same time, you have a public PGP key specified in your account, you will be able to restore access using it .

2FA through the application schematically ​

​

Two-factor authentication can be not only in the form of an additional code, but also in the form of a PGP key (you can choose both methods at once or only one of them). The principle of operation of a PGP key is described in articles Extra security for communication and Security: how to use a PGP key .

In short, this is a program for encryption / decryption, with it you can prepare messages that can only be read by the one to whom the message is addressed and who also has a program. An encrypted message can be easily forwarded in any way. To encrypt a message, you need to know the public key of the interlocutor, and to decrypt it, use your key to decrypt the public key. These articles contain very detailed installation and use instructions.

It is important to recall that the public key pgp specified by you on Hydra in your personal account cannot be changed! Therefore, do not lose the password from the gpg4usb application, because then in the case of 2FA using PGP you will not be able to regain access to your account. This is done for our safety, so that no one could trick the data.

This is what the PGP key looks like ​

​

Security Conclusion
A VPN is very good for surfing the Internet safely, and TOR for visiting the darknet. To prevent your data from being stolen when you use Tor, enable the "https everywhere" function (then the data for most sites will be encrypted), and encrypt PGP on resources without https support (insist on using it when you give your address to sellers!) ; on sites, in addition to easily hijacked passwords, use 2FA.

Safety is achievable. VPN and TOR are not perfect, but the effort required to compute the user is quite large, and if you are not a very interesting person, they are quite enough.

​