Guide To Computer Security (2022)

The original Guide to Computer Security was produced by the Newgon Support Team after consultation with the Newgon forum community in 2008. It explained how you could protect data stored on your hard drive and stay anonymous on the internet. The guide may be of interest to people who wish to protect their anonymity and data from adversaries. This page represents an updated version currently under development.

Operating Systems

Windows 10

As of December 2021, Windows 10 is the world's most popular operating system. Although extremely convenient, it is widely considered to be a very poor choice for data security and privacy.

Multiple guides exist online describing how to reduce the risk posed by using Windows 10. However, it is inherently insecure and best avoided for anyone who is concerned about the leakage of sensitive information.

Installing a free/open source operating system such as Linux is strongly recommended instead.

Windows 7

Windows 7 is no longer supported by Microsoft; as such, known security issues are unlikely to be patched barring exceptional circumstances. Usage of the Internet Explorer browser is not recommended.

There are a number of settings that should be changed in order to improve user privacy.

Indexing Service

The indexing service provides a book-like index of all files stored on any drive for which it is enabled. It enables faster searches of drives and folders. However, names of all indexed files and some of their contents will be stored in plain-text on the drive on which Windows is installed, even if those files are encrypted.

To turn off the indexing service:

Control Panel -> Programs -> Turn Windows features on or off. Deselect 'Indexing Service'.

Recent Items

By default, Windows 7 stores a list of recently opened items. To disable this, right click on Start, select 'Properties', select the 'Start Menu' tab, then uncheck 'Store and display recently opened programs in the Start menu' and 'Store and display recently opened items in the Start menu and the taskbar'.

System Restore

Windows 7 is normally configured to automatically backup system files and personal documents. This can be disabled via Control Panel -> System -> System Protection. Make sure it is turned off for all disks.

Swap File

Windows 7 uses a swap file in which it temporarily stores data from RAM on the disk in order to conserve RAM usage. This is unnecessary for most modern computers, and it is a security issue because almost any data could theoretically be written to the disk, including encryption keys.

To disable, System -> Advanced System Settings -> under performance, click 'Settings' -> Advanced tab -> under Virtual Memory, click 'Change' -> set 'No paging file' for all drives.

Hibernation

The hibernation feature of Windows 7 stores data from your current session to your hard drive and puts your computer in a very low power state. This has similar security implications to the swap file.

To disable hibernation: Start -> Type 'run' -> Type 'cmd' -> type 'powercfg -h off'.

Thumbnail cache

Windows 7 stores thumbnails in a central cache on the drive on which Windows is installed. Thumbnails of encrypted images will also be stored in this central cache when the folder in which the images are located is accessed.

Built-in methods and softwarefor disabling the cache exist, but there are reports of these solutions not working perfectly. People living in particularly oppressive regimes should consider wiping their thumbnail cache regularly.

Telemetry

Windows 7 sends data about your computer usage to Microsoft. The relevant 'features', designed for Windows 10, were introduced to Windows 7 via Windows Updates.

The following updates should be uninstalled if present:

• KB3068708
• KB3022345
• KB3075249
• KB3080149

Linux

Linux-based operating systems are strongly recommended over proprietary operating systems like Windows due to the latter's inherent privacy and security issues.
Installing a Linux distribution is easy. All that is needed is an .iso file downloaded from the distribution's official website, flashing it to a USB drive with a tool such as Rufus or burning to a CD/DVD.
Booting a computer from this USB or DVD drive will begin the installation.

• Ubuntu

Ubuntu is the most popular and one of the most user-friendly Linux distributions. If you're looking for a place to start while switching away from Windows, Ubuntu is a decent choice.

• Fedora

Fedora is another very popular Linux distribution, and in user friendliness equals Ubuntu. It also uses the most up to date releases of software and drivers, making it a good choice for newer hardware.

Tips

Virtually every popular Linux distribution will offer you to enable full disk encryption (LUKS) during the installation process. It is strongly recommended to enable this option (see screenshots).

Installation examples

• 
  Ubuntu
• 
  Fedora
• 
  POP OS

Live CDs

Live operating systems require no installation except a USB or DVD drive they are flashed/burned onto and then booted from.

• Tails OS

Tails is a live operating system configured to be fully amnesic (leave no trace on the computer it is booted from) and use the Tor anonymity network.

• Many Linux distributions can be run in live mode as an alternative to installation.

Data Protection

Encryption

Encrypting files renders the data within them unintelligible. While Microsoft, hard drive manufacturers and other companies offer free encryption tools, these cannot be trusted in the event of a highly motivated adversary.

Recommended Programs

The following programs can probably be trusted to protect against the vast majority of adversaries, assuming that their settings are configured correctly and the operating system has been appropriately secured.

VeraCrypt

VeraCrypt is a fork of TrueCrypt, a program whose development is alleged by many to have been shut down by the US government. VeraCrypt is widely considered to provide the highest level of security of any free program. Donations to the project would always be welcome.

LUKS

LUKS is Linux inbuilt encryption utility. An option to encrypt the entire disk is offered while installing Linux. Afterwards it can be easily used to encrypt external devices through a graphical interface offered by the distribution's desktop environment.

BestCrypt

BestCrypt is a paid encryption product with similar functionality to VeraCrypt. It can be purchased along with highly effective data erasure software. Although expensive, it is a long established and very well trusted product.

Encryption Options

There are two main methods of encryption that are still relevant in 2022.

Whole Disk Encryption

Encrypting the entire disk renders all contents unreadable unless a password is provided. If you do not require plausible deniability and you do not care about giving the appearance of compliance, you can simply encrypt the entire disk and refuse to provide the password.

Volume Encryption

Volume encryption creates a file on your disk that functions as a virtual drive. These virtual drives have the same functionality as a physical drive. Using volume encryption allows you to encrypt only a portion of your disk, instead of encrypting the whole drive.

A major benefit of volume encryption for activists is the ability to create hidden volumes. Hidden volumes are created within the free space of a standard volume. Due to the way they're created, they are extremely difficult to detect. This provides excellent plausible deniability; you can hand over a key to the main volume and still nobody can prove that there is a second hidden volume containing the data that you really wish to keep private.

VeraCrypt has a feature allowing users to run an operating system from within a hidden container, reducing the risk of data leakage from improper operating system configuration.

Secure Erasure

In most cases, files deleted through conventional methods are still recoverable, even after trash is emptied. Several tools exist to securely erase either specific files, entire partitions, or wipe free space on a disk to get rid of any remnants of files that were not erased securely.

Windows

Eraser can be used to erase select files, external drives, or wipe free space on the currently used drive.

Other (entire disk)

DBAN (Darik's Boot and Nuke), is used for wiping entire drives. It must be booted from an external drive.
Warning: All data will be erased, including the operating system. If there are files you want to keep, you must back them up on another drive and unplug it from the computer before using DBAN. An operating system must be reinstalled on the computer afterwards.

Network Security

Proxies

Proxies are used to hide your true IP address from another server or client. Many proxies are insecure and not suitable for use by MAP activists. Use of a malicious or unfriendly proxy server can be more dangerous than a direct connection.

Web-based proxy servers

Web-based proxies are of very limited utility for the MAP activist community. They provide a minimal level of obfuscation suitable only for circumventing bans and geographic restrictions, and many will already be blocked from popular websites. The service operator has the ability to monitor users and may well comply with authorities wrongly targeting MAPs.

VPNs

Similar to web-based proxies, VPNs place users at risk of monitoring by the service provider and anyone to whom they choose to provide access. They have the same practical purpose as web-based proxies for the MAP community.

Tor

Unlike web-based proxies and VPNs, Tor forwards data via an entry node and two more random nodes operated by volunteers. Data sent by the client is encrypted up to the exit node. Upon leaving the exit node, data is visible if not encrypted by other means (such as HTTPS), although the source of the data is unknown.

There are weaknesses within the Tor design, but it is the safest option for anonymous communication online. People who do not make themselves a major global target are unlikely to be identified due to any of the inherent weaknesses. User error is the biggest risk.

Using Tor safely

In 2022, Tor is most often used with Tor Browser, which is automatically configured to connect via the Tor network.

Tor Browser has three pre-configured security levels.

• 'Safest' disables any functionality that could be used to identify you. However, a lot of website features will no longer work. Social media, webmail and many other services will be unusable.

• 'Safer' disables some features that could be used to identify you, but not all. JavaScript is enabled on HTTPS sites. Social media, webmail and many other services will will usable, but there is a small risk of being identified via malicious scripts.

• 'Standard' does not disable any potentially dangerous functionality. There is a higher risk of being identified or attacked.

The final connection in the Tor circuit (between the exit node and the destination) is not encrypted by the Tor client. Therefore, any data sent will be visible by the operator of the exit node. Any sensitive information should be encrypted by other means. A simple HTTPS connection is one solution. The HTTPS Everywhere extension forces a HTTPS connection for all compatible services.

E-mail

Providers

• Tutanota is a privacy-respecting e-mail provider that offers both a free and paid model. There is a two-day waiting period on newly registered accounts before they can be used.

Operational Security

Search engines / Googling

It is recommended to use a privacy-respecting search engine instead of Google.

• Startpage offers results from Google without Google's tracking mechanisms. This also means the results are not personalized.
• DuckDuckGo is a popular search engine that claims to respect privacy of its users.

Screenshots

Linux installation

During the installation step that asks you about the disk to use for your operating system, tick the checkbox to Encrypt your data (under Advanced Features in the Ubuntu example).

Ubuntu

• 
• 
• 
• 
• 
• 

Fedora

• 
• 
• 
•