What Works May Hurt: Side Effects in Education

Stop giving your information away carelessly!

27 tips for improving your cyber-hygiene

Who is most responsible for your online privacy being violated?

You are.

Privacy is one of the biggest concerns in tech news recently. The importance of personal privacy is something everybody seems to be able to agree on. But if you’re concerned about privacy, then you need stop giving your information away willy-nilly. Because you probably are.

Well, maybe you are. See how many of the following best practices you already follow.

1. Passwords. Install and learn how to use a password manager on all your devices. There are many fine ones on the market.
2. Let your password manager generate your passwords for you. You never even need to know what your passwords are, once you’ve got the password managers set up.
3. Make sure you make a secure password for the password manager!
4. Stop letting your browser save passwords. Your password manager handles that.
5. If ever you have reason to send a password to another person online, break it into two or more files (texts, emails, whatever) in different media, then totally delete those files. Also, some password managers help with this.
6. Credit cards and other personal info. Stop letting your browser save your credit cards. Your password manager handles that.
7. Stop letting web vendors save your credit card info on their servers, unless absolutely necessary (e.g., for subscriptions). Again, your password manager handles that. Maybe you should go delete them now. I’ll wait.
8. If you give your credit card info out online, always check that the website has the “lock” next to its address on the address bar. That means it uses the https protocol (i.e., uses encryption).
9. Stop answering “additional security” questions with correct answers, especially correct answers that hackers might discover with research. Treat the answer fields as passwords, and record them in your password manager.
10. Stop filling out the “optional” information on account registration forms. Give away only the required information.
11. Americans, for chrissakes stop giving out your social security number and allowing others to use it as an ID, unless absolutely required.
12. Stop giving your email address out when doing face-to-face purchases. Those companies don’t actually need it.
13. Stop trusting the Internet giants with your data. Consider moving away from Gmail. Google has admitted it reads your mail—all the better to market to you, my dear. Gmail isn’t all that, really.
14. Maintain your own calendar. When meeting, let others add your name, but don’t let them add your email address, if you have a choice.
15. Maintain your own contacts. No need to let one of the Internet giants take control of that for you. It’s not that hard. Then have them delete their copies.
16. If you’re an Apple person, stop using iCloud to sync your devices. Use wi-fi instead.
17. Browser and search engine hygiene. Use a privacy-respecting browser, such as Brave or Firefox. (This will stop your browsing activity from being needlessly shared with Google or Microsoft.)
18. If you must use a browser without built-in tracking protection (like Chrome), then use a tracker-blocking extension (like Privacy Badger).
19. Use a privacy-respecting search engine, such as DuckDuckGo or Qwant. (Ditto.)
20. Social media, if you must. On social media, start learning and taking the privacy settings more seriously. There are many options that allow you to lock down your data to some degree.
21. Make posts “private” on Facebook, especially if they have any personal details. If you didn’t know the difference between “private” and “public” posts, learn this. And a friend says: “Stop playing Facebook quizzes.”
22. Stop digitally labeling your photos and other social posts with time and location. Make sure that data is removed before you post.
    (Putting it in the text description is better.)
23. For crying out loud, stop posting totally public pictures of your vacation while you are vacation. Those pictures are very interesting to burglars. Wait until you get home, at least.
24. Sorry, but stop sharing pictures of your children on social. (This is just my opinion. I know you might differ. But it makes me nervous.)
25. Consider quitting social media altogether. Their business models are extremely hostile to privacy. You (and your private info) are the product, after all.
26. A couple of obvious(?) last items. Make sure you’re using a firewall and some sort of anti-virus software.
27. Don’t be the idiot who opens email attachments from strangers.

How many did you answer “I do that!” to? I scored 22, to be totally honest, but it’ll be up to 27 soon. Answer below. Well, answer only if you have a high score, or if you use a pseudonym. I don’t want hackers to know who they can hit up for an easy win!

Kick the tech giants out of your life

If you’re like me, you feel a need to need to kick the tech giants out of your life. But how? Well, nobody said it would be easy, but I’m actually doing it!

Stop using Google Chrome. Google is contemptuous of your privacy and of free speech. I recommend Brave.

Stop using Google Search. And it tracks you after you search. I recommend DuckDuckGo, with results just as good as Google’s 90+% of the time, in my experience.

Stop using Gmail. Look. Gmail is way overrated. And there are many, many other options out there which do not read your mail and extract marketable data.

Stop using Google Contacts and iCloud. Start managing your own contacts and data. There are lots of great tools to do this; it’s not that hard.

Shields up on all the tech giants’ websites and devices. Dive in to the innards of your settings (or options)—not just a few, all of them, because they like to hide things—and set your privacy settings to max.

Maybe quit social media. Facebook, Twitter, YouTube, and others have becoming increasingly censorious and contemptuous of your privacy. Make them less relevant by spending more time elsewhere, if you can’t just quit for good.

Use a password manager. Stop letting your browser track your passwords.

And then, if you want to get serious:

Start learning Linux… Microsoft’s problems with privacy and security are famous. Apple has its own too. Well, there are these things called “virtual machines” which make it easy (and free) to install and play with your very own Linux installation. Try it!

…then switch to Linux. If you know how to use Linux, why not make the switch to something more permanent? You can always dual-boot.

How I locked down my passwords

If you’re one of those people who uses the same password for everything, especially if it’s a simple password, you’re a fool and you need to stop. But if you’re going to maintain a zillion different passwords for a zillion different sites, how? Password management software. I’ve been using the free, open source KeePass, which is secure and it works, but it doesn’t integrate well with browsers, or let me save my password date securely in the cloud (or maybe better, on the blockchain). So I’m going to get a better password manager and set it up on all my devices. This is an essential to locking down my cyber-life. One of the ways Facebook, LinkedIn, et al. insinuate themselves in our cyber-lives is by giving us an easy way to log in to other sites. But that makes it easier for them to track us everywhere. Well, if you install a decent password manager, then you don’t have to depend on social login services. Just skip them and use the omnipresent “log in with email” option every time. Your password manager will make it even easier than social login systems did.

You need a password manager

Password management software securely holds your passwords and brings them out, also securely, when you’re logging in to websites in your desktop and handheld browsers. Decent browsers (like Brave) make your passwords available for the same purposes, if you let them, but there are strong reasons you shouldn’t rely on your browser to act as a password manager.

Instead, for many years I’ve been using KeyPass, a free (open source) password manager that’s been around for quite a while. The problem with KeyPass, as with a lot of open source software, is that it’s a bit clunky. I never did get it to play nicely with browsers, and your passwords are saved in a file on your computer and/or in the cloud. If you lose the file, you lose your passwords.

Password managers do, of course, automatically generate passwords and save them securely. They can also (but not all do) store your password database securely in the cloud, so you don’t have to worry about losing it (you can export a copy if you like). You can use it on all your devices with equal ease. They’ll let you log in with a fingerprint on your phone.

A very nice feature is that they’ll securely store payment information, so your browser, websites, and operating system don’t have to hold that information. That means you don’t have to trust them to manage this information properly. You only need to trust the password manager…

But can you trust password managers?

“Ah,” you say, “but can you trust password managers?” That’s not a bad or naive question at all; it’s an excellent question. Consumer Reports, of all things, weighs in:

By default, LastPass, 1Password, and Dashlane store your password vault on their servers, allowing you to easily sync your data across devices. As a second benefit, if your computer crashes you won’t lose your vault.

But some people just really hate the idea of storing all their passwords on one site in the cloud—no matter what the company promises about its security measures, there’s probably a bulls-eye painted on its encrypted back. If that sounds like you, it’s possible to store your passwords locally.

Dashlane lets you do this by disabling the “Sync” feature in Preferences. This will delete your vault and its contents from the company’s servers. Of course, any further changes you make to your vault on your computer won’t show up on your other devices.

So what’s my take? There are layers upon layers of security protecting your password repository, not least of which is the (hopefully well-chosen) master password to your password database. While you do have to choose the professionalism and honesty of a cloud-based password manager, I think that’s their business, so I’m inclined to trust them. But, but!

I ask myself: what is more likely, that they become compromised (for whatever reason—let your imagination run wild) or instead that I lose my master password or all copies of my password database or somehow allow myself to be hacked? I think both are fairly unlikely, first of all. I am certainly inclined to distrust myself, especially over the long haul. And frankly, the idea that a security business is compromised seems unlikely, since security is their business. But could a password manager server be hacked? That is, again, a really good question, and you wouldn’t be the first to ask it. Password manager company OneLogin was actually hacked, and the hackers could actually “decrypt encrypted data,” the company said. Holy crap!

Also, which is most disastrous? Losing my password file would not be a disaster; I can easily generate new passwords; that’s just a pain, not a disaster. But a hacker getting hold of my passwords in the cloud (no matter how unlikely)? That could be pretty damn bad.

After all, especially as password manager companies grow in size (as successful companies are wont to do), they naturally can be expected to become a honeypot for hackers. Another example of a hacked password management company was LastPass, which was hacked in 2015, although without exposing their users’ passwords.

If you’re like me, you have libertarian concerns about having to trust external entities (and especially, giant corporations) with your entire digital lives. You might also not want to trust (future?) dangerous governments with the power to force those corporations to give access to your entire digital life, then we’re no longer talking about anti-crime cybersecurity. Then it looks like you shouldn’tsensibly put your password files in a corporate-managed cloud. Then you’re having to trust people a little too much for my comfort. So you should manage their location yourself.

Then there are two further problems. First, can you be sure that it is impossible for anyone at the password management software company to crack your password database, even if you host it yourself? (Do they have a copy? Can they get access to a copy? If they have access, are there any back doors?)

Second, there’s the practical issue: Without the cloud, how do you sync your passwords between all your devices? That feature is the main advantage of hosting your passwords in the cloud. So how can you do it automatically, quickly, and easily?

What self-hosted password manager is really secure?

Several password managers use the cloud, but what is stored in the cloud is only the encrypted data. All the login and decryption happens on your local device. This is called zero-knowledge security, and it might be a suitable compromise for many. I have one main issue with this: Especially if the software is proprietary, we must simply trust the company that that is, in fact, how it works. But that’s a lot to ask. So I’ll pass on these. I’ll manage the hosting of my own passwords, thanks very much.

Here are my notes on various password managers:

1. These all feature zero-knowledge security but seem not to allow the user to turn off cloud sync (maybe they do, I just couldn’t find evidence that they do): 1Password, Keeper Password Manager, LastPass, LogMeOnce, Password Boss, Zoho Vault.
2. Sticky Password Premium: Allows home wifi sync of passwords, which is just fine. Fills out forms, works on all your devices…except Linux devices. Linux does not seem to be supported. Next!
3. RoboForm: Doesn’t have a sync feature without using their cloud service, but hey! It has a Linux version! Might work on Brave, since Brave is built on Chromium and there is a Chrome extension. This was enough for me to install it (and it worked!), but it seems to be rather clunky and there were a few different things that didn’t inspire confidence.
4. Dashlane: This has zero-knowledge security, which isn’t a bad thing, but in addition, it allows you disable sync. Whenever you turn it off, the password data is wiped from their servers (so they say). You can turn it on again and sync your devices, then turn it off again. This is within my tolerance. Also, Dashlane has a Linux version. In other respects, Dashlane seems very good. I installed it and input a password. The UX is very inviting—even the Linux version. It’s expensive, though: it’s a subscription, and it’s $40 for the first year (if you use an affiliate link, I guess), and $60 if you buy it direct, which I’m guessing will be the yearly price going forward. That’s pretty steep for a password manager.
5. EnPass: Here’s something unusual—a password manager that goes out of its way to support all platforms, including Linux and even Chromebook (not that I’d ever own one of those). Rather than an expensive subscription, like Dashlane, EnPass’s desktop app is free, while the mobile version costs $10, and that’s a one-time fee. They don’t store passwords in the cloud; passwords are stored locally, but EnPass has some built-in ways to sync the passwords (including by wi-fi, like Sticky Password). The autofill apparently doesn’t work too well, while more expensive options like Dashlane do this well, and lacks two-factor authentication, which would be nice, and other “luxury” features.

Installation and next steps

Dear reader, I went with EnPass.

So how did I get started? Well, the to do list was fairly substantial. I…

1. Made a new master password. I read up on the strategy for making a password that is both strong, easy to remember, and easy to type. I ended up inventing my own strategy. (Do that! Be creative!) So my master password ended up being a bit of a compromise. While it’s very strong, it’s a bit of a pain to type; but it’s pretty easy to remember. Whatever master password you chose, just make sure you don’t forget it, or you’ll lose access to your password database.
2. Installed EnPass on Windows and Linux and tested it to see if it worked well in both. It does (so far).
3. Used EnPass to sync the two installations using a cloud service. (I’ll be replacing this with Resilio Sync soon enough, so it’ll be 100% cloudless.) I confirmed that if I change a password in one, it is synced in the other.
4. Imported all my Keepass passwords, then tested a bit more on both platforms to make sure nothing surprising is happening. So far, so good. My only misgiving about EnPass so far is that there doesn’t seem to be a keyboard shortcut to automatically choose the login info. I actually have to double-click on the item I want, apparently.
5. Deleted all passwords from all browsers, and ensure that the browser doesn’t offer to save new passwords. Let the password manager handle that from now on. (No need for the redundancy; that’s a bit of extra and unnecessary risk.)
6. Installed on my cell phone, synced (without issue), and tested. (Annoyingly, the Enpass iOS app doesn’t do autofill, but I gather that’s in the plans.)
7. Installed app and browser plugin on my (Mac) laptop. No issues there either.
8. Deleted Keepass data in all locations. That’s now redundant and a needless risk as well.

I’m now enjoying the new, secure, and easy access to my passwords on all my devices. I’m also happy to be free of browser password managers.

This was installment four in my series on how I’m locking down my cyber-life.

How I set up private email hosting for my family

Here’s how I actually set up my own private email hosting—sanger.io! I already finished choosing a private email hosting provider. So what was the next step?

I still had to choose a plan with my chosen provider (InMotion Hosting, which didn’t pay me anything for this) and pay for it. The details are uninteresting; anybody could do this.

Now the hard work (such as it was) began. I…

(1) Read over the domain host’s getting-started guide for email. InMotion’s is here, and if you have a different host, they’re bound to have some instructions as well. If you get confused, their excellent customer service department can hold your hand a lot.

(2) Created a sanger.io email address, since that’s what they said to do first. In case you want to email me, my username is ‘larry’. (Noice and simple, ey?) InMotion let me create an email address, and I was rather confused about how this could possibly work since I hadn’t pointed any DNS, hosted by NameCheap, to InMotion.

(3) Chose one of the domain hosts’s web app options. For a webmail app (InMotion gave me a choice of three), I went with Horde, which is, not surprisingly, a little bit clunky compared to Gmail, but so far not worse than ZohoMail; we’ll see. Unsurprisingly, when I tried to send an email from my old gmail account to my new @sanger.io account, the latter didn’t receive it. Definitely need to do some DNS work first…

(4) Pointed my domain name to the right mail server. In technical jargon, I created an MX record on my DNS host. This was surprisingly simple. I just created an MXE Record on NameCheap, my DNS host for sanger.io, and pointed it to an IP address I found on InMotion. So basically, I just found the right place to paste in the IP address, and it was done. Now I can send and receive email via sanger.io (at least via webmail).

(5) Created email addresses for my other family members. Very easy.

(6) Installed a desktop email client. Why? I wasn’t using one before because I just used Gmail in a browser and Apple’s mail app on my phone. I could keep using webmail (on InMotion) but a desktop client is apt to be nicer. I’d tell you which one I used, but I’m not confident it’s particularly good.

(7) Installed a new email client for my phone. As I no longer trust or want to support Apple if I can at all help it, I wanted to stop using their email client. I paid $10 for a privacy-touting mail client which is quite good so far: Canary Mail.

(8) Change the mail address registered with the big, consequential apps and services. This is the most labor-intensive step, and the step I most dreaded. Sure, it was a pain. But it turns out it was tremendously satisfying to be able to tell them to stop using my wretched Gmail address and instead to start using my slick new permanent and personalized address. Was that fun? Heck yeah it was! Anyway, such apps and services include (click on the links for useful privacy tips):

• The massive Internet and tech services: Google, Microsoft, Apple.
• The big social media/community accounts: Facebook, Twitter, YouTube, Quora, Medium, LinkedIn.
• Companies I pay money to: Amazon, Netflix, PayPal, Patreon, InMotion, GoDaddy, NameCheap, Heroku, LifeLock, The Great Courses, any other bills.
• Important stuff: my employer, the bank, medical info systems/apps, dentist, Coinbase.
• Family, friends, and work and business people. Send them the message three times spread over a month or two, because if they’re like me, they ignore such emails or don’t act on them right away, and some old aunt of mine will keep sending mail to my gmail address for years and years. (I haven’t actually done this one yet, but will soon. Gmail makes exporting of all your relevant contact info surprisingly difficult.)

(9) Create a Gmail forwarder! Buh-bye, Google! No need even to visit your crappy, biased, would-be totalitarian service for email any longer.

(10) Clean up and consolidation. There are a zillion little consequences when you change your email on all these big services, and I expect I’ll be dealing with the consequences (nothing major!) for a few days or weeks to come. Among the things I know I’ll have to do: (a) Install and configure mail clients on my laptop and iPad, and in other ways get those other devices working as expected again. (b) Update various email clients with address book information, as needed. (c) Actually collect my contacts from Google and Apple (harder than it sounds). (d) Change entries in my password manager from @gmail.com to @sanger.io. (e) Actually, get a new password manager…but that’s a whole nuther thang. (f) Get Microsoft and Google and whatever else to forget my contacts…ditto.

This was installment three in my series on how I’m locking down my cyber-life.

How I chose an email hosting service to replace Gmail

I want to lock down my cyber-life. One basic constraint is that I want to replace Gmail, and when I do so, I never want to change my email address again. My biggest concern is that I never again want to be beholden to any major Internet corporation that has shown its contempt for privacy and censorship concerns. But if I can get “the last email address I’ll ever need” while I’m at it, all the better.

The natural solution is to own my own domain name and seek out email hosting. This is not as difficult as it might sound, but it isn’t as easy as registering a new Google account. But then, that is exactly what Google is counting on: your laziness.

My new address will live at the newly-registered sanger.io domain. I and my family members can have unique and easy to remember email addresses for all the rest of our lives. After purchasing sanger.io (from NameCheap), I listed a number of features I knew I wanted: reasonable price, unlimited (or more than I could reasonably need) email storage space, IMAP support, a webmail app built in to the hosting provider (or else software that they make it easy for me to install on my new domain), and finally, enough email addresses for my purposes.

I ended up weeding out a fair few on grounds that they were too expensive (e.g., ProtonMail) or didn’t offer enough storage space or accounts (e.g., NameCheap). I also weeded many out because their Alexa ranking was above 10,000, and while that isn’t a make-or-break deal, I didn’t want to have to deal with a fly-by-night operation and maybe have to move operations again.

Private email hosting comparison (Jan. 2019)

I also discovered that some competitive email hosting (in the case of BlueHost and InMotionHosting) comes packaged with shared web hosting, which would be handy. I mean, then I could finally ditch GoDaddy, which I’ve used since time immemorial. (I dislike their upselling and bait-and-switch tactics, and detest their clunky user interface.)

I use Zoho Mail for work, and it’s quite decent, but it costs half again as much and doesn’t bundle shared web hosting. RackSpace email hosting seems high-quality, but it fails by comparison with BlueHost and InMotionHosting, in that those two offer unlimited email addresses and unlimited email storage space. And between the latter two, InMotionHosting seems to be the better reviewed by WebHostingGeeks.com and in other reviews. Besides, it supports Ruby; I could host my Rails projects there.

I looked at a number of other reviews of InMotionHosting, and it does indeed look good. It also has spam protection (which I didn’t think to check on at first), lots of PostgreSQL databases if I want them, and free website data migration from GoDaddy.

I understand that this is not a route that most people will take. Paying for email seems unnecessary, many people would say. And certainly most people don’t need their own domain name for email, they think. But just think: you can have the same, perfectly appropriate email address for the rest of your life. And you no longer have to feel beholden to the privacy practices of an Internet giant like Google.

Look, you don’t have to be an uber-geek to do this. If you can’t do it yourself, and you can get a geeky friend to set this up for you—it’s not that expensive, and then you’d have your own address forever.

And you’d no longer have to support the growing monster that is Google. Gmail is admittedly a pretty awesome web app, but frankly I find I haven’t missed it much when using ZohoMail for work, and I don’t even use the Google email client on my phone. So the slightly slicker quality of the Gmail web app really doesn’t make that much difference after all.

Next: how I set up my new private email hosting.

This was the second installment in my report about how I’m locking down my cyber-life.

How to secure your privacy and stop supporting censorious corporations

Two problems of computer technology

My 2019 New Year’s resolution (along with getting into shape, of course) is to lock down my cyber-life. This is for two reasons.

First, threats to Internet security of all sorts have evolved beyond the reckoning of most of us, and if you have been paying attention, you wonder what you should really be doing in response. My phone was recently hacked and my Google ID reset. The threats can come from criminals, ideological foes and people with a vendetta or a mission (of whatever sort), foreign powers, and—of special concern for some of us—the ubiquitous, massively intrusive ministrations of the tech giants.

Second, the Silicon Valley behemoths have decided to move beyond mere moderation for objectively abusive behavior and shutting down (really obvious) terrorist organizations, to start engaging in viewpoint censorship of conservatives and libertarians. As a free speech libertarian who has lived online for much of my life since 1994, these developments are deeply concerning. The culprits include the so-called FAANG companies (Facebook, Apple, Amazon, Netflix, Google), but to that list we must add YouTube, Twitter, and Microsoft. Many of us have been saying that we must take ourselves out of the hands of these networks—but exactly how to do so is evidently difficult. Still, I’m motivated to try.

At the root of both problems is simply that the fantastic efficiency and simplicity of computer technology is secured via our participation in networks and EULAs offered by massively rich and powerful corporations. Naturally, because what they offer is so valuable and because it is offered at reasonable prices (often, free), they can demand a great deal of information and control in exchange. This dynamic has led to us (most of us) shipping them boatloads of our data. That’s a honeypot for criminals, authoritarians, and marketers.

There is nothing we can do about it—except to stop participating.

The threat to our privacy undermines some basic principles of the decentralized Internet that blossomed in the 90s and boomed in the 00s. The Establishment has taken over what was once a centerless, mostly privacy-respecting phenomenon of civil society, transforming it into something centralized, invasive, risky, and controlling. What was once the technology of personal autonomy has enabled—as never before—cybercrime, collectivization, mob rule, and censorship.

A plan

I don’t propose to try to lead a political fight. I just want to know what I can do personally to mitigate my own risks.

I’m not sure of the complete list of things that I ought to do. I will examine some of these in more depth (in other blog posts, perhaps) before I take action, but others I have already implemented.

1. Stop using Chrome. (Done.) Google collects massive amounts of information from us via their browser. The good news is that you don’t have to use it, if you’re one of the 62% of the people who do. I’ve been using Firefox; but I haven’t been happy about that. The Mozilla organization, which manages the browser, is evidently dominated by the Silicon Valley left; they forced out Brendan Eich, one of the creators of Firefox and the JavaScript programming language, for his political views. Frankly, I don’t trust them. I’ve switched to Eich’s newer browser, Brave. I’ve had a much better experience using it lately than I had when I first tried it a year or two ago and when it was still on the bleeding edge. Brave automatically blocks ads, trackers, third-party cookies, encrypts your connections—and, unlike Google, they don’t have a profile about you. It’s quite good and a pleasure to use. There might be a few rare issues (maybe connected with JavaScript), but when I suspect there’s a problem with the browser, I try whatever I’m trying to do in Firefox, which is now my fallback. There’s absolutely no need to use Chrome for anything but testing, and that’s only if you’re in Web development. By the way, the Brave iOS app is really nice, too.
2. Stop using Google Search (when possible). (Done.) I understand that sometimes, getting the right answer requires that you use Google, because it does, generally, give the best search results. But I get surprisingly good results from DuckDuckGo, which I’ve been using for quite a while now. Like Brave and unlike Google, DuckDuckGo doesn’t track you and respects your privacy. You’re not the product. It is easy to go to your browser’s Settings page and switch.
3. Stop using gmail. (Done.) This was harder, and figuring out and executing the logistics of it was a chore—it involved changing all the accounts, especially the important accounts, that use my gmail address—but I’m totally committed to taking this step. I had wanted to do this for a while, but the sheer number of hours it was going to take (and did take) to make the necessary changes was daunting. Besides, I was tired of switching email addresses. I want to have one email address for the rest of my life. My new email address resides at sanger.io, a domain that my family will be able to use. Here’s how I chose an email hosting service to replace Gmail. And here’s how I set up private email hosting for my family.
4. Start using (better) password management software. (And never use another social login again.) If you’re one of those people who uses the same password for everything, especially if it’s a simple password, you’re a fool and you need to stop. If a hacker gets hold of, say, your simple Facebook password and finds you use it on Amazon, he might use it for his own nefarious purposes. But if you’re going to maintain a zillion different passwords for a zillion different sites, you certainly don’t want to write them all down on paper, and putting them in “plain text” (i.e., unencrypted) in a text (word processing) file is also unsafe. What’s the answer? Password management software. I’ve been using the free, open source KeePass, which is secure and it works, but it doesn’t integrate well with browsers, or let me save my password date securely in the cloud (or maybe better, on the blockchain). So I’m going to get a better password manager and set it up on all my devices. This is an essential to locking down my cyber-life. One of the ways Facebook, LinkedIn, et al. insinuate themselves in our cyber-lives is by giving us an easy way to log in to other sites. But that makes it easier for them to track us everywhere. Well, if you install a decent password manager, then you don’t have to depend on social login services. Just skip them and use the omnipresent “log in with email” option every time. Your password manager will make it even easier than social login systems did.
5. Figure out how to change my passwords regularly, maybe. I might want to make a list of all my important passwords and change them quarterly everywhere, as a sort of cyber-hygiene. Why don’t we make a practice of this? Because it’s a pain in the ass and most people don’t know how to use password management software, that’s why. Besides, security experts actually discourage regular password changing, but that’s mainly because most people are bad at making and tracking secure passwords. Well, if you use password managers, that part isn’t so hard. But it’s also because we really don’t have a realistic plan to do it. Well, I’m going to think hard about making one and, maybe, try to follow it, making use of whatever automated tools are available (such as this).
6. Stop using gcal. I just don’t trust Google with this information, and frankly, gcal isn’t all that. I mean, it’s OK. The only huge inconvenience is that I’m going to have to tell my workmates I don’t use it, but that they should invite me anyway and I’ll add the appointments to my own calendar. This will involve installing a calendar app on my phone (I don’t want to keep using Apple’s) and figuring out how to host my calendar data in the cloud so I have access to it from all my devices.
7. Take control of my contact lists. I’ve been giving Google, Apple, and Microsoft too much authority to manage these lists for me. I’m not sure I want them knowing my contacts, period. I don’t know what they’re doing with the information, or who they’re sharing it with, really. So I’m going to start maintaining my own contacts, thanks very much, and delete the lists I’ve given to Google and Microsoft. (Not sure I can avoid sharing them with Apple if I’m using the Phone app.)
8. Switch to Linux. (In process.) I’ve been using a Linux (Ubuntu) virtual machine for programming (and a fair bit of other stuff) for a while. Linux is stable and usable for most purposes, and while it still has issues of one sort or another, on balance those issues aren’t nearly as severe as those associated with using products by Microsoft and Apple. When necessary, I can use my Mac laptop and will continue to maintain a Windows partition, e.g., for when I need to use Camtasia. But I’ll soon (finally) be putting Ubuntu on a partition on my workstation and switching to that as my main work environment. Linux is generally more secure, gives the user more control, and most importantly does not have a giant multinational corporation behind it that wants to take and share your information.
9. Nail down a backup plan. (In process.) If you’re going to avoid using so much centralized and cloud software, you’ve got to think not just about security but about backing up your data. I’ve got a monster of a backup drive, as well as backup software and knowledge of how to use it, but what I don’t have are excellent habits to use this stuff regularly. I don’t even have regularly-scheduled backups, which I really should do. But really getting my old files organized, especially if I want to keep copies of my old emails instead of relying on frickin’ Google to do it—and doubly so if I want to download my old gmail stuff, or even (gasp) not use a cloud storage service at all.
10. Stop using cloud storage. “Now,” you’re going to tell me, “you’re getting unreasonable. This is out of hand. Not back up to iCloud, Google Drive, DropBox, Box, or OneDrive? Not have the convenience of having the same files on all my machines equally available? Are you crazy?” I’m not crazy. You might not realize what is now possible even without the cloud. If you’re serious about this privacy stuff and you really don’t trust big tech anymore—I don’t—then yeah. This is necessary too. One option is Resilio, moving files between your devices via deeply encrypted networks (via a modified version of the BitTorrent protocol), with the files never landing anywhere but on your devices. Another option is to use a NAS (network attached storage device), which is basically your very own cloud server that only you can access, but you can access it from anywhere via an encrypted Internet connection.
11. Nail down a social media use policy. Maybe quit some for good, really this time. (In process.) I’m extremely ambivalent about my ongoing use of social media. I took a break for over a month (which was nice), but I decided that it is too important for my career to be plugged in to the most common networks. If I’m going to use them, I feel like I need to create a set of rules for myself to follow—so I don’t get sucked back in. I also want to reconsider how I might use alternative social networks, like Gab (which has problems), and social media tools that make it easy both to post and to keep an easily-accessible archive of my posts. One of my biggest problems with all social media networks is that they make it extremely difficult to download and control your own friggin’ data—how dare they. Well, there are tools to take care of that…
12. Study and make use of website/service/device privacy options. Google, Apple, Facebook, Twitter, YouTube, etc., all have privacy policies and options available to the user. It is time that I studied and regularly reviewed them (as I have done only with Facebook and a bit with Google), and put shields up to maximum.
13. Also study the privacy of other categories of data. Banking data, health data, travel data (via Google, Apple, Uber, Yelp, etc.), shopping data (Amazon, etc.)—it all has unique vulnerabilities that is important to be aware of. I’m not sure I’ve done all I can to lock it down. So I want to do that.
14. Subscribe to a VPN? Websites can still get quite a bit of info about you from your IP address and by listening in on any data that happens to be unencrypted via your web connection. VPNs solve those problems by making your connection to the Internet anonymous. The big problem with VPNs, and the reason I probably won’t do this, is that they slow down your Internet connection. They also add new complexity to your life (e.g., if you get the wrong VPN, you might not be able to connect to some services, like Netflix, through the VPN). But it’s a great step to take if you’re serious about privacy, if you can get around or handle the slowness problem.
15. Get identity theft protection. (Done.) After my phone was hacked, I finally did something I’ve been meaning to do for a long time—subscribe to an identity theft protection service. The one I use is LifeLock, and so far it seems to be quite good. If you don’t know or care about identity theft, that’s probably because you’ve never seen weird charges pop up on your card, or had your card frozen by your bank, or whatever. LifeLock doesn’t prevent these issues by itself, but it does make it a lot easier to deal with them if they happen.

What have I left out?

Are you going to join me in this push toward greater privacy and autonomy? Let me know—or, of course, you can keep it to yourself.

How I’m locking down my cyber-life

Two problems of computer technology

My 2019 New Year’s resolution (along with getting into shape, of course) is to lock down my cyber-life. This is for two reasons.

First, threats to Internet security of all sorts have evolved beyond the reckoning of most of us, and if you have been paying attention, you wonder what you should really be doing in response. My phone was recently hacked and my Google ID reset. The threats can come from criminals, ideological foes and people with a vendetta or a mission (of whatever sort), foreign powers, and—of special concern for some of us—the ubiquitous, massively intrusive ministrations of the tech giants.

Second, the Silicon Valley behemoths have decided to move beyond mere moderation for objectively abusive behavior and shutting down (really obvious) terrorist organizations, to start engaging in viewpoint censorship of conservatives and libertarians. As a free speech libertarian who has lived online for much of my life since 1994, these developments are deeply concerning. The culprits include the so-called FAANG companies (Facebook, Apple, Amazon, Netflix, Google), but to that list we must add YouTube, Twitter, and Microsoft. Many of us have been saying that we must take ourselves out of the hands of these networks—but exactly how to do so is evidently difficult. Still, I’m motivated to try.

At the root of both problems is simply that the fantastic efficiency and simplicity of computer technology is secured via our participation in networks and EULAs offered by massively rich and powerful corporations. Naturally, because what they offer is so valuable and because it is offered at reasonable prices (often, free), they can demand a great deal of information and control in exchange. This dynamic has led to us (most of us) shipping them boatloads of our data. That’s a honeypot for criminals, authoritarians, and marketers.

There is nothing we can do about it—except to stop participating. That’s why I want to kick the tech giants out of my life.

The threat to our privacy undermines some basic principles of the decentralized Internet that blossomed in the 90s and boomed in the 00s. The Establishment has taken over what was once a centerless, mostly privacy-respecting phenomenon of civil society, transforming it into something centralized, invasive, risky, and controlling. What was once the technology of personal autonomy has enabled—as never before—cybercrime, collectivization, mob rule, and censorship.

A plan

I don’t propose to try to lead a political fight. I just want to know what I can do personally to mitigate my own risks.

I’m not sure of the complete list of things that I ought to do. I will examine some of these in more depth (in other blog posts, perhaps) before I take action, but others I have already implemented.

1. Stop using Chrome. (Done.) Google collects massive amounts of information from us via their browser. The good news is that you don’t have to use it, if you’re one of the 62% of the people who do. I’ve been using Firefox; but I haven’t been happy about that. The Mozilla organization, which manages the browser, is evidently dominated by the Silicon Valley left; they forced out Brendan Eich, one of the creators of Firefox and the JavaScript programming language, for his political views. Frankly, I don’t trust them. I’ve switched to Eich’s newer browser, Brave. I’ve had a much better experience using it lately than I had when I first tried it a year or two ago and when it was still on the bleeding edge. Brave automatically blocks ads, trackers, third-party cookies, encrypts your connections—and, unlike Google, they don’t have a profile about you. It’s quite good and a pleasure to use. There might be a few rare issues (maybe connected with JavaScript), but when I suspect there’s a problem with the browser, I try whatever I’m trying to do in Firefox, which is now my fallback. There’s absolutely no need to use Chrome for anything but testing, and that’s only if you’re in Web development. By the way, the Brave iOS app is really nice, too.
2. Stop using Google Search (when possible). (Done.) I understand that sometimes, getting the right answer requires that you use Google, because it does, generally, give the best search results. But I get surprisingly good results from DuckDuckGo, which I’ve been using for quite a while now. Like Brave and unlike Google, DuckDuckGo doesn’t track you and respects your privacy. You’re not the product. It is easy to go to your browser’s Settings page and switch.
3. Stop using gmail. (Done.) This was harder, and figuring out and executing the logistics of it was a chore—it involved changing all the accounts, especially the important accounts, that use my gmail address—but I’m totally committed to taking this step. I had wanted to do this for a while, but the sheer number of hours it was going to take (and did take) to make the necessary changes was daunting. Besides, I was tired of switching email addresses. I want to have one email address for the rest of my life. My new email address resides at sanger.io, a domain that my family will be able to use. Here’s how I chose an email hosting service to replace Gmail. And here’s how I set up private email hosting for my family.
4. Start using (better) password management software. And never use another social login again. (Done.) If you’re one of those people who uses the same password for everything, especially if it’s a simple password, you’re a fool and you need to stop. But if you’re going to maintain a zillion different passwords for a zillion different sites, how? Password management software. I’ve been using the free, open source KeePass, which is secure and it works, but it doesn’t integrate well with browsers, or let me save my password date securely in the cloud (or maybe better, on the blockchain). So I’m going to get a better password manager and set it up on all my devices. This is an essential to locking down my cyber-life. One of the ways Facebook, LinkedIn, et al. insinuate themselves in our cyber-lives is by giving us an easy way to log in to other sites. But that makes it easier for them to track us everywhere. Well, if you install a decent password manager, then you don’t have to depend on social login services. Just skip them and use the omnipresent “log in with email” option every time. Your password manager will make it even easier than social login systems did. UPDATE: I switched to EnPass and told browsers to stop tracking my passwords. Read more.
5. Stop using iCloud to sync your iPhone data with your desktop and laptop data; replace it with wi-fi sync. (Done.) If you must use a smartphone, and if (like mine) it’s an iPhone, then at least stop putting all your precious data on Apple servers, i.e., on iCloud. It’s very easy to do. After you do that, you can go tell iTunes to sync your contacts, calendars, and other information via wi-fi; here’s how.
6. Take control of my contact and friend lists. I’ve been giving Google, Apple, and Microsoft too much authority to manage my contacts for me, and I’ve shared my Facebook and other friends lists too much. I’m not sure I want these contacts knowing my contacts and friends, period. I don’t know what they’re doing with the information, or who they’re sharing it with, really. Besides, if my friends play fast and loose with privacy settings, my privacy can suffer—and vice-versa. So I’m going to start maintaining my own contacts, thanks very much, and delete the lists I’ve given to Google and Microsoft. I’m glad I’ve already stopped putting this information on iCloud.
7. Stop using gcal. I just don’t trust Google with this information, and frankly, gcal isn’t all that. I mean, it’s OK. The only inconvenience is that I’m going to have to tell my workmates I don’t use it, but that they should put my name in without my email address, and I’ll add the appointment to my own calendar. This will involve installing a calendar app on my phone (I don’t want to keep using Apple’s) and figuring out how to sync my calendar data without the cloud, so I still have up-to-date copies of on all my devices.
8. Switch to Linux. (In progress.) I’ve been using a Linux (Ubuntu) virtual machine for programming (and a fair bit of other stuff) for a while. Linux is stable and usable for most purposes, and while it still has issues of one sort or another, on balance those issues aren’t nearly as severe as those associated with using products by Microsoft and Apple. When necessary, I can use my Mac laptop and will continue to maintain a Windows partition, e.g., for when I need to use Camtasia. But I’ll soon (finally) be putting Ubuntu on a partition on my workstation and switching to that as my main work environment. Linux is generally more secure, gives the user more control, and most importantly does not have a giant multinational corporation behind it that wants to take and share your information.
9. Nail down a backup plan. (In progress.) If you’re going to avoid using so much centralized and cloud software, you’ve got to think not just about security but about backing up your data. I’ve got a monster of a backup drive, as well as backup software and knowledge of how to use it, but what I don’t have are excellent habits to use this stuff regularly. I don’t even have regularly-scheduled backups, which I really should do. But really getting my old files organized, especially if I want to keep copies of my old emails instead of relying on frickin’ Google to do it—and doubly so if I want to download my old gmail stuff, or even (gasp) not use a cloud storage service at all.
10. Stop using cloud storage. “Now,” you’re going to tell me, “you’re getting unreasonable. This is out of hand. Not back up to iCloud, Google Drive, DropBox, Box, or OneDrive? Not have the convenience of having the same files on all my machines equally available? Are you crazy?” I’m not crazy. You might not realize what is now possible without the cloud. If you’re serious about this privacy stuff and you really don’t trust big tech anymore—I sure don’t—then yeah. This is necessary too. One option is Resilio Sync, moving files between your devices via deeply encrypted networks (via a modified version of the BitTorrent protocol), with the files never landing anywhere but on your devices. Another option is to use a NAS (network attached storage device), which is basically your very own cloud server that only you can access, but you can access it from anywhere via an encrypted Internet connection.
11. Nail down a social media use policy. Maybe quit some for good, really this time. (In progress.) I’m extremely ambivalent about my ongoing use of social media. I took a break for over a month (which was nice), but I decided that it is too important for my career to be plugged in to the most common networks. If I’m going to use them, I feel like I need to create a set of rules for myself to follow—so I don’t get sucked back in. I also want to reconsider how I might use alternative social networks, like Gab (which has problems), and social media tools that make it easy both to post and to keep an easily-accessible archive of my posts. One of my biggest problems with all social media networks is that they make it extremely difficult to download and control your own friggin’ data—how dare they. Well, there are tools to take care of that…
12. Study and make use of website/service/device privacy options. (In progress.) Google, Apple, Facebook, Twitter, YouTube, etc., all have privacy policies and options available to the user. It is time that I studied and regularly reviewed them (as I have done only with Facebook and a bit with Google), and put shields up to maximum.
13. Also study the privacy of other categories of data. Banking data, health data, travel data (via Google, Apple, Uber, Yelp, etc.), shopping data (Amazon, etc.)—it all has unique vulnerabilities that is important to be aware of. I’m not sure I’ve done all I can to lock it down. So I want to do that.
14. Subscribe to a VPN? Websites can still get quite a bit of info about you from your IP address and by listening in on any data that happens to be unencrypted via your web connection. VPNs solve those problems by making your connection to the Internet anonymous. The big problem with VPNs, and the reason I probably won’t do this, is that they slow down your Internet connection. They also add new complexity to your life (e.g., if you get the wrong VPN, you might not be able to connect to some services, like Netflix, through the VPN). But it’s a great step to take if you’re serious about privacy, if you can get around or handle the slowness problem. A nice fallback is the built-in private windows in Brave that are run on the Tor network, which operates on a similar principle to VPNs.
15. Figure out how to change my passwords regularly, maybe. I might want to make a list of all my important passwords and change them quarterly everywhere, as a sort of cyber-hygiene. Why don’t we make a practice of this? Because it’s a pain in the ass and most people don’t know how to use password management software, that’s why. Besides, security experts actually discourage regular password changing, but that’s mainly because most people are bad at making and tracking secure passwords. Well, if you use password managers, that part isn’t so hard. But it’s also because we really don’t have a realistic plan to do it. Well, I’m going to think hard about making one and, maybe, try to follow it, making use of whatever automated tools are available (such as this).
16. Get identity theft protection. (Done.) After my phone was hacked, I finally did something I’ve been meaning to do for a long time—subscribe to an identity theft protection service. The one I use is LifeLock, and so far it seems to be quite good. If you don’t know or care about identity theft, that’s probably because you’ve never seen weird charges pop up on your card, or had your card frozen by your bank, or whatever. LifeLock doesn’t prevent these issues by itself, but it does make it a lot easier to deal with them if they happen.

What have I left out?

Are you going to join me in this push toward greater privacy and autonomy? Let me know—or, of course, you can keep it to yourself.

Protected: A Free Speech Credo

Jump-Start Your Online Classroom: Mastering Five Challenges in Five Days

The Global Education Movement: Narratives of Distinguished Global Scholars

In a Classroom of Their Own: The Intersection of Race and Feminist Politics in All-Black Male Schools

The Room Is On Fire: The History, Pedagogy, and Practice of Youth Spoken Word Poetry

Getting to Where We Meant to Be: Working Toward the Educational World We Imagine/d

The Possibility of Promotion: How Race and Gender Predict Promotion Clarity for Associate Professors

This study of associate professors at four-year higher education institutions uses national survey data to predict the degree to which associate professors are clear about their prospects of promotion to the rank of full professor.

The (Mis)representation of Enslavement in Historical Literature for Elementary Students

This study analyzes historical portrayals of enslavement in 21 recently published books for elementary students. Informed by critical race theory, our findings suggest elementary teachers will be presented with a more complicated set of options when selecting among historical children’s literature than previously documented by researchers.

Reproducing Sports Stars: How Students Become Elite Athletes

Drawing on 47 life history interviews with Division I student-athletes, this paper questions the extent to which college sports offer meritocratic mobility. Findings reveal a sports-track-to-college pipeline and a correspondence between White middle-class communities and greater access to elite universities via athletics.

Social Sources of Teacher Self-Efficacy: The Potency of Teacher Interactions and Proximity to Instruction

This study integrates social capital and social cognitive theories to frame an investigation of the social sources that contribute to teachers’ self-efficacy over time, and explores how social interactions that vary in their relationship with and proximity to instruction influence teachers’ developing self-efficacy.

“I Know I Have to Work Twice as Hard and Hope That Makes Me Good Enough”: Exploring the Stress and Strain of Black Doctoral Students in Engineering and Computing

In this research, we found that Black PhD students and postdoctoral researchers in engineering and computing departments framed the stress and strain of their STEM doctoral experiences through the lens of race. Their experiences in these settings not only led them to question their abilities and fit within their doctoral programs but also gave them the sense that they had to work twice as hard as their non-Black peers to survive the doctoral program.

Discourse Within University Presidents’ Responses to Racism: Revealing Patterns of Power and Privilege

Utilizing a critical discourse analysis framework, this study assesses the language conveyed in university presidents’ responses to racism at several predominantly White institutions and how their responses reveal larger patterns of social power and privilege. By informing the conversation around how those in power respond to racist speech, this research presents several implications for the ways in which universities can be more responsive to marginalized student communities.

Revamping edTPA or Considering Other Alternatives

This commentary argues that edTPA should be modified, or replaced, to produce more fair, equitable, and meaningful outcomes among teacher candidates.

How Do 2-Year College Students Beginning in STEM View Themselves as Learners?

This descriptive phenomenological study explores how 2-year college students participating in STEM classes and programs perceive themselves as learners.

Promoting Inclusion in Education Abroad

(Un)Learning to Teach Through Intercultural Professional Development

Upending the Ivory Tower: Civil Rights, Black Power, and the Ivy League