Teaching Privacy in Libraries: Strategies and tools...3/28/18 2 What we’ll cover lThreat modeling/assessing risk lBest practices and talking points lWeb browsing lOther online activity

3/28/18

1

Teaching Privacy in Libraries: Strategies and tools

https://libraryfreedomproject.org/resources-01/privacytoolkit/

An Infopeople WebinarPresented by Alison Macrina

March 29, 2018

Infopeople is dedicated to bringing you the best in practical library training and improving information access for the public by improving the skills of library workers. Infopeople, a grant project of the Califa Group, is supported in part by the Institute of Museum and Library Services under the provisions of the Library Services and Technology Act administered in California by the State Librarian. This material is covered by Creative Commons 4.0 Non-commercial Share Alike license. Any use of this material should credit the funding source.

About me

https://libraryfreedomproject.org

l Internet activistl Former librarianl Library Freedom Projectl Tor Project

Goals

l Learn how to assess riskl Get familiar with basic digital privacy concepts

and best practicesl Learn privacy tools to teachl Get resources for teaching privacy


3/28/18

2

What we’ll cover

l Threat modeling/assessing riskl Best practices and talking pointsl Web browsingl Other online activityl More resourcesl Questions


Threat modeling

l Assetsl Adversariesl Capabilitiesl Consequences


Threat modeling

l aka risk assessmentl What it isl How you can use itl Let’s try it together!


3/28/18

3

Who are the adversaries you identified?


What do we do?

l We need broad political and technical solutions. l In the meantime, we can take steps to reduce harm.


Talking points

l How do you define privacy?l controll autonomyl Choice

l What are some anti-privacy arguments? (group activity)l eg “I have nothing to hide.”


3/28/18

4


• If data is collected or stored, it can be exploited • If data is transmitted or stored insecurely, it can be exploited• The longer data is kept, the more likely it is to be exploited• Metadata and content are both important• Proprietary software has risks that free and open source software does not (but

no software is perfect)

Basic best practices

l Tell the machines less informationl Or feed them noise (eg AdNauseum)l Desktop > mobile l Software updatesl DeepFreeze or CleanSlatel Data policiesl Chrome as default web browser

l Settings → privacy → turn off tracking


Social media


• Can Facebook ever be used safely? Maybe not.• Does Facebook need to know this about me? • Privacy settings can’t be relied on• Location services – always off• Photos are risky

- Who is in them and what is their threat model?

- What’s in the background?

- Did you remove the metadata (exif)?• Don’t RSVP to events

3/28/18

5

Doxing


l Doxing is the practice of publishing PII without consent, in order to create chaos

l Remove information from data brokersl Don’t give PII to social medial Use strong passwords and endpoint security

Passwords(the biggest vulnerability on the internet)


l Strong passwords are complex, random, and uniquel Use EFF dice method to create a master passphrasel Use a password manager to store all other passwords

l Lastpassl 1Password

l Use 2factor authenticationl Lie to security questionsl Use at least a six-digit pin on mobile


3/28/18

6

Browsing (more) safely

l Problems with web browsersl Best options: Chrome or Tor Browser

l Problems with search enginesl The business model of the internetl Better alternatives exist for desktop than mobile




3/28/18

7

l Keep software up to datel Create a data retention policyl Offer anonymous guest passesl Use a program like Deep Freeze to wipe

machinesl Make Chrome the default web browser

l Settings → privacy → turn off tracking


The web without third-party trackers

Basic best practices



3/28/18

8

l Obscures your real IPl Prevents cross-site correlationl No one can see the websites you visitl Blocks fingerprinting, cookies, scriptsl Writes nothing to disk


l Orbot and Orweb: free Tor for Androidl No officially supported Tor for iOSl Onion Browser for iOS is functional if not

official!



A more private search engine:duckduckgo.com

3/28/18

9

l Please download it!l Encrypted texting, calling, video chatl Android, iOS, MacOS, Windows, Linuxl No stored metadatal Totally freel How does it compare to Whatsapp?


Signal

Resources

l EFF’s Security Education Companionl Library Freedom Project: libraryfreedomproject.org/resourcesl Tactical Technology Collective’s Security in a Box:

tacticaltech.org/projects/security-in-a-box-key-projectl DIY Cybersecurity for Domestic Violence: hackblossom.org/domestic-

violence/


Questions?

Alison [email protected]


Documents

Teaching Privacy in Libraries: Strategies and tools...3/28/18 2 What we’ll cover lThreat modeling/assessing risk lBest practices and talking points lWeb browsing lOther online activity