than others...

http://www.popsci.com/technology/article/2012-07/fyi-how-can-i-stop-my-wireless-carrier-spying-me

Some more options that take a little knowledge or help from a techie - run all your browsing from a Virtual PC image, one where you don't save changes to the disk (the virtual disk file is deleted after each session) and also use a third party Virtual Private Network. A lot of you probably have VPNs for your office. You can also buy and install one on your local PC. It will run your sessions through its servers via an encrypted channel. That way your ISP (Comcast, Charter, AT&T) knows you're connected to a VPN but doesn't know which sites you visit - so no records of spending hours on TER and Eros.

Not being an expert, I don't know if LE would be able to get records from the VPN, if they exist, or do the complicated recovery of VPC images. Chances are even if possible they don't have that kind of budget for this kind of offense.

This has to be addressed in two different ways:

Data security: Many modern computers have TPM built in to the motherboard. If you enable TPM at the BIOS and load whatever chipset driver which is needed for the operating system, the data on the hard drive is tied to the computer. On most modern laptops, the BIOS allows a password to be set so that every time the laptop is turned on, it will ask for the password. Unlike desktop motherboards, most laptops' passwords cannot be easily defeated by moving a jumper to CMOS erase position. If someone wants to get at the data and tries to remove the hard drive, the data is encrypted by TPM and is unreadable without the original TPM chip to decode it. This may be crackable if it is handed over to someone at Langley, but I guarantee you that the average donut eating city cops will have no clue in how to do it. To further strengthen the data encryption, you can use whole disk encryption software such as what is available from Symantec. In this case, even if the laptop is sent back to the manufacturer to erase the boot password, the disk data is still inaccessible without the other encrytption password.

Communications security: the is the sticky part. We sat on our hands and let the government get away with unlimited wiretapping without even getting warrants from judges. All the government needs to do is to call the TELCO or ISP and request access to the data going through the routers. If the ISP refuses, the government can scare them with a National Security letter and they will have to comply. VPN technologies will not do anything because first you have to have a VPN ROUTER at a network for you to log on to, and going through the work place VPN for hobbying is just a bad idea. Even if you do go through a VPN, the data between you and the VPN router is encrypted, but the data between the target websites and the VPN router is still transmitted in plain text. This is the case if you set the VPN connection to have all the data traffic routed through the VPN. You may elect to enabled Split-tunneling, which means only traffic going to the work place is going through the VPN. All other web traffic goes directly between you and the target websites. Again, unless all the hobbying websites switch to HTTPS and listen only to TCP port 443, the data is always transmitted in plain text and is subject to Man-in-the-middle Attacks, i.e., eavesdroppping by LE.

Conclusion: we need to covince hobbying sites to use only HTTPS for everything.  On computer security, there are specialized devices which you can build. They have no hard drives and the operating system is on a chip. Everything happens in dynamic memory and when you are done, the data is gone for good. No web history or cookies are ever saved. I can get more information on this if someone is interested. Don't email me because I am not a full member anymore and cannot read private mail.

On the latest iOS for iPhones, you can set a password on the phone and the entire phone will be erased if 5 consecutive wrong passwords are entered. The bad thing is none of the pay as you go disposable phones can do that.

which is EXACTLY why I use Hushmail for my email account and require the receiver ( aka. Client) to set up a password in order to have communication with me.   I am floored by the number of providers who are not set up with a Hushmail email account, but Insist on using the ever transparent Gmail and the such.   Hushmail is user friendly, free and it's easy to explain to your clients WHY it's a good idea for them to set up a password to receive your mail.  I have a 'copy and paste request" that I send to them in my first replies back to them.  **(Any provider that contacts me, I will be happy to send it to you.  Not ONE client has objected to setting up a password.  So please don't think they will.  They appreciate the concern for privacy!!!)**

Besides the fact that the data is encrypted over the cyberwaves.....IF the hobbyist should ever accidently leave his email OPEN....   NO one can Open the email from me unless they know the password the client set up.  If client forgets their password, there is a way to reset it, and they Still can't read that particular email I had sent unless I resend it.  And if you ask for me to resend it because you forgot your password, which has happened a few times, I automatically assume your account has been compromised in some way, and we start over from scratch.     Is it worth the extra security? Yes, it is.    The last thing any of us need is an angry SO trying to set us up.  Right?  

I also offer a SECURE contact form through which a new friend may contact me that does have the HTTPS,  as noted above by the very knowledgeable BolshoiKhui,  which I have included the link in this post. You will see if you click on it, it Will change to the HTTPS.   This secure form is offered when you have a Hushmail premium account. I don't recall the fee for the premium account.  It was a small $ amount.

For your personal computer security, These are two good programs:  The First one is easy to set up and is more Broad.  The second is probably what most of us need.  

Do a search for:
1) True Crypt    
2) Easy File Locker

both Free  

Happy Monday!!!

-- Modified on 12/17/2012 10:25:36 AM

-- Modified on 12/17/2012 10:28:40 AM

-- Modified on 12/17/2012 2:16:27 PM

http://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/

Hushmail is very easy to use and I have to thank Portia for getting me set up with it.

-- Modified on 12/17/2012 2:42:16 PM

Be careful with Hushmail. Even though the servers are physically in Canada, there have been court precedence that US LE was able to obtain records under the USMLAT in which Canada is a signatory. They do keep records of IP addresses and member information for "marketing purposes" so it is not bullet proof, at least in theory. Since the encrypted email can be decoded by Hushmail, they are subjected to actions of the courts. As a business, they will eventually break under pressure.

The interesting thing is if two persons exchange email encrypted with the same algorithms (PGP) with no middleman involved, LE can never prove anything. If LE asks for the decryption key, we can just decline it. We are still protected by the Fifth Amendment, i.e., we have the right not to say or do anything self-incriminating.

There are some important things you have to realize.

First, Hushmail is not secure.  It's simply not.  It's maybe a little better than an unencrypted mail system, but since Hushmail can decode the email, that means they have access to it.  They can simply log your password and they can decrypt it.  Likewise, anyone with a key logger can get your password.

Any encryption system that requires you to enter the password remotely can be compromised.  Only systems that encrypt locally before they send it to the server are secure, and then only if you've seen the code (or someone you trust).

What's more, Hushmail only encrypts mail on their server.  Once it's been opened by another person, you can't control what they do with it.

Second, Private browsing still saves file to the hard disk.  Seriously, it does.  However, it "deletes" them when you close the browser.  What's more, anything on your screen is stored in what's known as "virtual memory", and it's possible for a savvy person to view this file and see things that are stored in memory before the computer was shut down.

This is why encrypting your hard disk is so important.  Many things that say they are secure just aren't, or only secure enough to stop your spouse from spying on you (assuming they're not very tech savvy).

Full hard disk encryption, such as BitLocker or TrueCrypt or PGPCrypt are the only mostly secure methods, and even they can be compromised in certain specific situations (but those are very difficult to achieve).  

Roger that! Any time a 3rd party is involved, you introduced one more point which can be compromised. Hushmail has in fact cooperated with law enforcement in the past and turned over email records unencrypted. PGP encryption is so far uncrackable, but if Hushmail has access to the unencrypted email at any time, you are basically at their mercy. If the US LE requests access at Canadian courts, they may comply in most cases due to the mutual legal assistance treaty Canada has signed with the US. This is why I personally do not like to use P411 either.

There are some good inexpensive solutions for secured web surfing. One of them is running a diskless laptop with Live Dvd such as Fedora. The entire operating system is on the DVD and you can run the laptop without a hard drvie. Just make sure you have enough physical memory for all the running processes.  If you are in maximum paranoia mode, modify the MAC address of your WiFi device with a randomly generated 48 bit number after booting the system. Surf the web at a public WiFi hotspot. This way even if the WiFi access point keeps a DHCP log and web access activities, none of those logs can be definitively tied to your computer. Once you are done, shut down the computer and all the data just vaporized in thin air.