00:00 Hello, I'm Seth Simmons, and welcome to Season 1, Episode 4 of Opt Out. Opt Out is a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Wondering what the difference is between privacy, security, and anonymity, and how the three intersect? How about what a threat model is, and how to develop one for yourself?

This episode, we're sitting down with Nathan from The New Oil to chat about threat modeling, the intersection of privacy, security, and anonymity, and how open source software is central to opting out of surveillance. Welcome to Opt Out, Nathan. Thanks for joining me. Thanks for having me. I'm glad to be here. Yeah, man, I've really enjoyed your contributions as co-host of Surveillance Report. That's how I learned about you. And then after reading through your site, I just knew I had to have the chance to sit down and pick your brain a bit.

Just a lot there that piqued my interest. In case listeners haven't heard about you before, can you tell them a little bit about who you are and what you do? Absolutely. First off, I apologize if you can hear my cat in the background. He just ate and he's telling the whole world. But my name is Nathan Bartram. I consider myself a data privacy and cybersecurity educator and, I guess, content creator. I'm starting to venture into that world. I run The New Oil, like you mentioned, which is a...

Primarily, it's a website that is dedicated to making privacy accessible to non-tech people. And ideally, it's supposed to be kind of a 101 where people can get started in their privacy journey. And as part of The New Oil, I also have a weekly blog, the Current Events podcast you mentioned with Techlore Surveillance Report. And as I mentioned, I recently started doing bi-weekly videos. Perfect. Well, thanks for coming on and let's go and get diving in.

I just want to start off learning a little bit more about you and wondering what was it that woke you up to the need for personal privacy? So, excuse me. So, this is not a long story. Slightly long story. So, I'm learning a lot about personal finance. I wouldn't say I'm a personal finance nerd, but I'm interested in the topic. I was listening to a podcast called Radical Personal Finance, which I recommend. For the record, he gets a little political sometimes.

So, you know, if you're into personal finance, definitely check him out. And this is years ago, he had a guest on who was Justin Carroll, who used to be the co-host of the Privacy, Security, and OSINT show, which is another privacy podcast. They went by a different name back then. But anyways, he was on that episode and they were talking about how to, like, make your bank account really secure and stuff like that. And I just thought he sounded really knowledgeable and really interested.

So, I bounced over to his podcast to start checking that out. And a couple episodes later that I was listening to, the line that really got me was they were talking about how dangerous it is to, like, keep all of your eggs in one basket. Like, for example, if you really use Google and you've got Gmail and Google Search and Google Calendar and Google Drive and just everything Google, they said the defender needs to get it right every single time. But the attacker only needs to get it right once.

And now all your information is out there. And that really hit me. And I was like, oh, man, these guys are right. I'm really not doing it right. And then from there, it just kind of snowballed into what it is today. Yeah, definitely. I've heard you focus quite a bit on security and kind of blending that with privacy and anonymity. It's a hard one. Which I really liked that kind of mix. So I'll jump over to that. What was it that kind of made you think more deeply about the intersection of security, privacy, and anonymity?

And would you mind debbing a little bit into how those three interact in real life? Sure. Well, I think just to comment on what you just said, I think I like to take a security first approach because security seems like a much less, I don't want to say controversial, difficult thing to get people to focus on. Like if I'm talking to somebody about why they need privacy, we'll get the infamous I've got nothing to hide. I'm not doing anything wrong.

I don't care, blah, blah, blah. But when I talk about security, all of a sudden everybody perks up and they're like, oh yeah, I have a friend who got their identity stolen or my mom had her bank account drained or somebody masqueraded as me on Facebook. So I think that's a topic that's much more accessible to people. And then it does, as you said, it intersects with privacy and security. As for privacy, security, and anonymity, you asked me to define those, right?

If I'm remembering that. Yeah, kind of walking through, I mean, you had a really good blog post on your site that kind of walked through what the three are. And then you shared some really interesting combinations between the three to let people understand the real world implications of having one and not the other two or vice versa. Yeah, maybe just a quick intro to how you would define those three. Sure. So I'm glad you said how I would define those because I just want to say up front, this is a really complicated subject.

I've met people online that have written entire papers on this. So it's very complicated. But yeah, how I interpret it, so I interpret it as anonymity is like the most hardcore. It's like nobody knows who you are. Your identity is totally hidden. You're completely, privacy plays into anonymity, but they're not necessarily the same thing. So it's, I think on my website, I called it like privacy on steroids or something like that. Privacy, on the other hand, is it, by definition, it means like secrecy or seclusion.

And the way I define that is it's less about your identity and it's more about controlling information. So anything like a couple weeks ago on surveillance report, I mentioned, because we were talking about John McAfee's recent death, I mentioned that I also have depression. To me, privacy is the fact that I get to choose who knows that. You know, and it's my right to say that on surveillance report and make that public knowledge as opposed to just, you know, having it put out there without my control or taken from me by Google or Facebook or anyone really.

And then security is something totally different, but the privacy and security do intersect a lot. And security is just protection, you know, and I think one example that pops to mind, I'm not sure if I put it on the website or not, but it's like Google. Google has some of the best security out there. Like that's, that's really not arguable is, you know, Google's to my knowledge has never had like a really major data breach, but at the same time you have zero privacy with Google.

They're, you know, they're not going to erase your search history. They're not going to erase your location history. Like they're going to collect all that information usually without telling you, at least not overtly. And they'll protect it, but they're still going to invade it. And you don't really have any control over what information you give to Google when you use those services. Yeah. That, that idea about privacy not being the same as anonymity or pseudonymity, I think is one that I often forget.

I kind of conflate the two or three together into one thing. And that I love the definition from a hacker's manifesto or sorry, cypherpunks manifesto, which is just simply privacy is the power to selectively reveal oneself to the world. Exactly what you mentioned that it's the ability for me to say, I will reveal who I am. I will reveal what I'm doing when I want to, and only when I want to, which is a really powerful thing. I agree. And I think what you said about like getting it mixed up, I think a lot of people do, you know, a lot of people will.

Get really upset with signal. And rightfully so for like requiring a phone number, which is totally valid complaint for the record. But they'll say like, oh, signals not private because it requires a phone number. And it's like, no signals, not anonymous because it requires a phone number. But it's still very private because they don't log any metadata. They don't see your conversations. They don't do any of that. And it's also very secure because, you know, it is repeatedly passed multiple audits and, you know, all that kind of stuff.

So in my opinion, at least. Yeah. And for most people, most people don't necessarily need anonymity in something like that. And like a messenger that they're going to be messaging their friends and family. Anonymity isn't really a big deal. It can become more of a problem in the situations where you want to remain anonymous or pseudonymous and still be able to chat with people in that simple format. But yeah, that's a really good distinction. And I'm curious, what's a common myth about personal privacy that you've run into?

Well, I think the one we've all or many of us have run into is the whole like there's nothing. I have nothing to hide. I don't believe that's true. First of all, like, you know, there's there's a lot of arguments against that. Like, oh, well, then tell me your passwords or like, you know, what's your bank account number? Like we all have something to hide. And that's that's definitely the most common one I see. I think the one I run into a lot. Sorry, my cat's on my desk.

The one I run into a lot that I think is a little less overt or is really kind of unspoken is that I think a lot of people assume that it's harder to be private than it really is. And I guess that kind of varies more of like what level of privacy you're going for. You know, if you're going for like super, super totally off the grid, then yes, that is extremely difficult. But if you're just going for the simple like like the example I used earlier is, you know, it's it's I get to choose who knows about my mental health and who knows about this and that.

And I get to choose what big tech knows about me. I think my personal opinion is that it's not as hard as it seems. So, yeah, especially I think especially depending on your threat model, it can be daunting if you if you're going from this perspective.

10:00 perspective that like I don't want anyone to be able to see anything I do even if they're specifically targeting me which isn't most people's threat model but maybe that's where people are approaching it from um yeah and I think I think that's where a lot of people think about privacy is when you say like I value my privacy then they think that you're uh you know like um I don't know if you've ever seen the show Brooklyn Nine-Nine or if any of your listeners have but uh there's there's this character named Rosa and I absolutely love her because one of her her recurring jokes in the show is that she is a super private person like she's hinted at in one episode that her name's not even Rosa we don't really know and like her uh she's got an apartment in a shell name and like all her neighbors think her name is like Emily Goldfinch or something and totally different personality like she is like the ideal like man I wish I was that private but um you know and a lot of people think like that's what privacy is

is like I have to like nobody can know anything about me and I've got to be super super secret and it's like no it's it's just again in my interpretation and like the the cypherpunk manifesto it's it's about just selecting who knows what about you like you know I I choose whether or not to tell my co-workers where I live my opinions on certain things you know what restaurants I like to go to stuff like that and and in my opinion that's what privacy is is having that control over that information yeah absolutely um and is is there a specific roadblock you've seen people struggle with maybe that's kind of circling back to the same question but something you've seen people struggle to get past when initially approaching the idea of privacy or security I think just acting like that's that's the biggest thing is uh so for example some one thing that I really push to a lot of people is using Bitwarden because you know it's open source audited very secure and like it's way better than using the same crappy passwords over and over on the same websites and uh you know it's so easy

to get people to agree with you like yeah my you know I'm using weak passwords they're really bad I know I need to do better and they know they're like I know I need to do better ones and uh you know now that you tell them like here's the solution it's free it's mobile apps desktop apps web plugins blah blah blah and I'll I'll ask them like a week later when I see them again like oh hey did you check out Bitwarden and they're like nah I haven't gotten around to it it's like oh come on man it takes five minutes you know that's I think personally that's the biggest roadblock is just getting people to actually like act on something and then uh ironically the Bitwarden one specifically every single person I've ever actually managed to convince to use Bitwarden like not even joking every single one of them has come back to me later and been like oh man that that was life-changing like thank you so much I love Bitwarden yeah I switched them uh probably like six months ago I was using InPASS before that um but I've really enjoyed Bitwarden the cross device supports

really really great uh their browser plugins work well is there that's so that's that idea of recommending things to people them seeing the need but not acting on it is there some way that like some tactic you use to try to help prompt people to to push back past that anyways or is that just constantly a struggle of trying to get people motivated to actually take that first step I think um so I I think one important thing uh not to like say that I'm amazing at this or anything you know I'm I'm human I'm imperfect but uh one thing that I really like to do is first of all I like to focus on what people need like that's something I see a lot on uh like specifically like privacy subreddits and stuff is people say with zero context they'll be like how can I get my mom to care about privacy and it's like I don't know your mom I don't know what's important to her like I have one friend who's a parent of three small children and so I send her every single you know like uh as as we recorded this just the other day there was an article about how um there's apps and debit cards

that are aimed specifically at children under 13 to like kind of get them to be financially responsible and think about investing and stuff like that uh those apps are surprise surprise collecting a lot of data so like whenever I see stories like that I send them to her because I know that's what she cares about is like her children and helping them to you know protect their data like she fortunately she sees the value of this stuff and so I I think number one is to figure out what matters to people because what's going to convince one person to do something is not going to convince another person people have different values and people have different priorities and you know I don't have kids so stuff like that wouldn't work on me for example um as far as like pushing them to act on it I almost hesitate to say this because it's a social skills thing I I bug people but not to the point that I turn them off you know like I said like I I won't tell somebody about Bitwarden and then text them that night and be like hey don't forget to check out Bitwarden you know I'll I'll wait a couple

days I'll wait until they say something again you know they'll go to like log into uh or or yeah like they'll go to log into something and they'll be like ah what's my password again I'll be like dude told you gotta check out Bitwarden you know I I look for those little opportunities to like it it's it's a really fine line you know you you got to find that ability to like constantly remind them without beating them over the head with it and I almost hesitate to say that because I know some people that don't know where that line is but uh that's personally that's what I do and you know it something something else might work for somebody else but that I've had a lot of success with that yeah that's a it's a tricky line to walk because like you see you see people who you've recommended things or others have recommended them things and they just haven't taken that first step but yeah you don't want to come off as kind of spammy or uh annoying trying to get them to to move to that but obviously you see the value so I think that's a really good a really good point that you brought up

that you need to figure out what do they value and use that to try to show them like hey here's some specific things that'll be helpful for you with your specific life situation or your values your needs I think that's a really really good point there yeah um just to uh real quick just to add on to that something that else just dropped into my head um if I say something a couple of times and people don't act on it I just kind of leave it alone you know if uh because like you like you were saying you don't want to come off as spammy or overbearing and so it hits a point where it's like you know what they they know where to find me if they're curious if they've got questions like you know I've I've said it four or five times like switched to Bitwarden and I've I've had it happen where uh just recently actually um where specifically with Bitwarden I was like switched to Bitwarden this episode is not sponsored by Bitwarden by the way but but yeah you know I like for for several times I was like switched to Bitwarden switch to Bitwarden and then I was like all right

they're not gonna do it I'm gonna leave it alone and then literally months later they were just like man this is getting stupid I need a password manager what was that one you're always talking about and it's you know it's like hey you know where to find me so yeah yeah that's a great point um the last kind of curveball question what's something that you feel like almost no one agrees with you on uh well fortunately I I don't think I would say that I have any like unpopular views or at least none that I've uh none that I've shared publicly I guess but I I think the thing that I seem to clash with people on the most is the idea that there is no one size fits all with privacy you know I've run into a lot of people who are like hardcore you know if uh you know if if you've got a Facebook account you can't have privacy and excuse me there's you know there's some truth to that but at the same time I view privacy as more of a sliding scale like if you have a Facebook account you have less privacy but if you delete Facebook off your phone that's more privacy than if you still had the

app or you know like DuckDuckGo for example is a little bit controversial in the privacy community and rightfully so I I understand the complaints with DuckDuckGo but like I would rather people use DuckDuckGo as opposed to Google or Bing even though they're DuckDuckGo gets the results from Bing but you know it's it's it's all that like sliding scale it's a it's a spectrum and it's a journey and I I think that a lot of people forget that like you can start and move through things like I started with DuckDuckGo and now I'm on uh C-Rex or search I don't know how that's pronounced and you know it's just it's it's like this technology is a lot like a drug and for some people you can quit cold turkey you can just wake up tomorrow and download Linux and switch to XMPP and self-host your own like Tor exit node and do everything from there and like great that's good for you some people need to be like weaned off of that and I I think that's the thing that I clash with people on the most is that idea of slowly acclimating

people to these privacy services yeah I think that ties in really well with some some content you have in your blog and a video you just released about threat modeling because I think that kind of it dictates where people see that they should fit on that that privacy sliding scale and it kind of helps them to see to see what their specific tasks should be to become more private or to become more secure um so would you mind talking a little bit about threat modeling what a threat model is and then just maybe some simple examples or ideas around uh developing a personal threat model sure so uh threat modeling uh I I believe my definition is it's just a fancy way of saying what are you protecting and who are you protecting it from uh it's just you know makes it sound really cool threat modeling but um yeah it's it's just as simple as sitting down and saying okay I know I can do better and what do I need to do better and and I think the reason that uh that's actually something I've clashed with on other people

before is uh I I think everyone should have a threat model and that doesn't necessarily mean you need to like sit down with a piece of paper and write down every single thing but it it is really important to come up with at least a general idea because I believe it's the EFF says something along the lines of trying to protect yourself from everything all the time is exhausting and quite frankly impossible it's very

20:00 very impractical. And it's really important to prioritize because just because something is really likely doesn't necessarily mean it would be a big deal. Like, man, I should have written down some examples of this. Well, like data breaches, you know, and I don't want to downplay those, but I mean, there's literally data breaches every single week. Like on Surveillance Report, every week we have a data breach section where we talk about some of the big ones that made the news. And, you know, some of them like Facebook for most people, if their Facebook got hacked, it would be really frustrating. It would be a really big deal. But at the end of the day, it, you know, it's not going to cost them a job. It's not going to cost them a relationship. It's not going to make them homeless. But then things like identity theft or like getting mixed up with someone else of the same name. There's a story. I forget the man's name right now, but he was accused of being at the U S Capitol on January 6th and he wasn't anywhere. He was actually in Chicago at the

time. And fortunately he has like receipts and camera footage to prove that. But I mean, you know, that's a situation where he could have easily ended up like losing his job, getting pariahed from his community and things like that. So it's, it's, um, sorry, I feel like I'm kind of rambling. It's, it's really important to, to find that balance between what's likely, but also what has the most consequences because they're not always the same thing just because something is likely that doesn't always mean it has the most consequences. And just because something would be really bad if it happened, doesn't always mean it's likely. And so, yeah, uh, just to kind of sum that up. I think that that's really how I look at threat modeling is figure out what is most likely and what would be the most devastating and then find out how to patch up those weak spots. Yeah. And all those, the specifics around that are so individual, that's not something someone else can prescribe for you.

Like, you know, the things that, that you value and you see as super important. I mean, yeah, for most people, like a bank account, you don't want your bank account to get hacked into and someone steals the money that's in there or something like that. Um, but it could also be like, maybe you're, you have a political ideology that's being persecuted in the country you're in, or you're, you're part of a religion that's being persecuted in the country you're in.

You're going to have a very different threat model because those things could be, that could be life and death, or like you mentioned, it could be losing a job. It could be, uh, breaking off relationship with family or friends. Lots of other things could happen when information is exposed that maybe in another country would be no big deal. Um, so it's definitely something that each person has to figure out, like, what are the things that I value?

And like you mentioned, I think it was a really good point. Like what, what would happen if this scenario happened? Like if this data got out, what would happen? And how does that rank against, like, like I said, a Facebook account or something leaking versus a bank account, or maybe a political or religious ideology, something like that. So it's very, very much personal, but I think very important to at least get a rough idea of, of what your own threat model is.

Yeah. And that's a, um, that's actually one I see in the privacy community a lot is not asking the, like, what, what, what are the consequences if I fail here? Cause I've definitely seen a lot of people, um, like again, I, I get a lot of my privacy interaction from like Reddit, for example, and a lot of people will post and they'll, you know, I'm jumping through all these ridiculous, crazy hoops to like keep from Google sweeping up my IP address, which if you want to do that, that's totally fine. But these people, you can tell they're like, it's wearing on their mental health and they're like running themselves ragged. And it's like, dude, is it really that big of a deal? If, if you accidentally leak your phone location to Google once, like, is it really worth everything you're putting yourself through? Like, you know, and, and for some people it is, you know, a journalist, like for example, a journalist, if they're talking to a very, very sensitive source, then, you know, that one time they leak their location might reveal their

source. But, you know, for most people it's like, man, you got to find, and again, if, if you're doing it because you enjoy it, I think that's totally great. But some people really run themselves ragged and it's like, man, it's the consequences of failure here are not that bad and should probably take a step back and take a breather. Yeah. And it, I mean, it really depends on how much time do you have to dedicate to this? Like how, how much effort can you put in? How much mental strain can you handle to, to gain these things and figuring out like, what are those low hanging, the low hanging fruit that you like absolutely know you need to take care of and focusing on those?

That's a really good point that I'm glad you brought up is I think tech Laura calls it the convenience line, but I could be wrong, but it's basically, and I think that's also something I mentioned in, in threat modeling is like, where do you draw that line of how much trouble you're willing to go through? And that also varies from person to person. Like I'm a very minimalist person. I could absolutely live without any streaming services, but like my partner, for example, she really enjoys, um, especially like anime and, uh, uh, crunchy roll is her streaming service of choice. And it does not seem to play well with a VPN. So that unfortunately, when we got her out, uh, we, we got a DDWRT router and that was something I experimented with was putting a VPN on it.

And that did not last very long because it slowed down all the streaming services and some of them just wouldn't load at all. And you know, it's every person's convenience line is different. And she's, she cares about privacy to an extent, you know, she uses signals. She tries to push all her friends to use signal. Um, she turns the VPN on, on her phone when she's in like public wifi and stuff like that. But yeah, that's, that's like for her, that's where she draws the line. And she's like, no, this is, this is a hobby of mine. This is something I enjoy and I'm not willing to give that up.

So we're, we're going to have to find another way to protect the, the, the router or, you know, that particular part of the network. So yeah, convenience lines are really important and they vary from person to person. Yeah. I crossed a, a similar convenience line. I decided to run a Tor reload Tor relay node from home, not an exit node, but just a relay node. Um, and apparently my ISP decided that anyone running a Tor relay node, even though it's not an exit is worthy of blacklisting.

So I got put on blacklist that made it so that like no streaming apps would let me play any kind of streaming video because they all saw me on the same, the same blacklist simply because I ran a Tor relay node. Um, so that node quickly went away. My wife was, uh, very unhappy with that, that switch, but that was, that was a really weird one. Cause that wasn't even something like I could understand with an exit node. Cause obviously then you could have traffic that breaks terms of service or something like that.

But just a Tor relay node was enough to get blacklisted and unable to stream and lots of other weird little issues, which is an interesting one. I was actually really surprised when I, when I ran my node, um, I'll go ahead and admit it. My, uh, my ISP at the time was Google fiber. And so I called or, you know, contacted them, whatever. And I was like, Hey, I just want to check and make sure I'm interested in running a relay. Is this violate the terms of service? And from what they told me, like all Tor is totally okay. Like I could have run an exit node out of my house and they would have been like, you're totally fine. And I'm like, I did not expect Google to be so on board with Tor, but yeah, we, uh, I, I ran one for a little bit and I honestly forget why I got rid of it, but yeah, that's really interesting. I definitely would not expect Google fiber of all people to be super lax on Tor usage. I didn't expect that either. I totally expected them to be like, Nope, no relays.

Absolutely not. But they were like, yeah, dude, run whatever you want. And, um, but yeah, like that, that is a really good example is, you know, things that, uh, again, like if, if man, I didn't even have any streaming services before we started dating me and me and my partner. So like for me, if they went away, I'd just be like, Oh, okay, I'll read more books. But you know, yeah, for her, it's, it's really big deal. And it's like, Nope, that's, that's one area she draws the line.

Like it can't interfere with that. Yeah. That's another, that's another kind of interesting point. I hadn't really thought about it talked about, but your threat model or the things that, that you can or, or will do to become more private or secure also depend on who you're with. I mean, if you're married, dating someone, whatever kind of situation you're, you're in even could be your friends or roommates that could alter what approaches you can reasonably take to be more private and secure. And it may have to be kind of a team effort to figure out like, where's that, where does that convenience line lie? And how, what are the tools that we can use collectively or that we can use together without kind of breaching one of those barriers? That's an interesting aspect. And I've really thought about before. Yeah. And I'm, I'm, I normally don't think this far ahead down the road, but I've decided that in 2022 for February, I'm going to do like a whole series about relationships.

Cause I see a lot of people posting and asking and yeah, that's, that's definitely something that's been tricky to navigate is I was into privacy before I even met her. And so just, yeah, navigating a lot of that, like, and it's also hard because she's not really a techie person. So trying to figure out, um, I almost have to make decisions for her in the sense that like, I know what I'm trying to protect, but she doesn't really know what she's trying to protect. And so I kind of have to like, and I mean, I don't actually read her mind. Obviously there's a lot of communication that goes into this. I don't assume things for her, but to an extent I have to read her mind and like ask questions and be like, okay, um, how do you feel about this? What do you think about this? And, you know, I have to take into consideration, like if, if I'm going to do something with the router that might break the internet, I should probably do that while she's at work as opposed to like on a weekend when she's trying to relax. And now the internet's down for four hours cause I screwed something up,

but, uh, yeah, that's kind of off topic, but yeah, that's definitely a whole different ball game to navigate is when you're trying to make life work with another person who is either not as technical as you, or just doesn't care as much as you, or for some people just doesn't care at all. And trying to figure out how to protect yourself while also not interfering with them. It's yes, can be a challenge at times for sure. That should be a really interesting series. I'll have to, I'll have to check that out when you go live with that. It'd be a good one.

30:00 for me. Maybe I have to walk through and share around. I'm excited for that. Thanks. Shifting gears a little bit, I did want to touch on open source software because I know you have a pretty big section on your blog talking about why open source software is important and why people should care about it. Do you mention a little bit about why open source software is such a vital focus for you and a vital topic around privacy, security, and anonymity? Sure. So let me go ahead and put the obvious disclaimer. Open source is not perfect. Open source can be insecure. It can be hacked. It can be malware. I mean, technically there's, I forget what it's called, but I know I've heard of it.

It's kind of like a GitHub specifically for malware so that when researchers discover a new malware, they can go ahead and dump it in that website. And now all the other researchers can go ahead and access it and they can run it in their VMs and they can study it and whatnot. So I mean, by definition, that would make that malware open source, but it's still malware. So open source, just to go ahead and put out the disclaimer, it does not mean that it's 100% secure. It does not mean that it is 100% safe. But having said that, I still think that open source is very valuable because of the way that it can help ensure integrity and freedom. So like the example of integrity, Kevin Mitnick in his book, The Art of Invisibility, he talked about, there was a company, I don't think he named who they were, that said they were using, it was like an encryption company like Symantec kind of thing.

You know, we'll, we'll full disk encrypt your stuff. And, um, excuse me, they, they said that, and this is years ago, they claimed they were using 56 bits of encryption and he basically hacked into their, their proprietary source code and found out they were only using 30 bits, which, uh, I'm, I'm not a programmer, but if you put that in like password encryption, that is two seconds versus 25 days in order to crack that. So, yeah. And, and it's just like that, that, you know, and nobody like, uh, like I said, I'm not a programmer, so I can't verify this stuff myself, but when I use open source, I'm hoping and trusting that other people have verified this and maybe they have, maybe they haven't. But when you're talking about something that's totally proprietary, that all just goes out the window. You know, nobody can look at it except, you know, whoever they've approved to look at it. And who knows what the relationship there is, who knows what the expertise is there is, who knows if that person showed up that day and didn't have their coffee. So they missed something just, you know,

humans make mistakes. And, um, but then it's, it's also like to touch on the freedom part. It's also about the ability to modify it. Like, uh, you know, session is a really good example. Like they took signal and they were like, this is good, but this could be better. So let's make our own version and build on that. And, uh, or, you know what, like what's going on with audacity right now, like as we record for listeners who don't know, um, audacity has changed their terms of service to basically say that we will collect user data, uh, certain types of user data in certain situations.

It's very controversial. Some people are okay with it. Some people are not, but because audacity is open source already, people have taken that and removed all that telemetry. And now here's my fork of audacity. And just to have that freedom to do that, it's, uh, I, I forget who said it, but you know, some famous scientist, I think it was, um, I think it was Stephen Hawking. He said, uh, if I have accomplished anything, it's only because I've stood on the shoulders of giants and just that ability to stand on the shoulders of giants and build on what they've done. And to be able to do that instead of just being locked into that one ecosystem where you can't improve, or if you want to improve, you have to rebuild the wheel from the ground up. Or again, like with audacity where you say, well, I don't agree with what they're doing. I'm just going to go in a different direction. And it's just, you know, open source, just it. And again, you know, not perfect, but it just, the opportunity is there that it can be such a powerful tool to give us like that freedom and

that integrity back that we just don't get with proprietary software. Yeah. I think that's an, it's an excellent point that it allows for people to take things and make them either better or just more specific to their own use cases. And we've seen that with so many pieces of software that came from popular products that were also open source or that also open source pieces of themselves. And then we're rolled into other good privacy preserving useful product product. Yeah. Products like, I mean, for instance, the Chrome browser, which is from the Chromium project is open source. And so there are great projects out of that, like Brave, like un-Google Chromium. And it allows a lot of other people to build browsers that fit their specific needs and the specific use cases they have and their ideas around privacy. And it allows for that, even though like, obviously, I mean, none of us would recommend, at least none of us in the privacy community would recommend using Google Chrome because of all of the inherent Google issues there. But

there's a lot of great stuff in the actual Chromium code. There's a lot of great stuff in the engine that Chrome uses for web browsing. And so people have been able to pull that out because it's open source, instead of having to start from scratch, they're able to grab that, make something that is more applicable, more privacy preserving and build really great products on top of that. That's really the idea of forking is a really fascinating one and one that's really led to a lot of great projects that maybe, not even maybe, that probably would never have existed if the original thing was closed source and never shared. So that's a great other aspect. I think people usually focus on that security side of hopefully people who know what they're doing have reviewed this and verified, which I think is generally true. But it also is helpful to have people around you that can do that verification, whether that's in a community where you have people that you've trusted and talked with for a long time that you know they know their stuff when they're looking at code. But it is definitely

helpful to know that that code is out there, people have reviewed it, and that should bring more safety. But your caveat was very important. Open source software is not just a silver bullet. It's not it's not perfect. There can be issues, there can be exploits against open source software, there can be lots of problems around that. But generally, it's better. And I think generally, the ideology of the people behind open source software better aligns with people who are privacy and security centric, which helps because a lot of times the products are a better fit for people who are caring more about privacy and security.

Yeah, I feel like, not like I've looked at every open source project out there, but I feel like it's pretty rare to see an open source project that's like, "Oh, by the way, we're going to collect your first name, your last name, your date of birth, your mother's maiden name, every single device on your network, every time you ping the network every 30 seconds." You know, just all the crap that other softwares collect. Like you rarely see that in open source because like you said, their ethos fits so much better with the community. They're like, "I want to make this really cool tool to solve this problem." Like I see that in the privacy subreddit all the time. People will post and be like, "I made this thing because I was having a problem and it occurs to me that other people might like this.

So here's the GitHub link, have at it." You know, and it's just really cool to see that kind of camaraderie and community, you know, that looking out for each other like that. So yeah. Yeah, I will add the kind of a key thing that I think a lot of people forget is things that are privacy centric also generally don't collect a lot of data about how people use them or about the issues people have. And so a really key thing for people using free open source software is to report back issues, report back feature requests, report back ideas that you have for how to make the thing better.

Usually that's going to be in GitHub via issues that could be a bug report or feature requests or something like that. Different projects will have different ways of actually tracking that. But because they're not recording this data from everyone who's using the product generally, it's really important for people like you and I and listeners to make sure to give back to those projects that they love and give them information. It doesn't have to be stuff that's de-anonymizing or that tells them who you are. It doesn't need to be like personal info. But just giving them problem reports, giving them ideas that you have for how to make the product better, putting in feature requests, being a part of discussions about feature requests, that kind of thing is really, really helpful. So I think that's a thing where people who do make the move to using open source software, it's a way you can contribute and say thank you for them not collecting your data against your wishes by giving them back the core pieces of data that are helpful so that they can

build a better project, a better product for you. Yeah. And just to add to that, if you're like me and you're not a very technical person, I've had pretty good experience with like, I'll open an issue and I'll say, you know, like, here's what I'm doing. Here's all the information I can think of. And I'll put at the end, I'll be like, I'm happy to share like whatever other information you need, like any logs or anything. But for the record, I'm not very tech savvy. So you may need to tell me how to find those logs. And, you know, eight, nine out of 10 times, people will be like, hey, can you post this log? It should be, you know, C slash user slash whatever, whatever, whatever. And they'll tell you where to find it.

And, you know, so people are, you know, if you're willing to, to contribute like that, and you say, like, I'm willing to help, I just don't know where it is, like more than often than not, people will be willing to walk you through that and help you do that in my experience, at least. So yeah, absolutely. I mean, in my time working for, or working on open source projects like Monero, if someone is willing to put in the time to open an issue that gives a lot of good detail, usually follows like a template or something, and then it's communicative, like that is, oh my, that is like, that is so helpful to the developers behind a project.

It's so rare to actually get that. So if you're willing to like, you find an issue, put in the time to open the issue in GitHub and put in all that detail, even if you're not tech savvy, even if you don't understand like how to get all these technical logs,

40:00 they will be generally more than happy to help you figure out how to do that because you're providing them so much helpful information that they wouldn't have gotten otherwise. So that is definitely, it's a huge, huge blessing to the people building these tools. Yep. We talked about a little bit about Chromium Chrome browser, and I just wanted to get your thoughts around privacy preserving browsers and plugins. It's again, it's something you talked about in your, in your blog is one of the most important ways that you can protect your privacy and security is choosing a good privacy preserving browser, installing a few basic plugins. And I was curious if you have some recommendations around how to choose a browser and then maybe what plugins you recommend people use and why those stand out to you.

Oh man, I'm really going to irritate a lot of people with this. This is a divisive topic for sure. So have fun with this one. Yeah, it's cool. I get this a lot. No, so, so first of all, so the reason just to give some, some background for anyone who hasn't read the website, the reason I say that like your browser is really important is because there's generally, there's generally two ways that people interact with the digital world, which is either their phone or their computer and on phones.

And I do talk about this on my website. I really encourage you to, um, you know, Henry calls it digital minimalism is, you know, uh, use as few apps as possible. Uh, personally, I try to use my phone as little as possible. I don't have any evidence of this, but I'm fully tinfoil hat convinced that Apple can see everything I do on my phone. I use an iPhone. So I just like literally if I get a signal message and I have signal open on my computer, I'll respond on my computer. I won't text back on my phone.

Um, so yeah, I, I encourage people use your phone as little as possible. Uh, you know, if you're going to the grocery store, just write down a list. If you're going to a friend's house and you've been there before, just leave your phone at home. I I've actually done this frequently. And it, in my opinion, it makes like, you know, whatever social event you're going to that much better. Cause now you're not messing with your phone and stuff like that.

But yeah, just creating that small phone footprint, but, um, focusing specifically on computers. The reason I think browser browsers, excuse me, browsers are so important is because with a phone, you've got a lot of apps you shouldn't, but you generally do with a computer. You have very few apps. Like I've never met anyone who has the Netflix app, even on a windows device. Like they don't have the Netflix app. They don't have the Twitter app. They go to netflix.com.

They go to twitter.com. And so their browser really becomes almost entirely their gateway to the internet. And so by choosing a good browser and plugins, you can really get a lot of protection for very little effort. Um, and then one more quick caveat on that note, you know, there's a difference between privacy and security. So when we're talking about online security, the best security thing you can do is probably to use a password manager, use online or use a different passwords on every website.

Things like that. But as far as privacy or privacy browsers, will, uh, these are the kinds of changes that will really help with your privacy. Um, now getting to your question, what browsers do I recommend? Here's, here's the fun part. I recommend either brave or Firefox and 45% of people are now screaming at their phones because I said, Firefox and 45% are now screaming at their phones. Cause I said brave and 10% are screaming because I didn't say, you know, LibreWolf or, uh, water Fox or bro might or whatever.

Um, so the, to those 10% of people, number one desktop, number two, uh, I actually use LibreWolf. The reason I don't recommend most forks is because most of them either a are really slow to get updates or B, uh, don't auto update. Like that's, that's my one ding against LibreWolf is it doesn't auto update. And the average person is not going to remember to check for updates. Like they don't want that. They want something they can just download and go and not have to worry about it.

So, uh, that's why I go with Firefox and brave. And between the two of them, I honestly really think it's personal preference. Like both of them as companies, they really have questionable things they've done in the past that, uh, you know, to, to their defenders, it's like, Oh, those were honest mistakes to their critics. They were, you know, proof that they're an evil company and it goes both ways. Both of them have done that. And then, uh, you know, same thing with like the actual privacy benefits, like brave out of the box studies have repeatedly shown that it is the most private browser in terms of like telemetry and stuff like that.

And it also has really cool features. Like, you know, it randomizes your fingerprint every time you use it. But at the same time, those are all things that you can get with Firefox. You just have to put in the work. So, um, I, I guess if I had to like sum it down, I would say if you want something that's like ready to go out of the box, I would say brave. But if you don't mind tinkering with it and you want more of a focus on privacy, then I would say Firefox.

As for the plugins, uh, the biggest one in my opinion is you block origin. I have repeatedly found that one to have like the best block list. It blocks ads. It blocks trackers. Uh, if you put it in advanced mode, you can even block JavaScript. Like it, that one's really, really powerful. Sorry. I heard my cat knock something over. And then, uh, the next one I use is called clear URLs. And the, so that one, the most noticeable thing it does is it removes tracking links.

So if you see something cool and you're like, oh, I want to send this to my friend, you can copy the link and send it to them. And nine out of 10 times, it's going to remove that tracking link, which is, you know, great for privacy. The thing I found out, uh, recently that I didn't know before is it also removes those tracking links for you. So if you click a link on a website and it normally has that tracking link, it'll get rid of that for you.

Um, and then the last one, uh, fair warning. I've occasionally had some breakage with this. Not so much recently. It seems like they've, they've really gotten a lot better, but it's local CDN, which is a, uh, going back to open source. It's a fork of decentralized. It just gets updated more frequently. And what that does is there's a lot of third party, uh, libraries out there that help developers to build apps and websites a lot faster without having to like, you know, write their own JavaScript and stuff like that.

And so what local CDN does is if it detects any of that, it will try to switch it out with a privacy respecting version of that library to prevent tracking. And honestly, those are really the only three that I use, uh, these days, Firefox and brave both have like automatic HTTPS. Um, I think Firefox is now rolled out like a cookie isolation that replaced like cookie or a Firefox containers, which I used to recommend on my website. So yeah, just all that, I, you know, minimalism, keeping it really simple and trying not to have too many plugins.

Cause also you, something else I learned recently is plugins basically run in your browser with admin privileges, like to put it in simple terms. So the more plugins you have, the more privileges, the more different companies and apps you're giving this really, really powerful permissions to. So, I mean, the less you use the better. And those are the three that I use. There's, there's some others that might be right for some people, but those are the three that I think like everybody should have in my opinion.

Yeah. The, the clear URL one, I had not seen or heard of that one until I was reading through your blog. And that one I started using since then. I really liked that. Cause that's a, that is a hard thing to get around. There are so many, I mean, ref links, like I'm generally fine with those. If like the person I'm reading, I actually trust and care about, cause obviously I want them to make a little bit of money just for me going and buying a product that they recommend.

But there are so many shortened links, tracker links everywhere. Everyone uses them. Um, and even going from emails is specifically bad. They're almost always serious tracking links. Um, so using something that just natively replaced those is, is really, really nice. So I've been using that one. That one was a game changer for me. Cause you know, and on my, uh, my newsfeed that I post every day, it's basically just a list of articles that I found interesting that are like relevant to privacy and security.

And, you know, I, I use a lot of websites like, um, slash dot just has ridiculously long tracking links and clear URLs just clears those out right away. And it's like, oh, you're saving me so much time in deleting all these tracking parts of the links. So yeah, for me, that one was super helpful. Yeah. The sharing part is one that guy, I haven't noticed yet just cause I don't think I've shared any links out of a browser since I installed it. This was just like two days ago, but that one's always a pain in the butt.

Like you, you grab some link and paste it into like signal or something. And it's like a 600 character long URL. Cause it has 87 different tracking things. And it's, it's ridiculous. So how far are we going? I kid you not. One time my brother sent me a Facebook link because he wanted to like show me a video or something. And I kid you not. It was two lines of actual link. And I forget the exact number. I want to say it was anywhere between 12 and 18 additional lines of just tracking crap.

Absolutely insane. Absolutely insane. Yeah. And I pointed that out to him. I was like, I'm not mad at you. I'm not yelling at you. I just need to know how insanely stupid this is. Yeah. It was a wild. I need to go back and like screenshot that and share it as a blog. I used to have a blog post about tracking links. I don't know if I still do. And if I don't, I need to redo it. So I don't think I stumbled upon it, but I'll have to have to double check as well.

What are some of the other tools that you use regularly to opt out that you'd recommend others take a look at and why? Okay. So I am far from from perfect, but I have definitely opted out a lot and I'm really proud of that. So like some of the day to day stuff I use, I usually use Linux as my daily

50:00 driver. I do use Windows for production and gaming. I have a Linux router, DDWRT. I use, you know, ProtonMail, ProtonVPN. But I mean, some of the ones that have been the most helpful for me personally that I would definitely recommend others look into. We talked about Bitwarden. I also use KeePass. So the way I do it, I go a little more hardcore than most people. I use KeePass for all of my personal stuff. And then I use Bitwarden for either things that I have to share, like with my partner, you know, like the Netflix login, for example, or the things that I just, I need to sync between devices. Like I think my matrix login is on Bitwarden just in case I ever need to log in on a new phone or something. There's, of course, there's two factor apps, which I think I'm doing a review of later this month. Personally, I've been experimenting with Ravio lately. That one's really good. I am fortunate enough to, when my partner got a new computer, I kidnapped her old one and turned it into a Nextcloud server. So I've been using that for like

contacts, calendar, like a drive to sync things between Windows and Linux. I think my pseudo is kind of a controversial one. Unfortunately, I think it only works in Canada, the UK and the US, but it's a voiceover IP. I pay for the maximum. It's like 150 bucks a year and I get nine different phone numbers. And so I have like, one is for work. One is for The New Oil. One is for like personal friends and family. One is for like my bank, my doctor, stuff like that. That one is really been super, super helpful. And I also have a couple that are just like set aside burner numbers. So like just the other day, actually, I bought a, uh, uh, some online books and I'd never bought from this place before. So they were like, Hey, we need to text you a verification code. And I gave them one of my, my pseudo burner numbers and they texted me the code and I put it in and everybody was happy.

And you know, whenever that number gets too cluttered, I'll just go ahead and delete it. So I definitely recommend that one, but yeah. Uh, and let's see, the last one I have written down here is SimpleLogin. If anybody hasn't heard of that. And also AnonAddy is a good one too. That's like their competitor. They're a, an email forwarding service. So I can like, you know, if I want to sign up for a newsletter, I can make an email for them. And if they ever sell it, I can just delete it. And now my inbox does not get flooded with spam constantly. It's super awesome.

It's interesting. I think every guest I've had on has mentioned Nextcloud in one way or another. I, I, the, the combination of things you get from Nextcloud is just so important, especially if you're for switching off of like Google services, because you can replace Google drive, contact sync, uh, photo sync, um, calendar. There's so much you can do with that. So that's definitely, I was going to say, I, I know I'm not even using probably half of what Nextcloud can do.

Like I just found out recently it has an RSS reader and I didn't know that. Like, yeah, I just use it for real simple, like contacts, calendar drive photos, but I, I'm sure it can do so much more. Yeah. And it's tons of plugins for extra stuff on top of that as well. So it's definitely a great one. I I've been wanting to check out my pseudo. I haven't gotten around to that yet. Um, that was something that Henry mentioned in the first episode of opt out.

And it's one that I've been wanting to get around to cause I, I hate giving out my phone number and there are so many services that require it for absolutely no good reason. So it'd be great just to have a burner one that I can toss out and throw away every year or so, or every few months. Yeah. It's, it's fantastic. I love it. SimpleLogin for email serving the same purpose. Oh my goodness. That's been, that's been amazing to switch to. I switched to that. I've talked to Henry about that in episode one and, um, started switching over all my services to aliases. It's nice to have, like you can have pinned aliases for like key ones that you want to share and reuse, or you can just generate random ones to throw away or use one time. That's there. It's such a helpful service that's made cleaning up my inbox so much easier. And this is just like the beginning. So when all of these services, some of them have issues in the future or sell out to some marketing mailing list or something so much easier to just disable that alias rather than having to worry

about filtering to spam or something like that. A quick tip about both SimpleLogin and AnonAddy, something I didn't know for a long time is, uh, if you pay for the premium versions and you have a custom, uh, domain name, if it, uh, with AnonAddy, it does this automatically with simple login, you need to activate it, but it still does this. That domain name can become a wildcard email. So like, let's say you're out at, you know, Petco and they're like, Hey, if you sign up for our, you know, mailing list, you'll get 10% off. And you're like, yeah, sure. Why not? You can just make up like petco at my domain.com. And it'll automatically, as soon as they send you that email, it'll create that email address automatically. And I didn't know that for the longest time.

And when I found that out, I was like, Oh my God, I've been missing out on so much. Wow. Yeah. I had looked into adding a domain, but I didn't realize that that was something to do with that. I thought it was something where like, you would have to go make the email address still and then give it out. But if I can just tell someone whatever, and it automatically works, that's going to be pretty awesome. I'll have to explore that. And that's, that's how I found that out is because I like made one up on the spot and I was just like, in the back of my head, I'm like, I'll just make it when I get home. And then 30 seconds later, I got the ding on my email and it's like, welcome to the mailing list. And I was like, holy crap. That's so cool. That is an awesome feature. I'll have to explore that.

Yeah. It's really cool. Uh, and the, so the, the landscape of technology and privacy and security in particular is constantly shifting. There's so much change, so much news, so many developments and false projects. There's so much stuff like that. Is there a specific thing that you recommend or tool that you recommend or resource you recommend for keeping up with that shifting landscape and trying to stay on top of those things? Uh, so this is actually, I think I just wrote a blog post about this. Um, the biggest thing that I do is I use RSS, which stands for, I believe it's really simple syndication or something like that. And it was, man, it was all the rage back in like the early two thousands. And these days, these days it's not so popular, but it's still widely supported. Um, so it's really easy. Like this is a really good trick for like news too. Like if you're like, man, I would love to quit Twitter, but that's where I get my news.

If you go to like a, like BBC news, for example, if you just go to your search engine, that is hopefully not Google and type in like BBC news, RSS. Um, because RSS is not so popular nowadays. I've found that a lot of websites don't really promote where it is on the front page. So it can be really frustrating to try and find it. But if you search for it, it usually takes you straight there, like BBC RSS. And it's usually the first link and you can subscribe to that and you can use, um, I'm sure there's more of them out there. Well, there's Nextcloud we just talked about, but like Thunderbird does it. And there's also, I think it's called like tiny, tiny RSS. Uh, those are the only three I know of, but I'm sure there's others out there, but yeah, it, it basically creates a, uh, for those who don't know, it creates like a, it basically like pings the website.

However, often you tell it to like every five minutes, every 10 minutes, every hour, whatever. And then it pulls the latest content and drops it right into a section of your inbox. Like it doesn't actually email you, but it drops it into your RSS reader. And then you can scroll through it at your own pace. And this is really helpful because now you're not like going to the website and loading all the JavaScript and the tracking cookies and all that. But it's also really good because you know, you're, you're getting around like the algorithms of Twitter that are choosing what to show you and when, and yeah, like, like I said, most websites support it. That's mainly what I use. I've got like a bunch of different websites I subscribe to for technology and privacy and security.

And then, um, there's several podcasts I listened to. Like I've, you know, I've subscribed to yours. I, uh, I listened to the privacy security and OSINT show. I listened to security in five. Um, there's probably a couple other ones I'm forgetting. And then of course, whenever I'm unsure, I just, you know, I, I find a good community like tech laws, matrix room. They're really good. And I'll just ask questions like, you know, Hey, I've been seeing people talking about this.

What are everybody's opinions? You know, what do you guys think of this service? Yeah. So those are the main ways I, I stay up to date as best I can. And even then stuff still slips through the cracks, but you know, such as life. Yeah. RSS is one that I've been wanting to get into more and just haven't kind of gotten around to. Um, but it's a, it's a really nice way to, to keep up with everything. And, uh, I think also for Twitter, if you want to RSS feed, follow people, you can actually do it through knitter, which is a privacy preserving Twitter front end. Uh, they have RSS feeds for individual users. So you can actually subscribe to specific users and build kind of your own RSS feed of Twitter, of the people that, that you care about again, with bypassing all of the algorithms around what you want to see at that time or what Twitter thinks you should see or shouldn't see that kind of thing, which is a really nice feature. I haven't done that myself yet, but I've, I've heard of other people doing that. It seems like a nice way to keep up with Twitter or other social media.

Yeah. If, uh, not, not to like steer traffic away from your podcast, but if, if you or your listeners are interested, like that's what my latest blog post is about is, uh, well, depending on when this comes out, it might be the second latest one, but yeah, that's a Saturday, July 3rd. That's what that one was, was about how to stay informed without big tech. And that I had like a whole section about, here's how to subscribe to Twitter's. Here's how to subscribe to subreddit. Here's how to subscribe to YouTube channels all through RSS. And yeah, it's I'm, I'm with it's, it's been super nice to just, it can be a little overwhelming sometimes, you know, you like throw up your, your RSS reader for the first time in the day and like, oh, here's 57 articles you missed overnight about everything.

And it's just like, oh no, but it, it, it is really nice to, to feel informed. And I will say, um, not, not really privacy related, but like news related in general, you do kind of have to go out of your your way to get

1:00:00 opposing viewpoints if that's something you're interested in. Because no longer will it be like Facebook is showing you your racist uncle posting Breitbart. But not that I encourage people to subscribe to Breitbart's RSS, but you know what I mean? You have to be more intentional with what you're subscribing to because now it's basically on you to go find that news. That's a really good point. Echo chambers are a lot easier if you're curating things that tightly like you would be generally for RSS feeds, which is something that everyone has to be careful about.

Thank you. That's what I was trying to say. Thank you. And what advice would you give someone who's just starting to realize the need for personal privacy? So the two biggest things, first of all, we already said one size does not fit all. I firmly believe that privacy is a spectrum. And I think the other thing is just to kind of like go at your own pace. Like I'm one of those people. I'm really passionate about this. I really enjoy this. Like I enjoy the challenge of it.

And so when I moved to a password manager, I did that really insane thing where I sat down in one afternoon and spent like four hours like going through every single account and changing all my passwords and making them all unique. But, you know, not everyone has to do that. You can go at your own pace. And whether that's, you know, okay, next time I log into Amazon, I'm going to change my password. Or next time I log into ProtonMail. Well, hopefully if you're using ProtonMail, you already know that you need a good password.

But, you know, like you could do it one at a time or you could do it step by step. You could say like, okay, this weekend I'm going to change my passwords. Next weekend I'm going to, you know, research VPNs or whatever the case may be. Like you don't have to do everything all at once. And it's okay to change your mind. Like, you know, if you start off using, say, ProtonMail and then for whatever reason you're like, you know, I don't think they're right for me.

I want to switch to Tutanota or C Templar or Mailbox or whatever. Like that is also totally okay. Like you don't have to stay married to the first service you use or the first strategy you use. Like you're going to fail. You're going to find things that work. You're going to find things that don't. Things that need tweaking and, you know, just take it one step at a time, man. It's an ever-evolving journey, you know. That's a common thread through every episode of Opt Out so far is every guest has mentioned that idea of it doesn't just happen all at once.

Like you, at least no one I know is capable of just, like you said earlier, waking up one day and just dropping windows for Linux, spinning up a Torx, like all of these things. No one does that. Like no one just suddenly switches their whole life around to be more private and secure. It is something that has to be a journey. It takes a while. Like you mentioned, you choose which things to focus on. Again, the threat model plays into that because you decide when you're making just a simple threat model what things are most critical for me to keep private or for me to make sure are secure.

And maybe to start there or start with something easy, like you mentioned, a password manager. And it's that journey and it's how you go about it and keeping the motivation and keeping community around you that helps to prompt you with new things. Or new ideas or new ideas or helps to prompt you with motivation to keep going towards a specific goal that you have. And it's very much not an overnight thing. It's a process. And it can be difficult and time consuming at points, but it is very much worth it.

And I think once people start that process, it usually starts a snowball of realizing the importance of privacy and security and its impact on them and on their friends, coworkers, family has a great cumulative effect. I'd agree with that. I've definitely, my partner, you know, I mentioned that she's not quite as into this stuff as I am, but there's been several times that she's just out of the blue. She'll look at me and she'll be like, man, I feel so good knowing that like I used a privacy.com card.

And, you know, if my card number gets stolen, it doesn't matter because it's, you know, privacy.com or like I, you know, I feel good. Like I went into Ikea and didn't get reception. So I turned on Wi-Fi and turned on the VPN and now I'm protected. And, you know, she's mentioned that kind of stuff to me several times and just that feeling of security. Like when I switched to Qubes, which is my preferred Linux driver of choice, I literally describe it as a, oh man, what did I call it?

I was like, it feels like being wrapped in a warm blanket of security or something like that. Like it's, yeah, just like the feeling you get of knowing, like, not to ramble too much, but I, shortly after I started using privacy.com, I bought concert tickets. And then about six months later, I got an email that was like, so we had a data breach and I was just like, delete, don't care. Like, I don't care. My card is safe. If somebody tries to use it, I'll get an email.

It just feels so good to know that you're, you're safe like that and protected. Especially when you have those services that are like, they're not super complex to use or the tools that aren't super complex to use. And you're able to just be like, okay, I'm going to start using like SimpleLogin. We talked and talked about earlier. I'm going to start using SimpleLogin, Eli's email. It is so satisfying to have that, to get it done and to understand the implications of what that means in the seemingly inevitable case of some kind of data breach or some kind of new surveillance that starts happening.

It is, it's so satisfying to already have that done and in place. And to like, I think that's an interesting, interesting way to phrase it, but that, that warm blanket of security or privacy is it's very comforting. I mean, it really is. And it can feel daunting at first, but when you're able to, to start down that path, it really does feel very comforting. As long as you can stay away from kind of the paranoid, everyone's watching me, I can never do enough kind of approach that some people take or, or fall into.

But I think thankfully there's a lot of good community to help, help keep us away from that. Yeah. And I think if, if you start going that far, cause like I've definitely had my moments where, you know, I, I have my little Mr. Robot moments and I'm like, do I need to microwave my computer? And then I kind of have to do a, I think Michael Basil from privacy security and OSINT show, he calls it a sanity check, which is, you know, just take a deep breath and be like, all right, I I'm not that big of a threat.

Like nobody's spying on me. I mean, you know, Google spying on me, but you know what I mean? Like nobody's targeting me. I haven't clicked any phishing emails. Like nobody's been following me home. I just, I'm okay. Just take a deep breath, watch a movie, go back at it tomorrow. You know, it, yeah. You know, just take it, take it one step at a time. Absolutely. And last question I had for you is I was, I was browsing around your peer tube instance that you got spun up recently.

And I noticed that you have an event coming up on disinformation. Like I said, that'll be a live event that you have happening. And I just wondered if you wouldn't mind sharing a little bit about what that is and what people can expect if they tune in. Sure. So every quarter I try to do a webinar. Originally I was going to do like in-person conferences that were open to the public. And then I scheduled my first one for like March of 2020. So we see how that went.

And then ever since then I've just been kind of doing them digitally. And this one will, yeah, like you said, it'll be about disinformation. It will be July 18th. I will be live streaming it on peer tube. This will be my first peer tube live stream. So if anyone attends and things get a little wonky, I just want to apologize. This is going to be a learning experience for me. But yeah, I'm basically going to focus on what is disinformation, how to use it correctly, how to come up with different identities, when to use those identities, when versus using actual like your real information, you know, how to come up with like burner information and just stuff like that.

Because, you know, sometimes like as dumb as it is, you know, you go to buy something online and it's like, we need your phone number. And it's like, no, you don't. I'm downloading a game, but we still need your phone number. So like, how do you know what phone number to give them? And, you know, maybe you can give them a MySudo number. Maybe you can give them something else. And yeah, just that's, that's the kind of stuff I'm going to be talking about.

How to, what's a good fake name? What's a good non-suspicious address? Stuff like that. Perfect. Well, that is all I have for you. Thanks so much for coming on. It was great to be able to finally sit down and chat a little bit more and pick your brain about all the things you've written and talked about. There's just a wealth of info out there. Would you mind just sharing where the best place is to find or communicate with you? Sure. So my website is thenewoil.xyz.

And that is kind of the central hub for everything. So that's the main website where I talk about how to get started on privacy. I list a bunch of different tools that I recommend. On the last page is the links where you can find the blog that I've mentioned, the news feed, the peer tube, podcast with Techlore. There's also ways to get in touch with me. I do have a community on Matrix. There's a room on Matrix. So feel free to join that. I have like signal session as ways to get in touch with me.

And I do have a YouTube and a Twitter, but those are mainly the YouTube is mainly just to reach people that are not on peer tube. I have the comments disabled. So that's not a good place to reach me. And the Twitter is honestly just so that I can schedule posts that get mirrored to Mastodon. I try not to interact there too much. I mostly do everything on Mastodon. Yeah, you have like 18 different ways for people to reach you. I took a look at your page and I was like, goodness gracious, I don't even know how to choose.

So, you know, I try to cater to whatever people are using. And, you know, like I actually recently did away with XMPP because like no one was ever contacting me there. But, you know, I try to leave options for people. Like I said, like some people have legitimate complaints with ProtonMail, for example. So I have a Tutanota so that people who don't like Proton can still get in touch with me securely. And, you know, all the things. There's always a way.

Yeah, pretty much. Awesome. Well, thanks again for coming on, Nathan. Thanks again for having me. It was a fun time.

1:10:00 Thanks for listening, and I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast, or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the links to Nathan's content and contact info in the show notes, as well as links to all of the tools we discussed in today's episode. Now get out there and opt out this week. For this week's project to help you opt out, we're taking a look at PeerTube. PeerTube is a federated video platform that allows you to host your own content free of trackers and Google spyware, moderate your own content, and peer with other PeerTube instances as you see fit. PeerTube is entirely free to run, quite easy to spin up, and I use it for hosting all the video content for Opt Out at videos.optoutpod.com.

For those interested in merely consuming content on it, be sure to use a client like NewPipe or FreeTube to connect to your favorite PeerTube instances, or just browse directly to the instance and view through a browser. Check out the show notes for links to more info about PeerTube, links to my instance and that of Nathan at The New Oil, and how to run a server for yourself.