Privacy and security
Tim's tools for staying private and secure.
Privacy is not one purchase, it is a set of habits and a few good tools. This is the toolkit I actually recommend, sorted so you can start where you are. Do the Basic tier and you have already shut most doors. Work up only as far as your life needs.
Everything here is either free or from a company with a real security record. Nothing is paid placement. The links go to the official source, never a mirror.
Basic
For everyone, today. Low effort, high payoff. If you only do this tier, you have closed the doors that get most people.
- Bitwarden
A password manager so every account gets a unique password you never have to remember. Free and open source.
- Aegis Authenticator
App-based two-factor codes to replace text-message codes, which are the weakest kind. Pair it with a real login.
- Signal
End-to-end encrypted calls and messages. The private default for talking to family and anyone else.
- uBlock Origin
The ad and tracker blocker. Blocks the scripts that follow you around the web, and speeds pages up.
- Brave or Firefox
A browser that respects you by default instead of selling what you do. Either one, with uBlock Origin on top.
- DuckDuckGo
A search engine that does not build a profile on you or tie your searches to your name.
- Have I Been Pwned
Check whether your email or passwords have leaked in a breach, then go change what has.
- PrivacyHawk
Scans data brokers for your personal information and sends the removal and do-not-sell requests for you.
- Rocket Money
Security is also financial. Track subscriptions and spending in one place, from a company with a tight PCI-DSS and SOC posture around your data.
Intermediary
A weekend of setup for real gains. For people ready to go past the basics and lock down email, network, and logins.
- Mullvad or Proton VPN
A no-logs, independently audited VPN for public Wi-Fi and to keep your browsing out of the hands of your internet provider. Avoid the free ones that sell your traffic.
- Tailscale
A private mesh network built on WireGuard that securely connects your own devices, wherever they are, with no ports to open.
- Proton Mail or Tuta
Encrypted email that the provider itself cannot read, instead of a free inbox mined for ads.
- SimpleLogin or Addy.io
Email aliases so every signup gets its own address. When one leaks, you turn it off without touching your real inbox.
- YubiKey
A hardware security key that makes your logins phishing-proof. The strongest second factor you can carry.
- NextDNS
Encrypted DNS that blocks trackers and malware for every device on your network, with a log you actually control.
- Proton Drive or Cryptomator
Encrypted storage, or a free tool that encrypts files before they touch any cloud you already use.
Advanced
Threat-model driven and technical. For journalists, activists, and anyone whose exposure is higher than most. Match the tool to the threat, not the other way around.
- Tor Browser
Routes your traffic through several relays so no single point sees both who you are and what you visit. The tool for real anonymity.
- GrapheneOS
A hardened, de-Googled Android for Pixel phones. A private pocket computer instead of a tracking device.
- Tails or Qubes OS
An amnesiac live system, or an OS that isolates everything into compartments, for work that cannot leak.
- Vaultwarden and Pi-hole
Self-host your own password vault and network-wide ad blocker, so your data lives on hardware you own.
- GnuPG
Public-key encryption for files and email, and signing to prove something really came from you. Pairs with a YubiKey.
- OPNsense or pfSense
A real firewall with network segmentation, so a compromised gadget cannot reach the rest of your house.
Not sure where to start, or want this set up with you rather than handed to you? That is exactly what the Digital front of the practice is for.