- Whether you realize it or not, each of us has a framework
through which we make decisions about our data, our privacy,
and the way we access the internet.
There are some people who are very passive
about their privacy
and they're the ones who are emailing the same things like,
"Privacy? I have nothing to hide."
On the other side, you have people
who lean more towards conspiratorial paranoia
and they're the ones who are leaving comments on my videos,
like, "Wait, you use Apple products
and claim to care about privacy?
You are dead to me."
So yeah, I lean somewhere in the middle.
I do care about my privacy obviously,
but instead of seeing every big data
and social media company as a cancer
that I need to get rid of,
I prefer to make intentional, calculated decisions
about my privacy.
How do I do that?
Well today, I'm gonna share with you my privacy framework,
which can be distilled down to five commandments
that I try my best to follow.
I don't always, but I try my best.
This framework is always evolving,
so I'm open to discussion in the comments of this video.
For those of you who think that I'm missing something
or perhaps just outright disagree with me, that's great.
I welcome that.
My goal is to get you to move beyond binary thinking.
In other words, beyond the simple, this is private,
this isn't private mentality.
I want you to begin to understand
how you personally balance security and privacy
versus comfort and convenience.
And by doing this,
I promise that you'll approach how you get online
and give out your information in a whole new way.
(tense music)
Okay, let's get started with number one.
Commandment number one: I need to know who I'm trusting.
It's very misleading
to think that you can actually trust no one.
When you get online,
you're trusting a particular internet service provider.
When you use a specific operating system like Windows,
Mac OS; and yes, even Linux, you're trusting the companies
and programmers behind those systems.
Same with password managers, VPNs,
identity monitoring services.
All of these companies
that claim to enhance our privacy and security
require you to trust them.
Now hear me clearly, I'm not saying that's a bad thing.
I trust 1Password to secure my passwords.
I trust ProtonMail to secure my sensitive email.
The point of this commandment isn't to eliminate trust
because I think that's impossible.
The point here is to know who I'm trusting
and to be intentional about where I'm placing that trust.
This is why in all of the reviews
of security software I have on this channel,
I do specific research on the company behind the software,
and who's running that company.
It's important for me to know who I'm trusting
because I want them to be accountable to that trust.
So now that I've recognized that I have to trust somebody,
that leads me to commandment number two.
Commandment number two:
find ways to limit or reduce that trust as much as possible.
Now, before we unpack this,
let me make a couple of confessions here.
I use Gmail, I do.
I have an iPhone, a Facebook account,
and I make purchases through Amazon.
If I wanted to be invisible,
I would get rid of all of these.
In fact, Chris Luna in his book, "How To Be Invisible,"
lays out four levels of privacy.
And the fourth level, which he says is basically
like duplicating the Federal Witness Protection Program
is not only extremely difficult, it's also illegal.
In other words, there is such thing as too far
when it comes to your privacy.
Again, I wanna find a place
where I'm comfortable balancing privacy and convenience.
I've done a whole series on how to limit the data
that I give to companies like Amazon, Facebook and Google,
which I encourage you to watch,
but the takeaway here is that I've decided
I'm not going to delete my accounts.
I'm not gonna go that far.
I'm simply going to find ways
to limit what data I give them.
And commandment number three
is probably one of the best ways to do that.
Commandment number three:
divide control of my data and privacy.
What do I mean?
Well, let's look at it as a simple equation.
If I use a Chromebook laptop,
accessing the internet through the Chrome browser,
finding answers using Google search,
asking Chrome to store all of my passwords,
and then log into my Gmail account,
that's an equation that equals too much reliance
on one company, Google.
Instead, I'd like to divide that up.
So I'll use my MacBook computer
to access the internet through the Firefox browser.
I'll search using either DuckDuckGo or Startpage,
and rely on 1Password to hold all my passwords.
Then I'll log into my email
that's split between both Gmail and ProtonMail.
This equation is one that I'm much more comfortable with.
And in my subjective opinion,
this equation equals better privacy.
Are there ways to get even more privacy?
Sure, but this is where I'm comfortable.
For the most part, I try to use specific applications
that were designed for a specific use.
In other words, I don't want to use my browser
to save my passwords.
It wasn't designed to do that,
it was designed to get me on the internet.
I don't use a VPN to scan the dark web for my data.
That's not what a VPN is for.
I want to divide my data among applications that specialize
in that specific aspect of my privacy.
Makes sense? Okay.
Before we jump into commandment number four,
if you're watching this and find yourself agreeing
with my thought process here, why not take a moment
and click that subscribe button down here.
This is a framework I use to present practical means
of privacy and security in our everyday lives,
and I got lots of great video content
coming up here on All Things Secured
that you're going to really benefit from.
Commandment number four:
control my own data as much as possible.
This can be done in a number of different ways,
but I'm going to highlight three of them.
Client-side encryption, local storage, and data segregation.
Don't worry if you don't understand those.
Let's start with client-side encryption.
A great example of this can be found in the last video
that I just did about cloud storage.
Yes, I use Google Drive, Dropbox, and others
to store my data on their servers in the cloud,
but I encrypt the data first
using a program like Boxcryptor; or you guys,
a lot of you left comments talking about Cryptomator,
which is another great open-source free version.
That's client-side encryption.
I want to have some control of that encryption
so that even if a company claims
to use zero-knowledge encryption,
meaning none of their employees can peek in on my account
and see what I have in my files,
I'm still limiting my trust by encrypting my own data
and giving it to them.
Another way I can control my data is through local storage.
This could mean using a physical hard drive,
like this one I have here, instead of the cloud
to store all of my files, if you like,
or using a password manager
that keeps the password vault on your device
and doesn't sync it to the cloud.
Better yet, you could use a device like the YubiKey
or this OnlyKey that I've shown you before
to keep all of your passwords on a physical device
that you carry with you wherever you go.
Again, we're trading privacy for convenience here,
and that's a decision that you're going to have to make
on your own.
Finally, you can control your data
through what I call data segregation.
For me, this means separating out my most sensitive data
and treating it differently than my standard data.
My most sensitive data doesn't get stored in the cloud.
My most sensitive data is never transmitted via Gmail.
My most sensitive data is never given to just anybody
who requires or asks for it.
I mean, some companies ask for my address
when all they really need is my zip code
to verify the credit card.
Some companies ask for my phone number,
or strangely, my ID number,
my social security number when they don't really need it.
This is my data,
and I want to control it as much as possible.
Commandment number five: backup, backup, backup.
This all goes back to trust.
I don't even trust this local hard drive not to fail on me,
and so I want to have all of my data backed up
on at least two different drives in two different places,
if at all possible; sometimes that's really hard.
The biggest offender I see here
is two-factor authentication.
I get emails and comments from so many of you
who've set up something like Google Authenticator or Authy
to secure their online accounts, which is a great thing,
and then they somehow lose access to their phones
either they lost their phone or it got reset or whatever.
The point is, they no longer have access to these 2FA codes
and consequently, they lose access
to all of their online accounts
or at least the ones that are the most important.
If they haven't backed up the codes,
which means either keeping those backup codes
that you're given when you first set up 2FA
#or taking a screenshot of that QR code
and keeping it in an encrypted file,
they're in a heap of trouble.
Even when I'm using 2FA keys, which is my preferred method,
I have this YubiKey that I carry around with me
on my key chain.
I purchased a second set, which is what I use.
And after setting both of them up,
I keep that second backup key in a safe elsewhere
in case I somehow lose my keys
and I don't have access to this first set of 2FA keys.
Security and privacy are great things to work toward,
but as much as possible,
create that safety net with good backups.
Well, that's my framework for how I treat data and privacy,
but I'd love to hear from you.
Do you agree or disagree?
Do you think I need to add something?
I try to read every comment ,
and I look forward to hearing what you have to say.