Do the hardships of a privacy lifestyle make it not worth it?

Privacy and Security Discussions
1

With all the different conveniences that have to be given up for the sake of better privacy and security, it can end up leaving some feeling hopeless and overwhelmed.

How have you all dealt with these sorts of thoughts?

6 Likes
2

Absolutely. It’s easy to get overwhelmed by the feeling that no matter how many steps you take, it’ll never be enough.

I always say to take things in your stride, this is a marathon, not a sprint. You don’t have to change everything all at once. Like most things in life, small and gradual changes are the best way to go.

I also think people should really evaluate their threat model, because not everybody needs to go full cold turkey with this stuff. It’s easy with people everywhere saying this is not private, that is a honeypot etc. etc. to get into the mindset you need to have a Librebooted Thinkpad, compile all your software manually etc. but the reality for most people who aren’t actively in danger is that going THAT far isn’t necessary.

Take solace in the fact that simply by using an ethical browser, you’re taking one more step than like 99% of people out there. That alone is making great strides for keeping your data off of companies servers. I think it’s good to take breaks from time to time, too. Keeping tabs on privacy stuff is important, but be sure to keep up with family and friends, take an evening to unwind and watch a movie, enjoy a good book, whatever floats your boat.

Sorry for the scatterbrained thoughts, and take care.

8 Likes
3

I totally agree with @whiskeyhighball. Having a threat model is a good way to minimise overthinking. Prioritise what exactly you’re trying to keep private and work from there. If you want to prevent ISP surveillance, then a VPN’s good enough, but if you want anonymity, then you’re gonna have to go with TOR on a Linux-based OS and what not.

I personally went through some confusing times where I was stuck on choosing between functionality and privacy. Ultimately I did end up going with a Windows laptop, but use best practices for privacy from corporate and government surveillance.

2 Likes
4

I completely understand your concerns about the trade-offs between privacy and convenience. It’s a common dilemma in this community. While it can sometimes feel overwhelming, there are things you can help find that balance or thread model.

Remember that you are not alone in this journey. Encourage reaching out to online communities or forums where you can ask questions and learn from others’ experiences.

A little about myself: I remember when I started my journey in 2016, which was about 8 years ago. Back then, privacy and security were largely unheard of, and it was quite challenging to get into this Privacy. However, I’ve noticed that it’s become much easier to dive into privacy and security recently. There are more privacy-respecting services and better tools available now, making it more accessible and relevant to a wider audience. So, don’t hesitate to explore and take advantage of these resources as you navigate your own path to enhancing your privacy and security online.

Remember, it’s a journey, and finding the right balance takes time and effort. It’s also important to avoid burnout and maintain your commitment to privacy over the long term. Here are some tips to help with that:

  1. Set Realistic Goals (or another to put it, Set threat model): don’t try to implement all privacy measures at once. Start with the basics and gradually increase your level of privacy protection. Setting achievable goals will prevent you from feeling overwhelmed.

  2. Stay informed, But Don’t Obsess: It’s essential to stay up-to-date with privacy and security developments, but constant monitoring can be exhausting. Allocate specific times to catch up on news and updates rather than being consumed by it.

  3. Find Support: Connect with like-minded individuals or communities who share your interest in privacy. Discussing your experiences and challenges with others can provide emotional support and new insights. Including In real life, not just online.

  4. Take Breaks: Remember to take breaks from intense privacy efforts. It’s okay to relax and enjoy the conveniences of the digital world occasionally. I should say, not everyone can enjoy conveniences of the digital world because of safety reason.

  5. Celebrate Small Wins: Acknowledge and celebrate your achievements, no matter how small they may seem. Recognizing progress can boost motivation.

  6. Balance is Key: Keep in mind that privacy and convenience can coexist (in some threat models). Strive for a balance that works for you, rather than aiming for absolute privacy perfection.

  7. Seek Professional Help if needed: If privacy-related anxiety or burnout becomes overwhelming, don’t hesitate to seek professional advice. Mental health is just as important as digital privacy.

I hope this help’s if you have any addition question’s let me know.

9 Likes
5

Alcohol.

In all seriousness, there isn’t much you have to give up. I still use WA in a container which works fine, and the only app I don’t use (which puts me at a disadvantage) is Instagram. I’m not sure how much or how little IG helps with socialization, but I’ve never used it and not planning to start (while I do miss out on a lot of stuff I have no idea how much it matters).

1 Like
6

Is the hardships of a privacy lifestyle make it not worth it?

I think that the underlying premise of the question is what is making you feel overwhelmed–as much or more than “a privacy lifestyle” is.

How you think about this question will determine how overwhelmed you are, and how you’ve phrased it frames the question as a binary (a ‘privacy lifestyle’ and a ‘non-privacy’ lifestyle). I’d posit that this is a non-constructive way to think about it that leads to burnout/stress.

I’m going to make an analogy to diet and nutrition. Lets take your original question and apply it to that:

“Are the hardships of [eating healthy] worth it?”

In this context it might be more clear why this framing is not-constructive. It assumes a binary that doesn’t exist. There are 10,000 shades of grey between a diet of pure gluttony+convenience, and a diet of optimal nutrition. Everyone will find a different balance between these extremes, and can incrementally work towards a healthier diet, without needing to strive for perfection. In that sense, yes, it is always “worth it” but which point on the spectrum is “worth it” will be different for each individual.

The same is true of privacy, its not a binary, start where you are, improve where you can (and where you are willing to), find the point on the spectrum that works for you, and then, over time, as you become more comfortable and familiar, you can continually work to improve your privacy bit by bit, until you are happy with it.

For me, the number one thing to prevent burnout and feelings of being overwhelmed or anxiety about making a mistake, is to accept and realize that you will never have (and almost certainly don’t actually need) perfect privacy or security. And that a ‘privacy lifestyle’ is more about working privacy into your thought process and decisionmaking, and knowing your threat model, than it is about a perfect set of tools or privacy strategy. For me it is a continual incremental process of addressing the ‘lowest hanging fruit’. There will always be more fruit to pick, but before you realize it, you’ll be pretty high up in that tree, and will be pretty comfortable there.

The other (related) thing to bear in mind is that the privacy space is overwhelmed with black & white maximalist thinkers, hyperbole/FUD, conspiracy theorists, and dogmatic people that feel that their maximalist threat model should be everyone’s threat model. Learn to recognize these logical pitfalls, and take them with a grain of salt.

edit: I also want to add, nearly everyone who cares about privacy struggles (or has struggled) with the feelings you are feeling. It is a normal part of the process to feel overwhelmed at times.

3 Likes
7

The other day, I resorted to using Google, and I did not care about surrendering my data in that moment, because I was so stressed out with my work.

Life is short, at the grave, having privacy will not satisfy you as much as building connections, engaging in activities, and having fun. Now, it can be argued that some applications are bad for your mental health. But if you need like your social life is missing out because you don’t use Snapchat or Whatsapp, by all means prioritize socialization.

It’s important to protect just your most important communications and data, NOT all of your communications and data. If you want to use Gmail or AOL for less important emails, not a bad idea.

I love how services like Proton Mail, Brave, and Apple make improve privacy without hindering convenience by a great deal. Apple seems to improve convenience and privacy simultaneously. (It’s not fun having to download apps from Aurora Store).

Most people have too much in their lives to even think about privacy. But trust me, when school is out, when you’re on vacation from work, and you’ve got no work to do, you will start thinking about privacy heavily.

3 Likes
8

At the risk of beating an old drum, if it’s not then you’re doing it wrong. Let’s take this with an example:

Let’s say you don’t like GMail scanning your e-mail, so you want to switch to Tutanota or ProtonMail or whatever. Setting up the account is easy, but changing the address for everyone is a colossal pain in the neck (trust me, I’ve done it). Sure, you can do it slowly by setting up forwarding and changing them one at a time, but at the end of the day that’s a lot of effort because there’s always some you can’t change or some idiot who refuses to update no matter how many times you try. And for some people that effort may well be worth it! But for others, probably not. So for them I wouldn’t recommend it.

Think of it like exercise. Would I be healthier if I ran every day? Probably. Do I care enough about the marginal gain to commit to that kind of effort and discomfort? Nope. So I don’t do it. Instead, I go for walks when I have time and energy and the weather isn’t too unpleasant, and make some effort to eat somewhat healthy. I could do more, and there’d be benefit for sure, but for me the cost outweighs is, so I don’t. I could stop drinking iced coffee, and definitely that’d be healthy, but I enjoy it, so I try to not have it too often - still get some enjoyment, limit the “damage” as it were.

Privacy and stuff is, I think, better understood as a lifestyle than anything else (from this perspective). We all want to be healthy, but we can’t all go for runs every day and eat nothing but salads. So we do what we can within our limits.

I can avoid using Uber Eats (which also saves me money, so that’s nice), I can avoid using most social medias (although that’s not actually that much because of privacy), etc. I can’t put all my assets into an LLC and only use Monero or cash or whatever. So I don’t, and I’m OK with that. I’ve done what I reasonably can to satisfy my threat model, and I am lucky enough to not need to worry about the government breaking down my door and arresting/torturing me because of my questionable taste in books.

2 Likes
9

Intro

Paradoxically you could be doing too much. And this isn’t
even an argument for convenience over privacy. I find that a lot of the things I do become obsolete over time. I disagree with the mainstream advice of, “just make a threat model.” We aren’t Batman so we can’t easily visual a threat, or actually be a victim of an active threat. Most threats to our privacy are hypothetical, and wont be threats for a couple years. I recommend starting from the most private setup first, and working backwards to find whats comfortable.

What does this look like?

Yeah, what does this look like? Ideally a fully private setup is one that gives the user complete control of their digital footprint. We don’t have any perfect solutions for this dilemma other than destroying your computer, but we can get pretty close. A good example would be starting with no logins and using Tails. Nothing is saved, and its about as anonymous as you can get. After this, lets call it; ground zero, you’d downgrade from here. In a perfect world we’d all Tails; but we don’t. So you probably want to login to accounts. Maybe you find that Qubes with Whonix is your cup of tea. Qubes for your real identity and Whonix for Anon browsing. You can keep swapping tools and services until you hopefully; get the most private setup with everything you need.

Conclusion

I’m fine with articles still using the phrase, “threat model” for optics. However, I think everyone should be aiming for the most privacy they can get. I want everyone to keep this one thing in mind for now, and into the future that, these measures shouldn’t be necessary. We all deserve the right to privacy, and we deserve to have it enshrined in the law. Google Chrome should have TOR levels of protection and Discord should offer E2EE for all DMs. These services will of course, never offer this functionality out of the goodness of their hearts, so they should be legally obligated to, with some sort of US GDPR. What we called the right to liberty in the past, is now the right to privacy.

4 Likes
10

I disagree with the mainstream advice of, “just make a threat model.” We aren’t Batman so we can’t easily visual a threat, or actually be a victim of an active threat. Most threats to our privacy are hypothetical, and wont be threats for a couple years. I recommend starting from the most private setup first, and working backwards to find whats comfortable.

Interestingly I agree with your premise, but follow it through to the exact opposite conclusion!

Because we can’t easily visualise or conceptualise things, going straight to the extreme (in my opinion) is likely to lead to burnout and in fact be probably not that useful. There are cases where that’s the case - marginalised person in a repressive country, for example - but for a normal person I’m not sure that’s sustainable or necessary.

Instead, I would invite people to do something small - switching from Chrome to Firefox, for example. That’s pretty easy for most people, most of the time, and for most “threat models” it’s probably useful. Then maybe install the Tor browser, and try to get used to using it when you’re just browsing. Slowly, over time, the person will get more familiar and comfortable with these tools, and as they think about it they’ll develop a better sense of what they’re trying to accomplish, so they can move towards that at their own pace, without wasting time/effort/patience on stuff that doesn’t matter for them.

I think we broadly agree on the term “threat model” - I’ve been in this space for a while, so I know what I mean when I use it; a general wave at what I’m trying to accomplish and what interests I’m working against. But I do agree while it’s a useful term, it’s pretty vague and often abused. It seems like the trend against using it as, basically “how cool am I posturing as to gain social capital within a specific subculture” has passed, which is nice. But if someone was trying to learn more, I wouldn’t use the term to them, favouring questions like “what are you trying to accomplish? Are you trying to avoid identity theft? Having your accounts hacked? Avoiding corporate surveillance? Avoiding government mass surveillance? Avoiding government targeted surveillance?” I find focusing on specific outcomes much more useful.

1 Like
11

Intro

I understand where you’re coming from, but I think we are misguiding new people who come to the privacy movement by saying they can just switch from, “Chrome to Firefox” as you said. In their mind they may think what their doing is enough, or even worse they become less receptive to other changes in their setup. They may respond with, “I already used you’re weird browser what else do you want me to do, go out and live in the forest?” Different folks will have different reactions, but in general if you switch up a recommendation on them you’ll lose their trust real quick.

Why I advocate for a “Top-down” approach

I hear this a lot and I find it really bizarre. We are basically telling people privacy is great, but too much privacy is not necessary; I beg to differ. Anyone can use Tor browser Who uses Tor?, the more people who use Tor browser the better the protection gets. There is literally no reason not to encourage mass adoption of this browser, I find it counter productive to the privacy movement as a whole to suggest otherwise. Additionally, if we get new people to the privacy movement using the Tor browser, they will have the best anonymity protections a browser can offer. The internet is a public space, so the only true way of still using it while keeping your data yours, is to be anonymous. Having people start from what I’ll call a, “Top-down” approach will help them learn what is available to them, and what threats they should watch out for. If they start from Tails and work down, they will have a greater understanding of what peak privacy looks like. They’ll understand the Tor browser mitigates threats such as: browser fingerprinting, IP logs, malicious java script, and much more.

Of course we all need a public compartment so that users may decide to use Fedora only for public stuff. They may want more convenience, so they could use Qubes for public browsing and Whonix in Qubes for anon browsing. This will allow them to save a configuration unlike Tails and they don’t have to switch OS’s everytime they want to change compartments. Now keep in mind Qubes is what Edward Snowden uses, but I don’t think that should make it intimidating. As humans, we all are capable of learning to use incredibly complex things like cars and language. I’m sure we could all learn to be tech savvy for our privacy’s sake.

Conclusion

In reality, most people will only every make slight changes to their life style, so your “Bottom-up” approach is probably going to work for most people, hence why it’s mainstream. Ideally for me though I’d like it if everyone tried my Top-down approach, to minimize exposure of their private data to the highest degree. I disagree with you on threat models as well, but I’m tired of typing so I can elaborate on that if you want.

2 Likes
12

No, we’re saying “privacy is good, but often comes with drawbacks, so you’re going to have to weigh the benefits and drawbacks on your individual case”. In the same way that doing “more healthy” things is good, but it’s not feasible for everyone to do literally all the things due to things like work schedules or existing health situations or whatever.

In fact, there are several very good reasons Tor isn’t suitable for all the time:

  • It breaks a lot of websites (like my bank’s website if I need to pay my bills)
  • It can be quite slow
  • It flat-out loses the vast majority of its value the moment you log into things
  • Doesn’t support certain extensions which can be helpful or necessary to certain use cases (at minimum without negating a lot of the value, assuming they work at all)
  • Some networks like schools or work block it or make it unreliable

And those are just off the top of my head. I like Tor, but to say there is literally no reason not to use it is just a gross oversimplification at best and outright deception that harms people’s attempts to achieve marginal improvements at worst.

If you get someone who has no experience or technical ability or interest to try to run Tails and use only Tor and all that out the gate, what they’ll gain is an understanding that this is a giant pain in the neck, that achieving any good is too difficult and they’ll go back to GMail and Chrome and all that, but now be even more resistant to making any incremental benefits at all in the future. So congratulations, you’ve made the persons life worse (in this hypothetical example). Whereas if we go small and incremental, let’s say they stop at Firefox (which, by the way, isn’t “weird”, it’s pretty mainstream and a lot of people are familiar with it even if Chrome dominates the market. Tor is weird.). They’ve still made concrete gains by not using a horrifically invasive browser - yes, it’s a small step, but it’s notably better than their situation before, and it’s cost them very little effort.

I’m more tech-savvy than the average, and I’ve been in this space for a few years now. I’m still pretty vague on a lot of that stuff and how it works and what it means. So, no they won’t.

It is intimidating. I like Linux, but even I’ll freely admit it’s more of a hassle than Windows - stuff keeps breaking in weird ways, and it’s often hard to figure out why, much less how to fix it. I certainly wouldn’t try to convince my mother to switch, and if I did she’d probably just give up and go back to Windows the moment I wasn’t there to force her to keep doing it. Not because she doesn’t care, but because she’s not tech-savvy and she’s not especially interested in having to spend literally months learning how to use a whole operating system that isn’t compatible with what she has to use for work anyway and makes it harder to do what she wants to do. And that is much closer to the average person than someone who can just pick up how to dual-boot or run VMs or troubleshoot technical issues.

I notice you use two examples which require years to learn, and even after that time are still very prone to error, if the rate of car accidents or language misinterpretations is anything to go by. Learning a new language to even conversational proficiency takes at best months of immersion for the vast majority of people, and learning to drive a car took me nearly 2 years of multiple-weekly practice. And I had strong reason to learn that - it had a direct concrete benefit to my life to learn, so I stuck with it. But privacy things are often more abstract and diffuse and harder to grasp than “I can go down to the shops whenever I want” or “I don’t need to worry about whether the buses are running when I visit my friend”.

So, in other words, you don’t actually believe it when you said your point? That is, you don’t believe that it will lead to better privacy on average? So you’re advocating a position that you think will lead to worse privacy on average and drive people away and cause a lot of hassle?

If people are only going to make slight changes, surely it’s better to make those slight changes stick than annoy them for a while then have them go back to where they were only less willing to try again? Unless you want to treat privacy as an exclusive privilege or club that lets you feel superior, rather than actually materially improving their situation.

13

from my experience both the classic threat model from @Agreeably_Icy and the “top-down” approach from @InquisitiveWalrus can work.

it really depends on the person you are working with.

if that person isnt tech savvy and/or has no interest in security, privacy and anonymity, the classic threat model mostly works better, because the “top-down” approach would be too overwhelming and that person would probably never make a change.

however if that person is tech savvy and/or is actually interested in security, privacy and anonymity, a “top-down” approach can be better, because the person wants to learn that stuff and ends up having better spa than with the classic threat model. (i do that for myself and already did it for a friend who is into it as well)

TL;DR

if you are working with a normie person that isnt interested in spa, use the classic threat model.

if you are working with a tech savvy person that is interested in spa, the “top-down” approach can be better than the classic threat model.

1 Like
14

I don’t love your phrasing about “if someone actually has interest in spa”, but that’s a minor quibble that’s honestly not worth getting into. I broadly agree with the substantive point you’re making, that obviously it’s not that any one approach is necessarily The Best, but rather that for some people Approach A might work best, while other people it’s Approach B or C or D or whatever.

1 Like
15

Yea. I’ve been back and forth in my mind of whether to go back to android or stick with iOS.

Like, GrapheneOS seems like the best option for Android but there’s certain apps I use for work that I’m not 100% sure would work on it.

Then, if I do stock android with mostly FOSS apps, I’m probably in a worse position privacy-wise then I was with Apple.

16

i use grapheneos and all of my apps work, even my banking app.

with sandboxed google play services all apps should work.

you can even turn off hardened malloc for an app if it still doesnt work.

can you tell us what apps for work you mean? maybe someone here knows if it work on grapheneos.

17

I’d say you are correct as Apple now does a lot more things locally. And with advanced data encryption they e2ee Icloud stuff.

1 Like
18

Well yes, but then you have already traded in some privacy for convenience.

19

ofc, i personally have no gplay on my phone, but if he needs these apps to work he must do it like that.

in the end grapheneos with sandboxed gplay is still better than stock android or ios imo.

3 Likes
20

It would be really nice if there was a way I could test and see if my work apps would work on GrapheneOS.

I already checked Plexus and they aren’t there. Admittedly, that’s not suprising since it’s a community driven database.

If I do get onto Graphene and they work, I’ll make sure to contribute to Plexus