cmc/cleberg.net

  1#+title: 🌿 privacy
  2#+slug: privacy
  3#+description: Privacy is of the utmost importance.
  4#+date: [2026-07-01 Wed 12:23:42]
  5
  6/Privacy and security often overlap, so I have combined them here as privacy
  7relies on security./
  8
  9* Passwords
 10
 11For all passwords, I generate and store these within a [[https://bitwarden.com/][Bitwarden]] vault. I chose
 12Bitwarden due to its open nature and plethora of clients. If I didn't have to
 13maintain passwords for my family, I would prefer a solution like [[https://keepassxc.org/][KeePassXC]] and
 14would sync it via Syncthing.
 15
 16When possible, I prefer a [[https://bitwarden.com/passphrase-generator/][passphrase]] over a [[https://bitwarden.com/password-generator/][password]]. However, some sites have
 17short password length limits and a random string of characters may be better.
 18
 19** Multi-Factor Authentication (MFA)
 20
 21In order to protect my accounts, I enable MFA whenever possible. My personal
 22preferences are:
 23- Passkey
 24- TOTP
 25- Email (begrudgingly)
 26- SMS (almost never)
 27
 28Personally, I use a combination of [[https://apps.apple.com/us/app/bitwarden-authenticator/id6497335175][Bitwarden Authenticator]] for TOTP codes - a
 29standalone iOS app that I keep logged out - and the Bitwarden vault's native
 30TOTP and passkey functionality.
 31
 32This ensures two separate locations for TOTP secrets, in case one is lost or
 33otherwise inaccessible.
 34
 35* Email
 36
 37While email is inherently not a private communication channel, due to its
 38unencrypted nature on any sender's or receiver's servers, it's still a central
 39method of communication today. Therefore, it's important to take steps to make
 40it marginally more private.
 41
 42First, I choose an email provider that values privacy. This excludes the major
 43providers (Google, Microsoft, Yahoo, etc.) and requires us to look at other
 44options. Popular email hosts in the privacy community include Proton Mail, Tuta
 45Mail, and Mailbox.org.
 46
 47However, I chose a different path. I registered my own domain name, registered
 48with [[https://migadu.com/][Migadu]], and setup custom email addresses on my own domain, such as my
 49primary email: [[mailto://hello@cleberg.net][hello@cleberg.net]].
 50
 51This allows for a few unique features:
 52- Custom domains without limits, so I can utilize any domain I own as an email
 53  domain as well (unlike Tuta).
 54- I enabled catch-all reception, so I can sign up with aliases at-will. E.g.,
 55  local.store@cleberg.net will deliver directly to me without having to create
 56  that email beforehand.
 57- I enabled wildcard addressing, so I can reply from any such custom address.
 58- IMAP & SMTP is supported (unlike Proton), so I can use email clients I trust
 59  ([[https://www.thunderbird.net][Thunderbird]] & [[https://neomutt.org/][NeoMutt]]).
 60- Domain forwarding and redirects. E.g., all mail to =*@example.com= will go to
 61  =you@example.org=.
 62- Based in Switzerland, if jurisdiction is important to you.
 63
 64  I'm waiting for [[https://www.tb.pro/][Thundermail]] to be released publicly so I can test it out and
 65  compare against Migadu.
 66
 67* Messaging
 68
 69When it truly matters, I use [[https://signal.org/][Signal]] as my instant messenger. I have tried
 70others, but settled on Signal a while ago and have not lost faith in them yet -
 71especially with their helpful username and group chat features.
 72
 73* DNS & VPNs
 74
 75On my personal devices, I ensure that I use an always-on VPN. Currently, I am
 76using [[https://www.ivpn.net][IVPN]] and previously used [[https://mullvad.net][Mullvad]] for years. On my bittorrent server, I use
 77[[https://airvpn.org/][AirVPN]] because it supports reliable port forwarding via the Wireguard CLI.
 78
 79For devices that cannot use a VPN, I rely on network-wide DNS from my router. On
 80the router, I have installed [[https://nextdns.io/][NextDNS]] to ensure any non-VPN devices go through
 81NextDNS instead of the ISP's DNS.
 82
 83* Search Engines
 84
 85I use my own self-hosted [[https://docs.searxng.org/][SearXNG]] search engine at [[https://search.zerolabs.sh/][search.zerolabs.sh]], which "is
 86a metasearch engine, aggregating the results of other search engines while not
 87storing information about its users."
 88
 89When that is not possible (if it's down or a device doesn't allow setting custom
 90default search engines), I use DuckDuckGo. It's the next best option.
 91
 92* Browsers
 93
 94This section could be /massive/ if I detailed every single option and step in
 95securing a private browser. However, I will keep it brief for now.
 96
 97I utilize [[https://librewolf.net/][LibreWolf]] as my primary browser - a custom version of Firefox with
 98sane defaults and privacy-respecting settings.
 99
100When required, I use [[https://www.torproject.org/][Tor]] to access onion sites and/or browser sites with
101marginally better privacy and anonymity.
102
103* Cloud Storage
104
105This will be a short section, as I don't actually use "cloud storage" as we know
106it. After years of testing and using various providers, I have settled on
107[[https://syncthing.net/][Syncthing]] with a network of all my personal devices (>= 3 devices at all times).
108
109Previously, I tested Tresorit, pCloud, Proton Drive, Internxt, MEGA, Filen, and
110Ente. However, all of these require /some/ level of trust in the provider. I also
111used [[https://cryptomator.org/][Cryptomator]] to encrypt files *before* they reached the cloud provider, so I
112could use anyone and still feel safe.
113
114However, they all eventually provided one shortcoming or another and I settled
115on Syncthing with *relays turned-off*, as that is what makes the most sense for
116me.