Commit `c0efa33fd6`

c0efa33fd63eeacfc7056a93f273e5f8acdbb0a3

parent: 5fa129c879

Verified · cmc

cmc <hello@cleberg.net> · 2026-07-01 18:00 UTC

add garden page: privacy

Layout: unified · split

content/garden/privacy.org added +116

		@@ -0,0 +1,116 @@
	1	#+title: 🌱 privacy
	2	#+slug: privacy
	3	#+description: Privacy is of the utmost importance.
	4	#+date: [2026-07-01 Wed 12:23:42]
	5
	6	/Privacy and security often overlap, so I have combined them here as privacy
	7	relies on security./
	8
	9	* Passwords
	10
	11	For all passwords, I generate and store these within a [[https://bitwarden.com/][Bitwarden]] vault. I chose
	12	Bitwarden due to its open nature and plethora of clients. If I didn't have to
	13	maintain passwords for my family, I would prefer a solution like [[https://keepassxc.org/][KeePassXC]] and
	14	would sync it via Syncthing.
	15
	16	When possible, I prefer a [[https://bitwarden.com/passphrase-generator/][passphrase]] over a [[https://bitwarden.com/password-generator/][password]]. However, some sites have
	17	short password length limits and a random string of characters may be better.
	18
	19	** Multi-Factor Authentication (MFA)
	20
	21	In order to protect my accounts, I enable MFA whenever possible. My personal
	22	preferences are:
	23	- Passkey
	24	- TOTP
	25	- Email (begrudgingly)
	26	- SMS (almost never)
	27
	28	Personally, I use a combination of [[https://apps.apple.com/us/app/bitwarden-authenticator/id6497335175][Bitwarden Authenticator]] for TOTP codes - a
	29	standalone iOS app that I keep logged out - and the Bitwarden vault's native
	30	TOTP and passkey functionality.
	31
	32	This ensures two separate locations for TOTP secrets, in case one is lost or
	33	otherwise inaccessible.
	34
	35	* Email
	36
	37	While email is inherently not a private communication channel, due to its
	38	unencrypted nature on any sender's or receiver's servers, it's still a central
	39	method of communication today. Therefore, it's important to take steps to make
	40	it marginally more private.
	41
	42	First, I choose an email provider that values privacy. This excludes the major
	43	providers (Google, Microsoft, Yahoo, etc.) and requires us to look at other
	44	options. Popular email hosts in the privacy community include Proton Mail, Tuta
	45	Mail, and Mailbox.org.
	46
	47	However, I chose a different path. I registered my own domain name, registered
	48	with [[https://migadu.com/][Migadu]], and setup custom email addresses on my own domain, such as my
	49	primary email: [[mailto://hello@cleberg.net][hello@cleberg.net]].
	50
	51	This allows for a few unique features:
	52	- Custom domains without limits, so I can utilize any domain I own as an email
	53	domain as well (unlike Tuta).
	54	- I enabled catch-all reception, so I can sign up with aliases at-will. E.g.,
	55	local.store@cleberg.net will deliver directly to me without having to create
	56	that email beforehand.
	57	- I enabled wildcard addressing, so I can reply from any such custom address.
	58	- IMAP & SMTP is supported (unlike Proton), so I can use email clients I trust
	59	([[https://www.thunderbird.net][Thunderbird]] & [[https://neomutt.org/][NeoMutt]]).
	60	- Domain forwarding and redirects. E.g., all mail to =*@example.com= will go to
	61	=you@example.org=.
	62	- Based in Switzerland, if jurisdiction is important to you.
	63
	64	I'm waiting for [[https://www.tb.pro/][Thundermail]] to be released publicly so I can test it out and
	65	compare against Migadu.
	66
	67	* Messaging
	68
	69	When it truly matters, I use [[https://signal.org/][Signal]] as my instant messenger. I have tried
	70	others, but settled on Signal a while ago and have not lost faith in them yet -
	71	especially with their helpful username and group chat features.
	72
	73	* DNS & VPNs
	74
	75	On my personal devices, I ensure that I use an always-on VPN. Currently, I am
	76	using [[https://www.ivpn.net][IVPN]] and previously used [[https://mullvad.net][Mullvad]] for years. On my bittorrent server, I use
	77	[[https://airvpn.org/][AirVPN]] because it supports reliable port forwarding via the Wireguard CLI.
	78
	79	For devices that cannot use a VPN, I rely on network-wide DNS from my router. On
	80	the router, I have installed [[https://nextdns.io/][NextDNS]] to ensure any non-VPN devices go through
	81	NextDNS instead of the ISP's DNS.
	82
	83	* Search Engines
	84
	85	I use my own self-hosted [[https://docs.searxng.org/][SearXNG]] search engine at [[https://search.zerolabs.sh/][search.zerolabs.sh]], which "is
	86	a metasearch engine, aggregating the results of other search engines while not
	87	storing information about its users."
	88
	89	When that is not possible (if it's down or a device doesn't allow setting custom
	90	default search engines), I use DuckDuckGo. It's the next best option.
	91
	92	* Browsers
	93
	94	This section could be /massive/ if I detailed every single option and step in
	95	securing a private browser. However, I will keep it brief for now.
	96
	97	I utilize [[https://librewolf.net/][LibreWolf]] as my primary browser - a custom version of Firefox with
	98	sane defaults and privacy-respecting settings.
	99
	100	When required, I use [[https://www.torproject.org/][Tor]] to access onion sites and/or browser sites with
	101	marginally better privacy and anonymity.
	102
	103	* Cloud Storage
	104
	105	This will be a short section, as I don't actually use "cloud storage" as we know
	106	it. After years of testing and using various providers, I have settled on
	107	[[https://syncthing.net/][Syncthing]] with a network of all my personal devices (>= 3 devices at all times).
	108
	109	Previously, I tested Tresorit, pCloud, Proton Drive, Internxt, MEGA, Filen, and
	110	Ente. However, all of these require /some/ level of trust in the provider. I also
	111	used [[https://cryptomator.org/][Cryptomator]] to encrypt files before they reached the cloud provider, so I
	112	could use anyone and still feel safe.
	113
	114	However, they all eventually provided one shortcoming or another and I settled
	115	on Syncthing with relays turned-off, as that is what makes the most sense for
	116	me.

Commit c0efa33fd6

Commit `c0efa33fd6`