c0efa33fd6 · cmc/cleberg.net

1

#+title: 🌱 privacy

2

#+slug: privacy

3

#+description: Privacy is of the utmost importance.

4

#+date: [2026-07-01 Wed 12:23:42]

5

6

/Privacy and security often overlap, so I have combined them here as privacy

7

relies on security./

8

9

* Passwords

10

11

For all passwords, I generate and store these within a [[https://bitwarden.com/][Bitwarden]] vault. I chose

12

Bitwarden due to its open nature and plethora of clients. If I didn't have to

13

maintain passwords for my family, I would prefer a solution like [[https://keepassxc.org/][KeePassXC]] and

14

would sync it via Syncthing.

15

16

When possible, I prefer a [[https://bitwarden.com/passphrase-generator/][passphrase]] over a [[https://bitwarden.com/password-generator/][password]]. However, some sites have

17

short password length limits and a random string of characters may be better.

18

19

** Multi-Factor Authentication (MFA)

20

21

In order to protect my accounts, I enable MFA whenever possible. My personal

22

preferences are:

23

- Passkey

24

- TOTP

25

- Email (begrudgingly)

26

- SMS (almost never)

27

28

Personally, I use a combination of [[https://apps.apple.com/us/app/bitwarden-authenticator/id6497335175][Bitwarden Authenticator]] for TOTP codes - a

29

standalone iOS app that I keep logged out - and the Bitwarden vault's native

30

TOTP and passkey functionality.

31

32

This ensures two separate locations for TOTP secrets, in case one is lost or

33

otherwise inaccessible.

34

35

* Email

36

37

While email is inherently not a private communication channel, due to its

38

unencrypted nature on any sender's or receiver's servers, it's still a central

39

method of communication today. Therefore, it's important to take steps to make

40

it marginally more private.

41

42

First, I choose an email provider that values privacy. This excludes the major

43

providers (Google, Microsoft, Yahoo, etc.) and requires us to look at other

44

options. Popular email hosts in the privacy community include Proton Mail, Tuta

45

Mail, and Mailbox.org.

46

47

However, I chose a different path. I registered my own domain name, registered

48

with [[https://migadu.com/][Migadu]], and setup custom email addresses on my own domain, such as my

49

primary email: [[mailto://hello@cleberg.net][hello@cleberg.net]].

50

51

This allows for a few unique features:

52

- Custom domains without limits, so I can utilize any domain I own as an email

53

domain as well (unlike Tuta).

54

- I enabled catch-all reception, so I can sign up with aliases at-will. E.g.,

55

local.store@cleberg.net will deliver directly to me without having to create

56

that email beforehand.

57

- I enabled wildcard addressing, so I can reply from any such custom address.

58

- IMAP & SMTP is supported (unlike Proton), so I can use email clients I trust

59

  ([[https://www.thunderbird.net][Thunderbird]] & [[https://neomutt.org/][NeoMutt]]).

60

- Domain forwarding and redirects. E.g., all mail to =*@example.com= will go to

61

=you@example.org=.

62

- Based in Switzerland, if jurisdiction is important to you.

63

64

  I'm waiting for [[https://www.tb.pro/][Thundermail]] to be released publicly so I can test it out and

65

compare against Migadu.

66

67

* Messaging

68

69

When it truly matters, I use [[https://signal.org/][Signal]] as my instant messenger. I have tried

70

others, but settled on Signal a while ago and have not lost faith in them yet -

71

especially with their helpful username and group chat features.

72

73

* DNS & VPNs

74

75

On my personal devices, I ensure that I use an always-on VPN. Currently, I am

76

using [[https://www.ivpn.net][IVPN]] and previously used [[https://mullvad.net][Mullvad]] for years. On my bittorrent server, I use

77

[[https://airvpn.org/][AirVPN]] because it supports reliable port forwarding via the Wireguard CLI.

78

79

For devices that cannot use a VPN, I rely on network-wide DNS from my router. On

80

the router, I have installed [[https://nextdns.io/][NextDNS]] to ensure any non-VPN devices go through

81

NextDNS instead of the ISP's DNS.

82

83

* Search Engines

84

85

I use my own self-hosted [[https://docs.searxng.org/][SearXNG]] search engine at [[https://search.zerolabs.sh/][search.zerolabs.sh]], which "is

86

a metasearch engine, aggregating the results of other search engines while not

87

storing information about its users."

88

89

When that is not possible (if it's down or a device doesn't allow setting custom

90

default search engines), I use DuckDuckGo. It's the next best option.

91

92

* Browsers

93

94

This section could be /massive/ if I detailed every single option and step in

95

securing a private browser. However, I will keep it brief for now.

96

97

I utilize [[https://librewolf.net/][LibreWolf]] as my primary browser - a custom version of Firefox with

98

sane defaults and privacy-respecting settings.

99

100

When required, I use [[https://www.torproject.org/][Tor]] to access onion sites and/or browser sites with

101

marginally better privacy and anonymity.

102

103

* Cloud Storage

104

105

This will be a short section, as I don't actually use "cloud storage" as we know

106

it. After years of testing and using various providers, I have settled on

107

[[https://syncthing.net/][Syncthing]] with a network of all my personal devices (>= 3 devices at all times).

108

109

Previously, I tested Tresorit, pCloud, Proton Drive, Internxt, MEGA, Filen, and

110

Ente. However, all of these require /some/ level of trust in the provider. I also

111

used [[https://cryptomator.org/][Cryptomator]] to encrypt files *before* they reached the cloud provider, so I

112

could use anyone and still feel safe.

113

114

However, they all eventually provided one shortcoming or another and I settled

115

on Syncthing with *relays turned-off*, as that is what makes the most sense for

116

me.

@@ -0,0 +1,116 @@
	1	#+title: 🌱 privacy
	2	#+slug: privacy
	3	#+description: Privacy is of the utmost importance.
	4	#+date: [2026-07-01 Wed 12:23:42]
	5
	6	/Privacy and security often overlap, so I have combined them here as privacy
	7	relies on security./
	8
	9	* Passwords
	10
	11	For all passwords, I generate and store these within a [[https://bitwarden.com/][Bitwarden]] vault. I chose
	12	Bitwarden due to its open nature and plethora of clients. If I didn't have to
	13	maintain passwords for my family, I would prefer a solution like [[https://keepassxc.org/][KeePassXC]] and
	14	would sync it via Syncthing.
	15
	16	When possible, I prefer a [[https://bitwarden.com/passphrase-generator/][passphrase]] over a [[https://bitwarden.com/password-generator/][password]]. However, some sites have
	17	short password length limits and a random string of characters may be better.
	18
	19	** Multi-Factor Authentication (MFA)
	20
	21	In order to protect my accounts, I enable MFA whenever possible. My personal
	22	preferences are:
	23	- Passkey
	24	- TOTP
	25	- Email (begrudgingly)
	26	- SMS (almost never)
	27
	28	Personally, I use a combination of [[https://apps.apple.com/us/app/bitwarden-authenticator/id6497335175][Bitwarden Authenticator]] for TOTP codes - a
	29	standalone iOS app that I keep logged out - and the Bitwarden vault's native
	30	TOTP and passkey functionality.
	31
	32	This ensures two separate locations for TOTP secrets, in case one is lost or
	33	otherwise inaccessible.
	34
	35	* Email
	36
	37	While email is inherently not a private communication channel, due to its
	38	unencrypted nature on any sender's or receiver's servers, it's still a central
	39	method of communication today. Therefore, it's important to take steps to make
	40	it marginally more private.
	41
	42	First, I choose an email provider that values privacy. This excludes the major
	43	providers (Google, Microsoft, Yahoo, etc.) and requires us to look at other
	44	options. Popular email hosts in the privacy community include Proton Mail, Tuta
	45	Mail, and Mailbox.org.
	46
	47	However, I chose a different path. I registered my own domain name, registered
	48	with [[https://migadu.com/][Migadu]], and setup custom email addresses on my own domain, such as my
	49	primary email: [[mailto://hello@cleberg.net][hello@cleberg.net]].
	50
	51	This allows for a few unique features:
	52	- Custom domains without limits, so I can utilize any domain I own as an email
	53	domain as well (unlike Tuta).
	54	- I enabled catch-all reception, so I can sign up with aliases at-will. E.g.,
	55	local.store@cleberg.net will deliver directly to me without having to create
	56	that email beforehand.
	57	- I enabled wildcard addressing, so I can reply from any such custom address.
	58	- IMAP & SMTP is supported (unlike Proton), so I can use email clients I trust
	59	([[https://www.thunderbird.net][Thunderbird]] & [[https://neomutt.org/][NeoMutt]]).
	60	- Domain forwarding and redirects. E.g., all mail to =*@example.com= will go to
	61	=you@example.org=.
	62	- Based in Switzerland, if jurisdiction is important to you.
	63
	64	I'm waiting for [[https://www.tb.pro/][Thundermail]] to be released publicly so I can test it out and
	65	compare against Migadu.
	66
	67	* Messaging
	68
	69	When it truly matters, I use [[https://signal.org/][Signal]] as my instant messenger. I have tried
	70	others, but settled on Signal a while ago and have not lost faith in them yet -
	71	especially with their helpful username and group chat features.
	72
	73	* DNS & VPNs
	74
	75	On my personal devices, I ensure that I use an always-on VPN. Currently, I am
	76	using [[https://www.ivpn.net][IVPN]] and previously used [[https://mullvad.net][Mullvad]] for years. On my bittorrent server, I use
	77	[[https://airvpn.org/][AirVPN]] because it supports reliable port forwarding via the Wireguard CLI.
	78
	79	For devices that cannot use a VPN, I rely on network-wide DNS from my router. On
	80	the router, I have installed [[https://nextdns.io/][NextDNS]] to ensure any non-VPN devices go through
	81	NextDNS instead of the ISP's DNS.
	82
	83	* Search Engines
	84
	85	I use my own self-hosted [[https://docs.searxng.org/][SearXNG]] search engine at [[https://search.zerolabs.sh/][search.zerolabs.sh]], which "is
	86	a metasearch engine, aggregating the results of other search engines while not
	87	storing information about its users."
	88
	89	When that is not possible (if it's down or a device doesn't allow setting custom
	90	default search engines), I use DuckDuckGo. It's the next best option.
	91
	92	* Browsers
	93
	94	This section could be /massive/ if I detailed every single option and step in
	95	securing a private browser. However, I will keep it brief for now.
	96
	97	I utilize [[https://librewolf.net/][LibreWolf]] as my primary browser - a custom version of Firefox with
	98	sane defaults and privacy-respecting settings.
	99
	100	When required, I use [[https://www.torproject.org/][Tor]] to access onion sites and/or browser sites with
	101	marginally better privacy and anonymity.
	102
	103	* Cloud Storage
	104
	105	This will be a short section, as I don't actually use "cloud storage" as we know
	106	it. After years of testing and using various providers, I have settled on
	107	[[https://syncthing.net/][Syncthing]] with a network of all my personal devices (>= 3 devices at all times).
	108
	109	Previously, I tested Tresorit, pCloud, Proton Drive, Internxt, MEGA, Filen, and
	110	Ente. However, all of these require /some/ level of trust in the provider. I also
	111	used [[https://cryptomator.org/][Cryptomator]] to encrypt files before they reached the cloud provider, so I
	112	could use anyone and still feel safe.
	113
	114	However, they all eventually provided one shortcoming or another and I settled
	115	on Syncthing with relays turned-off, as that is what makes the most sense for
	116	me.

Commit c0efa33fd6

Commit `c0efa33fd6`