#tech opsec

Jargon Overview

This section is a quick review of the computer jargon I'll be using to talk about this project. I don't want to assume any particular level of background knowledge, so if this is over explaining or you know what I'm talking about, feel free to skip this section.

Hardware- The physical computer parts. If you can touch it, it's hardware.

Software- The programs that the computer runs on its hardware.

OS- Operating system; the software that acts as the stage for all other programs the computer runs.

Flashing/Imaging software- Flashing or imaging describes writing a program to a storage medium (like an SD card or USB drive) so that it runs the program when it's plugged in.

IP Address- A string of numbers that acts as your computer's name on a network.

VNC- A desktop sharing system that allows remote control of a computer.

DNS- A protocol that allows computers to translate website names to IP addresses. (more information at https://www.cloudflare.com/learning/dns/what-is-dns/)

Materials Needed

A computer with an ethernet port to act as the server for the Pi-hole; traditionally a Raspberry Pi, but it doesn't have to be. You can use an old laptop if you've got one lying around. I would recommend using this computer only for a Pi-hole, at least at first.

Another computer to flash software & remote access the Pi-hole

A way to flash the Raspberry Pi OS onto the computer. For a typical Pi this is a micro SD card, for another computer, maybe a bootable USB drive.

Software to flash the OS onto the card AKA Imaging software- I personally use the Raspberry Pi Imager

An ethernet cable

Admin access to your wifi network

This guide will be using a Raspberry Pi 4 for the hardware, a micro SD card & USB SD card drive to flash the OS, and Raspberry Pi Imager as the flashing software.

Part One: Setup

Steps in this section:

Make a bootable storage medium (SD card or USB drive)

Connect your Pi-hole computer to the router via ethernet cable

Boot the OS

Enable VNC in settings (optional, but recommended)

Install VNC software on other computer (optional)

Set a static IP address for the Pi-hole computer

Reboot, and check if VNC is working

Step 1: Make a bootable storage medium

Download a flashing software to your non Pi-hole computer (recommended: https://www.raspberrypi.com/software/) and open it

Plug your SD card or USB drive into your non Pi-hole computer

Select the appropriate options, most importantly, select Raspberry Pi OS (64 or 32 bit) for the second option. (If you're not using a Raspberry Pi computer, select No Filtering for the first option), and click Next

Click No for the customization settings (it doesn't affect the functionality of the Pi-hole), and Yes to erase the data on the drive & begin flashing it with the software.

Step 2: Connect your Pi-hole computer to the router via an ethernet cable

DON'T connect the power, just plug it into the router.

Step 3: Boot the OS

Once the SD card/USB drive is done writing & verifying (the software will tell you when it's done), unplug it from the non Pi-hole computer, and plug it into the Pi-hole computer. Turn on the Pi-hole computer, and allow the OS to boot up. This may take several minutes.

(If you're booting from a flash drive, some helpful tips on how to do it properly can be found here https://www.digitalcitizen.life/boot-your-windows-10-pc-usb-flash-drive/)

Step 4: Enable VNC in Settings (Optional)

VNC will allow you to remotely access and control the Pi-hole when you're on the same wifi network. I highly recommend VNC, as it removes the need to have a screen, mouse, and keyboard for the Pi-hole.

Go into Preferences (top left corner menu) and then Raspberry Pi Configuration

Go to the interfaces tab, and turn on VNC, and click OK

Step 5: Install VNC Software onto non Pi-hole computer (Optional)

VNC software on the non Pi-hole computer is a necessity to remotely connect.

I recommend RealVNC https://www.realvnc.com/en/connect/download/viewer/

Step 6: Set a static IP for the Pi-hole

Setting a static IP does two things:

It allows much easier connection via VNC, since the IP of the computer stays the same

It allows you to input the Pi-hole's IP into your wifi settings to ensure that your devices are all using the Pi-hole

Click on the wifi information on the top bar, and select Advanced Options, and then Edit Connections at the bottom of the drop down

Select the ethernet (wired) connection, and then the settings icon at the bottom

Go the IPv4 tab, and change the connection method to Manual

Input your chosen IP address (will usually look something like 192.168.X.XX), the netmask (usually 24), and the gateway address (your router's IP address, can be found on your router's login page), and click Add. Then click Save.

More on selecting an IP address can be found here:

Set static IP for Raspberry Pi: https://raspberrytips.com/set-static-ip-address-raspberry-pi/

How to find your router's IP address: https://www.howtogeek.com/233952/how-to-find-your-routers-ip-address-on-any-computer-smartphone-or-tablet/

Reboot the Pi-hole for the changes to take effect.

Step 7: Check if VNC is working (Optional)

Open RealVNC on your non Pi-hole computer

In the bar at the top, input the static IP from step 6, and click Connect. This should open up a remote desktop of your Pi-hole.

Part Two: Installation

Steps in this section:

Install the Pi-hole software

Access the web interface

Step 1: Install the Pi-hole software

Open the terminal (the icon with the carat and line in the upper left corner of the screen), and type

curl -sSL https://install.pi-hole.net | bash

PLEASE read the github page (https://github.com/pi-hole/pi-hole/#one-step-automated-install) for more information

Follow the installation steps in the installer

Select eth0 (ethernet/wired) connection

Select any DNS provider you'd like; I personally use OpenDNS (cause fuck google), but any option should work

Select Yes to install the basic block list

Select Yes to install the web interface

Select Yes to install additional packages for the web interface

Select Yes to enable logging, and select any option you'd like for privacy.

When everything is done installing, take a picture of the final screen. This screen has your web interface address and initial web interface login password. We'll change it in the next step.

Step 2: Access the web interface

On your non Pi-hole computer, open a web browser, and type in the IP address from the last screen on the Pi-hole set up

Enter the password from the last screen, it should open the web interface

Let's change the login password to something that we want. Open RealVNC and open the Pi-hole desktop. Open another terminal window, and in the command line, type:

pihole -a -p [newpassword]

Replace [newpassword] with whatever you want your web login password to be

Congrats! You now have a Pi-hole on your network. Let's make sure that your other computers will use it.

Part Three: Customization

Steps in this section:

Changing router DNS settings to make sure it's using the Pi-hole

Adding blocklists

Step 1: Changing router DNS settings

Go to your router's login page (type the IP address of your router into the search bar in your web browser) and log in.

NOTE: I'm using a Netgear router, different interfaces might function slightly different. I'd recommend a web search on how to do this for your particular brand of router.

Go to the Internet tab, and scroll down till you find the Domain Name Server settings. Select Use These DNS Settings, and input your Pi-hole's IP address into the selection box. Select Apply, and wait for changes to take effect.

Step 2: Adding blocklists

Blocklists are how the Pi-hole determines what to block on your network. The basic list that's added in the install is pretty good, and you don't have to add any other lists. I personally use the list set below:

https://v.firebog.net/hosts/AdguardDNS.txt

https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt

https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt

https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

To add these to the Pi-hole, copy the links above, and go to the web interface. Click on Adlists in the left column, and paste the above links into the Address box.

Update the Pi-hole gravity list by opening RealVNC, opening the Pi-hole desktop and terminal window, and typing:

pihole -g

Click enter, and wait for the lists to update

Technology Logins

The general rule for a safe login is to NOT use biometrics. Yes, they're convenient, and yes, they are unique to you. But they're also easy to acquire, especially for law enforcement. There have been multiple court cases asking whether or not it's legal for police to force you to give up biometrics, with differing (1) opinions (2).

Either way, it's safer to just have a password or PIN on your phone and computer than use biometrics. Police cannot force you to give up those.

(1) https://www.forbes.com/sites/thomasbrewster/2021/11/29/fbi-no-consent-required-for-forced-phone-unlocks-via-finger-or-face/?sh=56cf3a641e4e

(2) https://www.thomasianlaw.com/blog/2021/october/can-police-force-me-to-unlock-my-phone-/

Secure Messaging Apps

Most messaging services that folks use are unencrypted, and the companies who run them can and will turn over those texts to law enforcement when asked. Encrypted messaging apps, on the other hand, are much more secure & are less likely to hand over what information they do have. The two that I recommend (and have personal experience with) are Signal (3) and Wire (4).

More folks (at least in the states) use Signal more frequently, but I personally prefer Wire since you can use a phone or email to sign up. Signal requires a phone number.

(3) https://signal.org/

(4) https://wire.com/en

Secure(ing) Web Browsers

There are several options for secure browsing. The classic secure browser is Tor (5), but if you don't want to switch all browsing over to Tor, the best option is Firefox (6). I use Tor for very secure browsing, but do my daily work on Firefox with a bunch of add-ons to increase privacy. Both are also available as mobile apps. My recommended privacy add-ons are:

(Links lead to Firefox Add-on page)

Ublock Origin (Link)

Adblocker Ultimate (Link)

AdNauseum (Link)

Decentraleyes (Link)

Disconnect (Link)

Don't track me Google (Link)

DuckDuckGo Privacy Essentials (Link)

Facebook Container (Link)

Ghostery (Link)

Privacy Badger (Link)

Privacy Possum (Link)

Trackmenot (Link)

(5) https://www.torproject.org/

(6) https://www.mozilla.org/en-US/firefox/new/

Scrubbing Photo Information

Posting photos & videos is an important way to get information about harm in communities, police violence & misconduct, protest information, and general communication. However, being identified in such media can pose massive risks, up to and including incarceration and death. Video editing has many more components to it (audio editing for security, blurring faces across multiple frames, etc.), so this post is mostly focusing on photo information removal.

The amount of information to remove will depend on many factors, but when in doubt, err on the side of caution.

There are 2 types of information to remove:

Identifying information in the photo itself (faces, phone numbers, identifying t-shirts)

Metadata within the photo itself (when/where it was taken, on what device, etc)

A convenient online tool to remove both of these is CodiTools' Image Scrubber (7). This tool is specifically made for removing information from photos taken at protests, and has blurring options as well as metadata removal.

(7) https://coditools.com/tools/image-scrubber

Making a Faraday Cage

A Faraday Cage (8) is a container that blocks electromagnetic fields. Your phone & other tech uses EM fields to communicate. When attending protests, it's usually advisable to leave your phone at home. While this is definitely the best option, sometimes that's not possible or safe. A portable faraday cage or pouch will block all signals in and out of your phone.

To sum up a Faraday Cage, metal (like a trash can or aluminum foil) messes with the EM fields. Surrounding your phone with several layers of aluminum foil is one way to go, but there's several (9) other (10) methods as well.

(8) https://en.wikipedia.org/wiki/Faraday_cage

(9) https://www.pcmag.com/how-to/how-to-make-your-own-faraday-cage

(10) https://www.askaprepper.com/10-faraday-cages-you-can-make-at-home/

VPN's

VPN's are useful for an additional layer of security, since they redirect & encrypt internet traffic. I don't have a ton of experience using them, but the two that I've found the most helpful are Proton VPN (11) and RiseUp VPN (12). Both have a free option, so no need to commit to paying.

(11) https://protonvpn.com/

(12) https://riseup.net/en/vpn (has more information on what a VPN is and how to use it!)

Overview

Rule 1: Don't use biometrics for logins

Rule 2: Use encrypted messaging apps for sensitive conversations

Rule 3: Secure your browser traffic

Rule 4: Don't post identifying information- for yourself or others!

Rule 5: Make sure you have a way to deactivate your phone- turning it off doesn't count!

Rule 6: Use VPN's to increase security