The struggle is real my friends. Everyone seems to want online privacy, or at least be concerned about it. There are a number of sophisticated and easy-to-use tools to help people achieve more of it. Yet it still seems almost impossible to attain any decent level of privacy. Why is that? It’s a question that has been hounding me lately, so I wanted to work out my thoughts with you.
Not For Lack of Trying
If you’ve been around here before, you might remember that I went on my own personal journey to better privacy. During this time I took a look at a few key areas of my digital life and resolved to make changes towards gaining more privacy. More than a year since starting that, I find myself struggling to maintain many of those resolutions. That’s partly due to my own fickleness, but mostly I’ve encountered a factor I didn’t account for: literally everyone else in my life. As mentioned above, there are some great tools for increasing privacy these days. However, no man is an island, and the success of many of those tools requires the participation of those you regularly interact with. Probably the area where this has become most evident for me is that of messaging. I set out to use Signal as my default messaging app. It is end-to-end encrypted, can be used on both iOS and Android, and has desktop clients as well. I viewed this as an easy win for privacy in my conversations, but it turned into a big fat nope. I couldn’t get anyone, ANYONE, interested to a significant degree. And the same story has been reiterated to me from other privacy-minded folks who have made similar attempts. The majority of the population is content to use either apps made by known data-hungry companies (ie Facebook) or antiquated text messages. I’ve found similar struggles with other communication services, such as encrypted email.
Even aside from communication services, though, or tech that you use solely on your own, there is still a problem. Let’s say that you’re completely devoted to privacy, full tin hat level, but your spouse or family members aren’t on board. They could be regularly transmitting information concerning you across any number of services that you wouldn’t dare use, and there isn’t a lot you can do about it. And beyond even family, work at some point will ask you to transmit sensitive information (for benefit enrollments, etc), or you will purchase a home and need to send in documents with sensitive information. Odds are they will be using services that are not privacy focused. (I’ll save my rant for how documents are passed around via standard email for another day.)
Even with all of the modern tech we have in 2020, the majority of the population is still using antiquated or data-hungry solutions. And your life touches theirs at some point.
There Is Awareness
Why is this an issue? As mentioned at the start, it’s not that people are unaware. I’ve never seen a time where online privacy was more openly discussed among people in my life that aren’t even technical. Major companies such as Google and Facebook have even come under great scrutiny in recent times, all but being openly investigated for their privacy practices. So why is it that the majority of people still use solutions that compromise privacy, and thereby make it more difficult for you to escape them as well?
I’ve come to decide there are a couple of reasons for this. First, they have some level of awareness but don’t really see the depth of the problem. There are a lot of problems in the world (especially this year), and so privacy takes a back burner. They either register it as less important or, worse, impossible.
However, the other reason that people don’t do more, and I would argue the most prevalent one, is that they simply just don’t care. It might be said that this is still related to not seeing the true depth of the problem, but I’ve been shocked at the utter apathy people have regarding privacy. For many, so long as the tech does what they want it to, is easy, and is convenient then that is enough. There is little to no concern about what means are justifying the end. To this day I’m honestly not sure how to approach this. It’s very difficult to present any kind of solution to someone when they don’t see the problem it’s meant to address.
As a result of this, it’s very difficult to carve out meaningful levels of privacy. I’ve had to table many of my aspirations and find a hybrid solution, using private tools where I can and compromising where I have to for the sake of communicating with everyone else.
I don’t want to pretend like privacy is the ONLY consideration. There are certainly a number of tools that just aren’t developed enough to be used by the populace at large. Sometimes we techies have to step back and realize that just because we are okay re-configuring DNS for our household doesn’t mean Joe on the street even knows what DNS stands for. I get that. What I’m speaking to here is the presence of easy-to-use apps and services that are completely ignored for their more popular, data-hungry counterparts.
I have no solutions in this post, only observations. At the end of the day I think all we can do is make the best choices possible with the knowledge and means available to us. My hope is that as the awareness of privacy issues grows, and the maturity (and therefore adaption) of privacy-focused services increases, that it will just become part of the common consensus that these are the types of things we should be using. DuckDuckGo has been a great example of that the last couple of years, and I applaud their success. Here’s hoping for many more stories like theirs.
There is a lot of potential for privacy-focused apps and tools these days, but until there is mass adaption by the general populace their effectiveness is very hamstrung.
From the outset, Apple’s HomeKit intrigued me. Over the years we have gradually become great fans of the Apple ecosystem, always appreciating the level of quality and smoothness that they bring to their products. Also, I was just very excited about the smart home trend in general and the possibilities that it brought. I’d hoped to build a seamless Jarvis-like experience with Apple’s HomeKit as the stable and secure foundation.
Before long, however, it became clear that Apple’s home automation system and accompanying digital assistant weren’t where I needed them to be for full adoption, and competitors like Alexa were way ahead of the game. So I jumped into the smart home game with Amazon’s devices, always looking back over my shoulder wondering if I should have waited for Apple.
Sensing the Need for Change
If you’ve read any of my previous posts on digital assistants, you know that their privacy concerns is something that weighs on my mind. This is something I wrestled with and came to some level of peace with in the end, but it never completely sat well with me. We were quite happy with the functionality of our various Amazon devices, but a part of me always wondered if they were leaking more of my family’s life than I was comfortable with. Amazon has pledged to take steps to protect your recordings from being listened to by random employees or others, but in the end they are still tied directly to your account.
There is also a noticeable difference in the experience between HomeKit and Alexa. Knowing that part of me still wanted to be on HomeKit, as much as possible I had bought devices along the way that would work with either system. Because of this I was able to do a lot of comparison between the two. Below are some of the major areas that made HomeKit stand out for me:
Responsiveness: With Alexa or Google everything works over the internet. Your devices must be able to talk to Amazon, which must be able to talk to the device providers’ servers. This creates a lot of unnecessary steps for something as simple as turning a lamp on or adjusting the thermostat. When your ISP is fast and everyone’s servers are working correctly it isn’t typically a problem, but we had more experiences than we liked where the device was sluggish or simply unresponsive (including when the internet is completely out). By contrast, Apple’s HomeKit works locally on your home network, cutting out the middle man. When a device was unresponsive via Alexa I’d go to the Home app on my phone and usually still be able to manage it, so I knew the device itself was not the issue. For the same reasons, it’s also much faster to turn a light on or off through HomeKit. The response is almost instantaneous. Apple isn’t perfect and sometimes there were issues with it as well, but they were by far the minority.
SmoothIntegration: I can’t really fault Amazon for this, but as I said we are a mostly-Apple household. It’s unsurprising then that Apple’s system integrated much better with our lives. The Home app is built right into our laptops, tablets, and phones. We can easily control things directly from our watches. Devices are able to tie into many of the things already in use in our daily life. Amazon has a decent app (which has come a long way) but the level of integration is lightyears different. In reality it’s probably just fractions of a second, but it becomes very annoying to open up the Alexa app, fish through menus, and wait for its delays in order to interact with devices. In my experience, any time you’re trying to chain together third party services the experience is going to feel bolted together or clunky. It’s no less true here. The Amazon ecosystem worked, but it was clunky.
Privacy: I’ve already touched on this, but privacy was a huge motivator for me. In short, Apple doesn’t attach your voice recordings and information directly to your account. Instead it uses random identifiers. While this sounds like a small difference it really leads to a much greater peace of mind. In both situations there are soundbites of my family out there on someone else’s servers, but with Apple they are disassociated from us. They are random clips in a sea of other voices instead of being hyperlinked directly to me. Not that I have anything to hide, but you never know how pieces of conversation can be taken out of context or taken offense to. If something is sitting there listening to me, it’s better knowing that it’s not also yelling to the world who said it. The same goes for video recordings. We had been using a Ring doorbell and as part of the change went with Eufy instead. Now my videos are either using HomeKit Secure Video (stored in my iCloud account) or stored locally in my house. No more risk of Ring employees having their laughs at them.
With all of the above in mind, I decided to finally take the plunge and revert to the HomeKit-only journey I’d originally set out on. It helps a lot that HomeKit, Siri, and the rest of Apple’s home automation have come a long way in the intervening years.
So I disconnected our Amazon echoes and unplugged non-HomeKit smart plugs. Despite my intense frugality I purchased HomePods. We removed the Ring doorbell, as mentioned above, and installed equipment from Eufy. Since I had kept one foot in the HomeKit door, the changeover was surprisingly painless. The most difficult part was physically mounting cameras.
I was worried at first that we would miss some of the functionality that we’d come to enjoy in the echoes, like using them as intercoms between rooms. This has surprisingly been a non-issue. If we need someone we just yell down the stairs like families did in days gone by. Seriously though, there has not been an Alexa feature that’s offset the extra peace of mind and pleasantness of a smoother experience.
Altogether I couldn’t be happier with the change. The level of quality and smooth experience is higher, as I knew it would be. I have a peace of mind knowing that I’m doing everything possible to protect our privacy while living in a world of devices that listen to us. And all of our things work together in a very enjoyable way, as one would expect inside the walled garden. I find that Siri is still behind others in some regards, but the 2020 version is more than capable of what I need her to do. And the fact that she’s got my back in regards to privacy makes up for a lot.
Your mileage may vary if you’re not already invested in the Apple ecosystem as we are, but I’d still encourage you to give HomeKit a chance. The older I get the more I decide that a little extra monetary cost and a slower pace of development are well worth it for a result that is high in quality and well thought out. That has certainly turned out to be the case once again in this situation.
We live in an interesting time where business have suddenly been forced into a remote work model in order to stay profitable during the COVID-19 crisis. Because of this, many people have now been thrown into a work from home situation (whether it’s something they wanted or not).
I’ve worked from home on and off for the majority of the last decade. Along the way I’ve found some things that helped me be more successful and productive with this form of work (as well as some that didn’t). So I’d like to share with you some quick tips from my experience. I hope they help!
Keep the same schedule that you always have. This seems counterintuitive. At first you’re looking forward to sleeping in longer now that you don’t have a commute, have to look decent in front of people, etc. You’d like to take that extra time and enjoy it as a perk of your newfound freedom. Don’t. Staying in the same rhythm has a passive psychological effect that will make you feel more productive and on top of things. And if you end up going back into the office eventually your schedule won’t be thrown completely off. Find productive ways to fill that extra time, or snuggle with the kids a little extra before starting the day.
Wear real clothes. Speaking of looking decent, continue to do that even if no one will see you. When I first started doing WFH I rocked the jogging pants and Crocs like no one’s business. I was at home and I was going to be comfortable. But it doesn’t take long to start feeling like a slob. After getting up on schedule like mentioned above, clean yourself up and put on clothes you’d be proud to be seen in. That doesn’t mean you have to wear a suit, but leave the yoga pants in the drawer. Just making yourself look presentable makes you feel ready for the day and its challenges. It also saves some embarrassment if you need to jump on a video call.
Take breaks. WFH can strangely lead to you working too much. Without John the Jokester to derail your train of thought for an hour, you plow right through your morning assignments and realize four hours have passed. It’s lunch time and you never went to the bathroom, much less had a snack. Build in regular breaks to your routine. Your body and brain will thank you. I also find it helpful to stretch and/or do some light exercise during these times.
Be ergonomic. Even though you could totally work from your couch all day, your body will thank you again if you don’t. Find a desk, sitting or standing, at which you can work in an ergonomic style. Take advantage of your ability to work in unique places where there is sunlight, etc, but save your neck by not craning it downwards at your laptop screen with your feet propped up.
Have a dedicated space. This will be more difficult for some than others depending on the layout of your home and how many people you share it with. But as much as possible, find a place to dedicate to work. Just like with clothes and schedule, this has a subtle mental effect. When you’re there you’re in work mode, and when you leave it’s easier to disengage from that. Make sure up front that your family or roommates know and agree to this as well. Having them respect your workspace will make you all happier in the long run as you will be more productive and easier to get along with.
Stop when work stops. When working from home there isn’t a natural stopping point where you see all of your colleagues leaving for the day and you all have the usual end-of-day routine together. It’s also easy to remember at 8pm that one thing you forgot and just grab your laptop to knock it out quickly. Resist the urge. Very quickly the lines between work and home blur and you become discontent, feeling like both work and home are being cheated. Give work your all during work hours, and then give yourself and your family your full attention after 5pm.
Just because your kitchen is down the hall doesn’t mean you should visit it frequently. It’s far too easy to tank up on snacks when you’re home. After all, you literally picked the food selection and it’s right there. Maintain self control, both your mind and body will feel better. Your body because of the fewer calories circulating through it and your mind because you’re being disciplined even in the midst of temptation.
Recruit your family as your team. It can seem daunting at first to try and be productive with your family around, especially now with schools also being closed at the same time. But we homeschool our children while I work here and have been very successful with it. The key is to get everyone onboard as teammates. Be intentional about talking to them of the importance your work has, both for you and for them. It can seem to them like it’s playtime since you’re home, but work still has to get done. My wife and kids have been incredible at respecting my space, respecting my time, and doing everything they can to set me up for success. This is crucial, and I couldn’t do it without them. She created a green/yellow/red sign on my door so that they know whether I’m available or not. This allows them to not feel like I’m locked away but still be aware of when I need to not be disturbed.
Communicate proactively, and over communicate. You will quickly find that it is easy to get out of sync with others or to feel underrepresented. It’s just the nature of physical separation. You can’t yell over the cube wall to ask a quick question, and your boss doesn’t walk in the room as you’re doing something awesome. Make sure you’re communicating proactively when you have a need or successes to report. Don’t let this be the time when you become a person of few words. Refrain from blowing them up with text every few moments, but when you do need to bring something up make sure you’re being proactive and descriptive. There is a gulf left by the lack of proximity and body language, or even voice tone. Be sure that you’re being heard and that the message you’re intending to communicate is the one they’re hearing. Also, with everyone being in their own silos, hours can go by without realizing you haven’t really interacted with others. If you’re more of an extroverted person this can begin to make you feel very unhappy. Utilize the great technology that we have available today for both chat and video conference options. Don’t wait until there is a specific work need, reach out to your friends and colleagues just to be social.
Have fun with it. Now that I’ve gotten all of the serious warnings out of the way, I’ll hang an umbrella over it all to enjoy yourself. Keep in mind all that I’ve said above, but also don’t forget to enjoy the benefits that this unique situation brings you. Take those breaks and play with your kids. Have your favorite coffee instead of the cheap stuff served at the office. Sit in sunlight when you’d normally be in a dungeon. Spend extra time in the morning and afternoon with the ones you love instead of being on the road alone. Being around them more has a profound way of reminding you what you’re doing all of this work for anyway.
Over the last few months I have been on a journey to better privacy. During that time I’ve gone over search, browsers, social networks/messaging, digital assistants, and email. This is not an exhaustive list of all the areas where online privacy is concerned, but it’s the primary ones that had not yet been addressed in my life. Now that we’ve gone over each of those areas, and I’ve had weeks to months to live with those decisions, I want to wrap things up with the conclusions I’ve come to over the course of this journey.
In my mind you have a range of choices when it comes to privacy. As with all things in life there is a pendulum, and you can choose to live on either side of that or somewhere in between. Let’s go over the basic options at each of those levels.
If you want complete privacy online, below are your options.
Don’t use the internet.
That’s it… I’m not kidding. If you want to avoid being snooped on then you literally cannot touch the internet in any way. This isn’t limited to computers and tablets. You should avoid using any type of electronic payments, opting for cash only. Any type of phone usage can be tracked as well. Honestly, I’m not sure you can fully avoid being tracked without going completely off grid (and maybe not even then).
Take home point: if you’re going to use the internet then you’re going to forgo privacy on some level.
So you’ve decided that living in the woods and drinking your own urine is too high a price for privacy? Good choice, but that means you’ll be interacting with the internet on some level. Maybe you still want absolutely as much privacy as possible, regardless what that means in the way of inconvenience. Your options will probably look something like this:
Use an operating system that doesn’t signal back to its maker. (Probably a flavor of Linux, but not all of them are considered privacy conscious.)
Whole-home VPN (I didn’t go over this, but basically you configure your router to funnel all traffic through a tunnel.)
TOR (This is a system that somewhat anonymizes your internet traffic.)
Alternate DNS settings (avoid using your ISP’s or Google’s)
Web browser that uses all the addons I wrote about, plus others like NoScript.
Move your email to an encrypted service like ProtonMail.
Use a password manager, probably an offline one.
If you want to be super safe, do all this from a virtual machine on your computer instead of on the computer itself.
If it hasn’t become clear yet, this is a giant hassle. Aside from the time and frustration that will go into setting it all up, your network speeds will also be slower and you will constantly (CONSTANTLY) run into issues with sites not working correctly. And here is the kicker, you may still be tracked. Technology is always changing and we’re often not even aware of the most advanced methods until years after they’ve been used. You can totally take this approach, and there are people that do, but be prepared to put in the work. It may also make you a gleaming target as someone who is trying to hide something.
If the above approach is more involved than you are ready for, there are ways to increase your privacy while still achieving a reasonable level of usability. This is basically the balance I’ve been trying to strike throughout the series, not being completely locked down but not throwing my data at people either. Here is what I see as the best approach:
Use a VPN service when traveling or on public networks.
In my mind this allows you to interact with the internet, but with safeguards in place. It’s the sweet spot.
The other side of the pendulum is not caring about privacy at all. Many (maybe most) take this approach. They either aren’t conscious of the amount of data they’re giving up or assume there is no use trying to stop it. This is certainly the easiest way to approach things, but not one I can agree with. Firstly, your information is obviously valuable. The companies trying to syphon it are making billions off of it. Secondly, you have no idea how long they will keep the data and what they’ll do with it, either now or in the future. Privacy is a human right, and the onus is on us to fight for our own.
Honestly, this journey hasn’t gone completely as I expected. There were a few areas where I started out with an assumption as to what I would do and changed my mind as I researched it. Also, things are constantly changing. I made some posts and later had to return to update with a different conclusion after reconsideration. In the end I think it’s less about choosing a specific set of technologies and more about having a privacy mindset. Look deeper into offerings, not focussing on only features and price but also how they are respecting your privacy. Make sure you’re using secure services. Know that social networks, among other things, are free for a reason. You are the product.
But also, don’t forget to have fun. There is a lot of really great stuff out there and a wealth of opportunity on the internet. Keep your safeguards in place but don’t let fear limit you.
If you’ve been following along, then you know I’m on a quest to increase privacy across my digital life. The next stop on that journey is email. This system of communication has become so ubiquitous that we hardly give it much thought. We communicate over it with service providers, friends/family, random blogs, and any number of other entities. Since it’s a digital form of communication some get a false sense of its security, but that couldn’t be farther from the truth. Let’s take a moment to look at the current state of email in 2019.
How It Works
It’s sometimes easy to take for granted how digital communication works these days. We assume that what we’re writing is only being seen by ourselves and the intended recipients. But that isn’t necessarily true, especially in the case of email. In fact, it might be helpful to visualize email as more akin to its physical cousin, snail mail. A friend of mine once said it’s best to consider any email you send to be like a postcard. When you send a postcard it is secure in your house, and therefore somewhat safe. You then place it in the mailbox and send it off through the post office routing system. Along that route it passes through many hands. Those who have malicious intent, or are just nosy, could read it any time they want. Eventually it comes to your recipient’s house, where it is then again somewhat safe due to being in their residence. The same is true with email. Your mail provider places a lot of effort into securing their servers with encryption and other measures. However, once your email leaves there and is being routed to the recipient’s mail it is open and vulnerable. Once it arrives there are measures that keep it safe on the destination as well, but in between it’s basically completely open. Besides all of that, your mail provider likely uses data mining on your emails in order to serve you targeted ads. So even when the email is “safe” it is still being accessed by other parties.
The lesson here is that email should NEVER be considered private. Don’t put anything in email that you wouldn’t put on a postcard.
There are some options for locking down your email and making it secure. Mostly this means using an encrypted service. Providers such as ProtonMail (great review here) offer end-to-end encryption, meaning that even they can’t see your email. There is a web client to securely access the service, or you can download their mobile apps. There are shortcomings in comparison to the convenience you’re used to (such as searching for a subject), but overall it’s a great way to secure your email.
If it’s so great, why isn’t everyone using it instead of data vacuums like Gmail? Well, there are reasons. Remember our postcard scenario? Imagine if you sent someone a postcard and they received it just fine but couldn’t read it. With secure email services your recipients cannot read your emails unless you provide them with a password or public key to decrypt the messages. There aren’t a lot of friends that would do that just so they can receive email from me, much less people I barely know.
Also, your email is now sitting on their provider’s servers. Even if ProtonMail takes steps to ensure they can’t read your email it doesn’t mean your friends’ service lives up to the same standard. And any email they send to you will definitely have all of the same pitfalls of normal email. Plus, if someone forwards the email on then all bets are off.
Lastly, if you forget your password then all of your email is lost to you. This is the blessing and curse of ProtonMail not having access to your mail. They can’t snoop on you, but they can’t recover it for you either.
So, what’s a privacy-focused nerd to do? Even though services like ProtonMail aren’t as easy to use as traditional ones that doesn’t mean you should ignore them. As the funny taco commercial once said “Por que no los dos?”. Use ProtonMail for sensitive business emails or personal ones containing identifying information, and keep your usual service for all the spam you get from Old Navy and emails coordinating pot lucks. If you want to keep those from being data mined, swap to something like an iCloud address. It’s run by a major corporation too, but they don’t scan your email the way Google or Microsoft does.
Personally, I already stay away from putting anything in email I don’t have to. I prefer to use secure messaging systems for personal contacts (iMessage or Signal). If secure information needs to be emailed, you can always place it on a cloud storage service that is encrypted and then send them its link. This reduces the amount of storage being used on both email services (sender/recipient), lets you configure the link to only be accessible to certain individuals (either read or write), and lets you bypass the insecure digital postal system already discussed.
Be mindful of what you’re sending and how. And choose the option that works best for your situation.
After more consideration I decided to go all in on ProtonMail. And you know what? It was completely painless. At the moment I’m using the free tier, but will likely bump up to the paid one soon (Same with their ProtonVPN service). Everything is working great, but there are some nice perks when you upgrade. Also, you help support their mission by being a paid subscriber, and creating a web where we are free to communicate privately is a mission I believe in.
I’ve forwarded my other data-hungry accounts to it and started swapping services one at a time. So in the end not only is my email more secure but I’ve also achieved a secondary goal of consolidating the mass of email accounts I’ve collected over the years.
You don’t have to use ProtonMail (well, you don’t have to do anything) but I would advise joining the private email movement. It’s really very little effort for the return you and the rest of the internet community receive in return.
Since the time I was a child the idea of robotics and automation has appealed to me. When digital assistants started to hit the scene I was stoked. I imagined myself controlling my home like Tony Stark with Jarvis. I tried to hold out for a good Siri solution, knowing that Apple makes quality products and that they are generally more privacy focused. But $400 is way too high for a smart speaker and Siri, bless her heart, is way behind the rest of the class in terms of intelligence. I ended up going with Amazon’s Alexa and have really enjoyed the experience.
At this point in time my investment in the Amazon Echo ecosystem is not insignificant. We are the owners of the full-size Echo 2, an Echo Spot (the alarm clock one), and the 2nd generation Echo Dot (the hockey puck). I even had a second Dot, but have since gifted that to my in-laws. Added up that’s a decent dollar investment (but still hasn’t reached the price of one Apple Homepod). With these devices I’ve been able to have music that plays throughout our house, control a number of lights by voice, have a simple intercom system, and more. An additional perk is that it lets my kids easily do things like turn on the lights in the scary basement from upstairs.
All of that to say, I have good reason to consider the privacy implications of digital assistants. And it could also be painful for me should I need to make a change. So you know I’m taking this seriously.
What Is The Worry?
After the initial rush of excitement surrounding digital assistants and their potential, a number of years have passed and important questions have come up in the mean time. Many people ask, if something is always listening for me to speak is it recording everything I say? Secondly, what is done with the recordings once your choice of tech companies has it? How long do they keep it? Perhaps most important recently is the question of human interaction. We always assumed that only machines interacted with our recordings, but it turns out that people do as well.
Some of these concerns are valid and some simply aren’t. Let’s start by taking a look at how these devices work, and that will help us separate out truth from myth.
How It Works
Honestly, it’s really very simple. In the case of smart speakers, or anything that uses a wake word (Alexa, Hey Siri, Ok Google), the device listens to everything said around it. This happens locally on the device, and it completely ignores anything other than the wake word. When the wake word is recognized, that is when it reaches out to the company’s servers. Any sound during the listening period is recorded and sent up to these cloud servers. That is where all of the smarts are (which is why the devices can have such low power hardware). Using sophisticated language processing, machine learning, etc their systems determine what you’re saying and how to best respond. Any number of things are triggered from there, and whatever you requested happens. That’s it. To summarize: Wake word, snippet sent to cloud, action taken. The companies then take a small percentage of the millions of recordings they receive, somewhat disassociate it from user accounts, and have people work with them to make their language processing smarter.
There are a few key takeaways from this knowledge:
The device dumps EVERYTHING it hears unless the wake word is registered. It is NOT recording everything you say.
The request is processed by machines. No human interaction is involved.
Though people are involved in training the system to be smarter, and that allows them to hear recordings, it is with an astoundingly small portion and your user account is partially decoupled from the recordings at that point.
It’s worth noting that Apple is more privacy conscious with its operations, such as tying recordings to a random identifier rather than your user account and doing as many operations locally as possible rather than in the cloud.
What Concerns Remain?
Having said that, it does not mean there aren’t real concerns. In our experience the devices can wake at very random times where we definitely did not say “Alexa”. At first this is just annoying (and a little creepy). The more you dwell on it, though, you start to wonder exactly what it’s picking up. Some have raised the point that personally identifiable information could be overheard, or bank numbers, etc. Sometimes I wonder if it picks up my children’s conversations. Not that they’re saying anything nefarious, but I don’t really want them recorded. Also, you just never know how anything you say will be taken if heard out of context. In today’s society people get really worked up about opinions they don’t agree with. Who’s to say it won’t overhear a conversation that isn’t politically correct, and then the workers might tie it back to you? What if something is acceptable now but in a decade is practically a thought crime (token 1984 reference)? One should always be careful of what they say, but this adds newer and potentially more dangerous considerations. Words you barely thought about almost instantly become data that is globally distributed and perhaps perpetually retained.
Most companies have built mechanisms to let you delete recordings from your account, but that doesn’t mean they’re completely purged. In the end it’s really up to them how long they’re going to keep the data and what uses they’ll have for it. The recording is on their servers and out of your hands.
After the outcry over having people listen to recordings most of those programs have been suspended. I can’t imagine that will last, though. I’m honestly not certain you can properly train the system without sampling recordings. That’s just the nature of how this technology works. They should have disclosed this better and potentially had their employees act more professionally (like not passing around amusing recordings), but it’s simply a reality.
Considerations For Balance
How much all of this matters to you is going to be a personal choice. Everyone has different thresholds for what they consider to be private conversation and how much they care they’re overheard. In many areas of life my wife is my touch point to reality. I can get very lost in the internal academic debate and become completely disconnected from the real world. While wrestling with these subjects in regards to our own home I asked if it bothered her, and she responded something to the effect “not even once”. Just now I asked her what she thought we should do and she said “I don’t even care”.
Another thing to consider is how deep down the rabbit hole you want to go. If you’re worried about devices listening to you without your permission, stop to consider the ones that are already part of your daily life. Every cell phone (smart or not), laptop, smart watch, and many desktops have mics in them. A bad actor could activate any one of those without your knowledge. It’s already been done before with webcams. Facebook, Google, and likely the goverment already have an astounding amount of information on you from multiple sources, verbal or not. And you could just mute or turn off the devices should you need to have a private conversation.
When you put everything together it’s a balance of obtaining the functionality you want vs the information you volunteer. For me that means, as painful as it is, Alexa and I will have to part ways. I really didn’t want that to be the case, and I even wrote up this article originally stating that I was going to keep her. But that didn’t sit well, and here are the main reasons why:
Conversations unintentionally overheard: There is no way around it, these devices often think you’re speaking to them when you’re not. That leads to us being recorded when our guard is down, and as stated before the information is then out of our hands and within Amazon’s control. For whatever reason this seems to happen much less with Siri, so I’m not as concerned about our phones, etc having it enabled.
People reviewing recordings: Only Apple’s system truly decouples your recordings from your personal information, so theirs is the only one I’m comfortable with in this regard.
There is no feature we can’t live without: We did a week trial without the devices and there was surprisingly little impact. A few smart home tasks are more annoying to do with the phone or watch, but overall life went on pretty much the same. Having the Jarvis effect is fun, but not something I’m willing to trade our privacy for.
No peace of mind: I mentioned this in the web browser discussion too, but peace of mind is very valuable. No matter how much I run over the facts and come to terms with them, something in the back of my mind was never comfortable with Alexa. Being without that internal battle during our week long test was refreshing, and a part of me has known since starting out with Alexa that something felt off about it. Maybe it’s paranoia, or maybe it’s instinct. Only time will tell I suppose.
So going forward the only digital assistant in our lives will be Siri. She’s not the smartest, and the Apple Homepod is absurdly expensive. If they go on sale or Apple produces a lower cost Echo Dot competitor then I’ll jump on board. In the mean time we just use our phones or watches for the same tasks. And if worse comes to worse, we walk across the room and hit a physical button. Turns out that’s still a completely viable option.
A few weeks have gone by since I posted this article and I’ve now changed my position on our Alexa devices. This is because of a couple of key reasons. First, Amazon will let you opt out of having humans review your recordings. Second, I thoroughly reviewed my own article above and concluded that my decision leaned more on the paranoid side than the cautious.
TLDR, all of the information above is still true and valid. But the value vs risk index tips in favor of us keeping Alexa rather than dismissing her, especially as Amazon comes under increasing pressure to make sure she guarantees our privacy. As noted above, my family has received a ton of benefit from using these devices (my children have literally been begging me to put them back). We feel comfortable with the way the technology works and the benefits we receive from using it.
At their September hardware event Amazon announced new privacy measures along with a slew of new products. I’m not saying this makes them 100% trustworthy, but it’s a sign in a good direction.
I’ll never forget when I first started working with SQL Server. After the initial excitement of diving into something new I launched SSMS and then just sat there looking at a blank query window, with no idea what to do next.
I see a lot of questions online regarding how to get started as a SQL Server professional. Either they have an interest in data and are looking to make a career out of it, or very often they’re in an entirely different role and their company throws data responsibilities on them as well. (Many of us are “Accidental DBA’s”.) In either case, it can be a daunting prospect at first.
I’m here to tell you that you’re going to be fine. Not only is there mountains of information available, but there is also a community of data professionals who have been in your shoes and are more than willing to help you find your way. This article serves as a bit of a foothold, a launching point of sorts to direct you toward those resources and get you moving.
This might seem like a strange place to start, but I think it will help you to begin here. We tend to be loners as IT people, hiding in our dark corners and interacting with others as little as possible. But there is a wealth of knowledge out there held by your colleagues, and many of them are eager to share it with you. Your first step as a young SQL Server professional should be getting connected with PASS. This is the Professional Association for SQL Server, and they have a number of resources to help get you the training you need. There are user groups, both physical and virtual, SQL Saturday events, as well as the yearly PASS Summit. Getting connected with them early on in my career was a tremendous blessing to me, and I know it would be to you as well. Half the battle is not knowing what you don’t know, and they have resources for every level of your career whether you’re a complete beginner, intermediate, or advanced.
Also, one thing you’ll learn at PASS is that the SQL Server community is very active online. You can easily connect with them via Twitter or Slack. On Twitter, just search for #sqlhelp. World-class professionals watch it throughout the day to provide feedback and assistance. This includes many of those that speak at PASS Summit and other events.
One last note on community: don’t be afraid to ask questions. Everyone has been new, it’s okay.
There are a couple of resources that I did not find until much later in my career, and I wish I’d had them sooner. One is w3schools. This site gives a great tutorial of the SQL language, and will get you well on your way to making good use of it. A second is SQL Fiddle. This is a fantastic resource, especially for those that do not have a sandbox environment to practice in. It lets you build schemas of various database types (MSSQL, MySQL, etc) and test your query syntax against them. When you’re just starting out with the SQL language, these two sites combined are a great way to practice.
Another great website for new SQL Server professionals is Brent Ozar’s. There is a “Free Fundamentals” section on his training page. He is also well known for his Blitz scripts, which allow you to quickly ascertain the health of a SQL instance and take care of common issues. All of his First Responder Kit is available to download for free.
Also, don’t forget about YouTube. There is a ton of great content out there, including big names like Microsoft and PASS.
Not every learner is the same, but for me books were what first helped me really start to understand SQL Server in depth. The Training Kit and Exam Ref series by Microsoft are very good. The Training Kit is what I used at the time, starting with the one for the exam I wanted to take first. I read it cover to cover, passed the exam, then did the same for the next one. There are a lot of boring stretches along the way, but in the end you cover a wealth of information.
I also see Itzik Ben-Gan recommended a lot, particularly his T-SQL Fundamentals book. Incidentally, he also co-authored some of the books mentioned above.
There are a great many other resources out there as well, these are just a few that I’m aware of and that have been beneficial to me. I’ll be asking the community to contribute to this as well, so stay tuned for updates!
I’m on a journey to improve my online privacy. Search engines and web browsers have already been covered in previous posts. What discussion on this topic would be complete without Social Networks (Facebook, Twitter, Instagram, etc)? I’m also going to include messaging along with them because they often go hand in hand (ie Facebook Messenger).
Why Does It Matter?
Social networks encompass a large portion of our online activity, and ironically are also one of the main outlets through which we hemorrhage data. Besides the risks incidents like the Facebook data breach present, why are we okay with giving the social networks themselves so much data? Even if you follow the argument that you’re a good person and have nothing to hide, it’s still disturbing to have a random party repeat back to you what you ate for lunch. Yet we tell things to audiences of thousands, and that data gets spread to servers around the globe. We have seen in recent history how old year books from high school and college have affected people’s careers. What if a decade from now what you’re freely laughing about with friends is completely socially unacceptable? There is a timestamped record of it anyway, and your picture is likely along with it in full HD. In the same vein, what if laws later change around the governance of that data and third parties such as governments or others can freely access it? The point is, we don’t really know how the accumulated data of our lives is being used today, much less how it will be in the future. Also, studies have shown that social media is just plain bad for you.
What Am I Going To Do About It?
Delete all my accounts!!! Just kidding. I’ve actually been down that road before due to a mixture of privacy concerns and trying to engage with people in person more. In the end I came back, and I don’t plan to delete them again. This may sound outrageous given this post is about privacy, but if you will remember I stated at the beginning of this journey that I was trying to strike a balance between full tin foil hat paranoia and living effectively on the internet in 2019. In my specific situation, I have family and friends scattered around the country and globe. I don’t often get to see them in person, so Facebook is a very effective way of keeping in touch with them. Also, groups we are a part of coordinate heavily through it, such as our Sunday School class at church. I use Twitter, Linkedin, and others to stay in touch with the tech community and post (hopefully) helpful information such as the entries on this blog. So, in the end a complete burn-it-to-the-ground deletion would not be the smartest move for me.
I have found over time, however, that there are ways to severely limit what information I give to social media. The first has nothing to do with technology, it’s discipline. I make a practice of only saying online things that I wouldn’t mind a crowd of strangers overhearing. Sometimes I remember this more than others, but overall the idea is to simply be careful what you say. Second, I use a web browser and plugins that block website components that want to spy on me, including those connected to Facebook’s like button that appears on almost every page. On mobile devices you can use apps such as Friendly to still get the social network content without as much bloat and spying.
There are additional steps I’m implementing, however. This is after all a journey forward, not a review of steps I’ve taken in the past. First, I’m setting a specific time frame during the day to be my social media window. I’ve gotten far too comfortable with randomly accessing it throughout the day the moment I experience more than a second of boredom. I think we would all benefit from learning to curb that impulse, and regaining some of the ability we’ve lost to simply just “be”. Second, in order to help reinforce this first goal I am going to remove the apps from my phone. I’ve tried this in the past unsuccessfully, because I would simply log into the web version. But this too is more about discipline than technology. Tech can make a lot of things more convenient, but our choices are still up to us. As a side benefit, I’m looking forward to increased battery life and mental focus.
As mentioned up front, I’m including messaging in this effort as well. I think it is even more sneaky in regards to our data, because we get the false sense that it’s private. You’re having a conversation with those closest to you, forgetting that any number of unknown entities could at some point access all or part of that conversation. I’m taking the same mitigating steps with messaging as those listed above. But I’m taking one additional step of only using messaging platforms that include end-to-end encryption. That means that your messages are protected on your end as well as the recipient’s, and no one in between (including the company hosting the service) can read them. For me that means using iMessage and Signal. iMessage is only available on Apple products, but Signal is cross-platform.
In the end my choices might not match what makes sense for you, and that’s okay. This approach allows me to stay in contact with family/friends and coordinate with groups who are heavily invested in Facebook as a communication platform. But it also allows me to reduce both the amount of data I put into these companies’ hands and the amount of time their products take away from my life. It also ensures that my personal conversations aren’t snooped on. I’m a boring guy with nothing to hide, but I’d still be creeped out if a stranger asked me about where I went on vacation.
My Recommendation: Firefox, with the extensions HTTPS Everywhere, uBlock Origin, Firefox Multi-Account Containers, and Cookie AutoDelete Privacy Simplified: If you just want privacy out-of-the-box and don’t care that it’s based on Chromium, go with Brave. (Update 04/07/2020: I’ve been using Brave a lot and see great promise in it. I might do a full post about it soon, but in my mind it’s starting to win out over Firefox.) MyMobile Recommendation: Safari with Firefox Focus enabled as a content blocker, or Firefox depending on your preference.
If you read my previous post, you know that I’m on a journey to achieve better online privacy. Much like with search engines, web browsers are something that I’ve been considering for years. I tend to be drawn towards Chrome for its features and the fact that most sites are built to work with it. Then I become more privacy conscious and move to Firefox, with several addons enabled. Some point either after or before that I use Safari because of its integration with my devices (we’re basically an all-Apple house).
I wanted to make a concrete decision this time, though (or at least as concrete of one as can be made when technology changes so drastically from year to year). For that reason, I’m putting my thoughts down in writing and sharing them with you. It’s an accountability mechanism of sorts. Also, I sincerely hope that it benefits you as well.
*One small note before we get started. There are a LOT of browsers out there. I’m only going to cover the top few that tend to circulate through my life and that I think the mass majority would consider.
Almost without doubt, if you’re asking which browser is going to be fastest and work the best it’s Chrome. Depending on which stats you look at, it has up to 75% of the market share, and for good reason.
But, how is it in regards to privacy? After all, its maker Google has come under a lot of scrutiny in that area over the last several years. Even The Washington Post basically called it spyware. They’re an ad business, using their “free” services to collect mountains of data to fuel that business, and Chrome is just a tool to help direct people towards contributing to that. It’s also becoming a bit of a monopoly as well, to the point where developers only code for it to the exclusion of other browsers. For these and other reasons, many (including myself) are highly suspicious of letting it pilot our journey through the web.
However, they haven’t left users completely without options. If you’re willing to look for the options in settings then you can turn off a lot of the snooping. Also, Chrome has one of the richest extension libraries, so you can add a number of those that will greatly enhance its privacy capabilities.
I for one remain too skeptical to embrace it as my daily driver. I truly wish that weren’t so, because it’s probably my favorite overall. But it just doesn’t sit easy with me.
I’m going to be a lot more verbose concerning Firefox, because it is basically the measure by which I will judge all the others. It has a long history of fighting web browser monopolies and is basically a household name at this point. Below are some of the reasons it stands out to me.
Open Source: It is not the only option I’ll discuss that is open source, but it’s probably the most respected in the open source community. I’m not someone who will say non-open-source is evil (I’m writing this from a Mac), but I do think it’s something we should promote as often as possible. This is especially true in regards to the web. At this point in our culture the internet is almost like a utility. It houses essential resources for communication, productivity, education, and so on. It’s my belief that an open source browser from a non-profit company is better positioned to safeguard that than an offering from a large corporation which has special interests.
Defenders of the open web: Continuing off the point above, Mozilla (the maker of Firefox) has a long history and deep commitment to keeping the web open. Because they aren’t selling ad services, they can freely support ad blockers unlike Google is doing. They also sponsor lots of events to educate people on how to interact with, and contribute to, the web community.
Cross-platform: Firefox will run on Windows, Mac, or Linux. You can also have it on Android or iOS devices. If your life doesn’t reside all on one platform (as most people’s doesn’t) you can still use Firefox and sync your data across all devices.
Not Chromium based: Chromium is the open source browser that Chrome is built on. It’s basically Chrome before some Google-specific components are added in. As already mentioned above, Chrome is becoming a bit of a monopoly. There is NOTHING wrong with building a browser on Chromium. Several fantastic browsers do that. However, it further contributes to this monopoly. The more Chromium-based browsers there are, the more developers code to only that platform. This leads to the exclusion of other browsers. When users hit issues they think “Why is this browser terrible?”, not “Why isn’t this site built better?”. This continually funnels more people towards Chromium based browsers, where the sites “just work”. And in the end Google has gained more control over how the web behaves than any one company should have. Firefox, however, uses its own engine and it’s fantastic. For a deeper look at the pros and cons of using Chromium-based browsers, this article is a great read.
Extensions: Honestly extensions are almost what make a browser in regards to privacy. And Firefox has a WEALTH of them, in addition to the privacy features already built in. Don’t get me wrong, Chromium-based browsers do as well via the Google Chrome Web Store. But, that continues the Google snowball that I’ve already discussed. Firefox is known for being extremely customizable, much of which comes from its extensions. You can go full-on tin foil hat with them or use none at all. Below is the list that I have found to be a good balance between completely open and so secure that the internet is unusable:
Cookie AutoDelete (Every time you close a tab it deletes the cookies associated with it, so that they don’t linger and become used in malicious ways)
Containers: Continuing off of the extensions discussion, I’d like to expound a bit more on the Multi-Account Containers made by Firefox. This is one of the key features specific to Firefox that no other browser has. I can have my work, social, banking, search, and other sites open in their own little silos. That way none of them mixes together and uses each other’s cookies to spy on me. It really is a fantastic way of walling off information from those with ill intentions. There is a bit of work up front to tell it which containers you want sites to open in, but thereafter it will use them automatically.
Conscience: Last but not least, it just sits well with my conscience. Maybe it’s just me, and others might not put a lot of stock in it, but there’s something to be said for having peace of mind.
So what are the downsides? Let’s not pretend there aren’t any. As mentioned before, you will likely run into more issues with sites not working than with a Chromium-based browser. Who’s fault this is doesn’t really matter, in the end the result is encountering more problems. Ones that likely won’t go away. Secondly, it’s just not as polished in general. The Quantum rewrite took it forward leaps in both speed and performance, but it still seems to lag more and be less smooth overall.
How much any of these cons matter to you will largely depend on how hard-core you want to go with the privacy push. Without a doubt, you can’t go wrong with Firefox when looking for better privacy and security.
Safari is actually quite a good browser these days, and also very privacy focused. Apple has realized that privacy is a niche where they stand out in a good way. Whether they intended to do that for the sake of the users or just ended up there by happenstance, nobody knows. But they’re milking it.
There are a bunch of small features that make Safari appealing in my Apple-integrated world. Chief among these are:
Reader mode (Other browsers have one, but this one is the best)
Text shortcuts (Every time I want to input my email I simply type “eml” and hit space. The same is true for address, phone, etc. This saves a surprising amount of typing and syncs across my devices.)
Seamless syncing with my other devices
Built-in reading list
Beautiful design and performance on both desktop and mobile
Add to the items above that you can add extensions, plus other capabilities through App Store apps, and Safari is a solid option. You’re probably wondering at this point why I don’t use it given all the bragging.
As with all things, it has its downsides as well. One of the major ones is a less robust extension library. Some of the major players like uBlock Origin is there, but things like HTTPS Everywhere are not. And some that are present don’t work quite as well within Safari for whatever reason. Also missing is a way to manage cookies by tab. I have purchased a separate program named Cookie 5 that will delete them on close of the browser. But I use my browser all day long, and that is a lot of time in between for sites to use my cookies in ways I don’t desire.
So, though Safari provides the best experience overall, I’m sad to say it doesn’t fit well enough into my privacy-focused world.
Mobile is a different story. Apple locks developers into using their web engine on iOS, so no matter what browser you’re using it’s basically just Safari reskinned. Adding in a content blocker like Firefox Focus gives you the ad blocking and increased privacy you want. Also, nothing else matches the smoothness and integration of Safari on iOS.
One of the standout Chromium-based browsers is Brave. I’ve been testing it it out and REALLY like it. This browser’s company was started by the co-founder of Mozilla, Brendan Eich. Its focus is on providing out-of-the-box much of the security/privacy that others offer via extensions, and also on solving the issue of website ads. It has a novel approach where publishers and users opt into a network where users are rewarded for surfing and can give some of that back to their favorite content creators. In this way you eliminate targeted ads and much of the privacy issues that accompany them.
Honestly, it seems like a great browser. It’s definitely a great solution for the not-so-techy folks who just want better privacy. Many of the functionalities I described in my favorite extensions above are built right into the browser, among others. If a site isn’t working well, just click the “shields down” button to allow it to work as normal. Also, it can install any plugins from the Google Chrome Web Store.
The only hangup for me is that it’s Chromium based (which was discussed at length above). Also, the mobile app isn’t awesome. It’s getting better, but still not quite to the level as that of Firefox. If those things don’t bother you, get it. I think you’ll enjoy it.
All of that to say, in my opinion Firefox best fits the bill for a privacy-focused world view. It’s the only browser that allows you to silo websites, manage cookies per-tab as I close them, isn’t built on Google software and therefore isn’t controlled by them, and comes from a company that is well positioned to put the needs of the users first.
I won’t be offended if you don’t agree. There are as many opinions as there are browsers. But I hope that sharing this is thought provoking and will assist in your own journey to better privacy!
In the end it’s not which browser you use that protects your privacy so much as 1) where you browse to and 2) being mindful of how the web works. To that end, pick one with a track record for being secure, pick reputable addons to enhance its capabilities, and browse smartly.
Apple has been leading the way with blocking cookies in Safari, and now Firefox is following suit. I also conducted my own little test using https://www.deviceinfo.me/ to see exactly what information websites could pull about me. Without any privacy addons installed Safari gave up less information than Firefox did, even when configured as I’ve mentioned above.
All that to say, Safari is becoming a very good option for privacy if you live fully within the Apple ecosystem. Everything I’ve said about Firefox above still holds true, but Safari is a much better option these days than it once was.
Not long ago Microsoft proclaimed to us that they love Linux. And while many remain skeptical of that assertion (and not without reason), the tech giant is continually pouring more time and resources into the open source world. One of the really exciting products of this (to me at least) is PowerShell Core. Not only can I now program with my favorite scripting language from Mac or Linux, I can interact with services like Azure. In fact, Microsoft’s own Azure Cloud Shell runs PowerShell Core, so it’s no side mission for them. Let’s take a look at using it to connect to Azure from a non-Windows environment.
Install PowerShell Core
To start out, we’ll need to install PowerShell Core.
# Download the Microsoft repository GPG keys
wget -q https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb
# Register the Microsoft repository GPG keys
sudo dpkg -i packages-microsoft-prod.deb
# Update the list of products
sudo apt-get update
# Enable the "universe" repositories
sudo add-apt-repository universe
# Install PowerShell
sudo apt-get install -y powershell
# Start PowerShell
Now we have PowerShell on Linux!
Next, we will need to install and import the ‘AZ’ module for working with Azure.
Install-Module -Name Az
Alright, now we’re ready to rock. Let’s get connected up to Azure using Connect-AzAccount. That will give us a prompt like the one below, supplying a code to be used for connection.
Supply your Azure credentials, and your machine should now be connected.
Now, we can interact with our Azure environment!
Microsoft has done a fantastic job with making PowerShell Core and the Azure cmdlets available on non-Windows systems. It’s a trippy experience to be working with them from Mac or Linux, but I’m excited for the possibilities ahead!