Tips for increasing online privacy (without going insane)?

You should have a threat model in mind and justify on what is possible vs. the cost of doing so.

For example, a smartphone will have built-in spywares and it's really hard to block this. With more vendors you add, the more spying. This means that using a Pixel or iPhone remove one vendor from the list (any Android phone will have Google Play Services regardless of vendors, but you can avoid Samsung or Xiaomi spying on you)

Unlike webapps, every apps you install may spy on you. I prefer to not install apps if possible and use the web apps.

I try to only implement protections that cover a lot of areas:

• Use NextDNS as your "private DNS" provider in Android and let it block ads/trackers. (You can also choose to run your own Pihole on the cloud, but I didn't like the experience)
• Use browser with ads blocking built-in, as DNS-based blockers has limitations. I use Firefox with uBlock (due to ideological reasons - I don't want to support the Chrome/Blink monopoly)
• Prefer applications on F-Droid, but only if they are competitive to other applications. For example a QR/barcode scanner are dime a dozen, so Binary Eye is preferred to Google Lens.
• I'm currently using Hail which supposedly "freeze" individual apps so that they should not run when I don't want them to. The document doesn't says it's 100% frozen though

I like what PagerDuty wrote on their security training - "Be secure, but usable". Most people don't put ten locks on their front door, but not zero either. My university course teach me that you should not invest in protection more than the cost of the harm itself. My bike cost $70. I'm not buying $100 bike lock to protect it (although for some people the cost of having to walk/taxi home may also make that investment worthwhile)

Edit: I made it 20 minutes into my comment and realized you weren't really talking about online information security, but I spent too much work on this so I'm going to post it anyway :p

I've been doxxed, witch hunted, and even swatted once: here's what I've done to help.

1. Google/Bing/whatever your name, your address, your phone number; any identifiable information you can think of that could be publicly available. Check multiple pages of results. Find every website that has your information on it and submit opt-out requests (99.9% of the sites should have this function, some don't) there are a lot of websites out there like peekyou, the Whitepages, etc which will just post your straight up name, address, number, etc for anyone to find. It's criminal.

2. Do the same for your immediate family members, especially your parents. Parents are the number one targets for psychos online and they usually don't have the wherewithal to do this kind of thing themselves. If you have the patience you can do it for inlaws as well, I once had someone call my sister in laws phone number dozens of times saying that I caused someone to kill themselves and I should be in jail. It really stressed her out and I felt terrible that she was targeted because of her relation to me.

3. Once you've done everything you can to remove your information from the people finder websites, do some digging into specific popular databases. You may find that you're still showing up in them despite them not appearing on searches.

4. For any public online information that you can't easily remove, submit a takedown request via Google. I believe they'll remove it from the search results if you give them a good enough reason, so feel free to get creative. This isn't foolproof obviously but it does a lot to slow down the lazier creeps online.

5. Consider trying out a paid service like incogni to go through a purge other records. It's usually not very expensive and can save you a lot of time and effort. I don't know how well they work, but for a few bucks it's probably worth it.

6. You can go even deeper and start planting fake information out there associated with your personal identity. Not really sure the best way to do this, but I believe you can submit corrections for online people searches and change things like addresses and phone numbers. You could also make fake social media accounts associated with your name or username and have false info planted there too. I personally haven't but it's worth a shot if you're desperate to have some barriers up.

7. Call your local PD and warn them that someone may attempt to SWAT you or your family. They usually are pretty clueless but sometimes you'll find someone helpful and they'll be able to make a note about it and maybe prevent a disaster.

8. Recognize that you will probably never be able to get all traces of your info off the web and don't stress out about it too much. You can only do so much, and it's not worth beating yourself up too much over it. Do your best and hope for the best, don't let the trolls win.

Check out https://privacyguides.org, it's probably the best privacy-related resource online! The website's co-founder is also on Tildes @freddy

I'll happily recommend the FUTO keyboard for Android, if you are uncomfortable with your search engine reading every keystroke. The speech-to-text feature is the best one that I've found. Good luck!

I have Fastmail with my own domains and am gradually switching over as logins come up since all at once is overwhelming.

• burner emails for as much as possible
• nextdns
• ublock
• wipr 2 for iOS/macOS safari

Slowly moving off of the big platforms as well Google (only for services that require it), Twitter to Bluesky and Mastodon, Discord to IRC, Facebook remains for people who I can’t contact otherwise. Instagram still has a few amusing accounts.

I try to self host as much as possible using Photoprism and Immich with backups to my NAS and an S3 bucket as well.

I find that disabling notifications unless they no-shit need to be there (medication reminders) has been extremely helpful as well and helps you clean up your phone.

Device: Pixel 8 or above.
OS: GrapheneOS (there is no competitor)
GooglePhotos: Ente Photo
Authenticator: Aegis Or Ente Auth
Internet Traffic Management: Rethink
File Manager: Mixplorer
Password Manager: Bitwarden
App store: Accrescent/Obtanium (Fdroid is not recommended for security)
Mail: ProtonMail, Tuta Mail, Infomaniac (Also use Aliases)
Cloud storage: Filen.io (or use whatever but encrypt before uploading before uploading)
ReadLater: Wallabag(self hostable)(RIP Omnivore)
Notes App: Notesnook/Obsidian/logseQ
Gallery: Fossify Gallery
Message App: QUIK SMS
Music App: RiMusic/Innertube/Spotube
Rss Reader: Feeder
Birthday Reminder: Birday
Smartwatch/Earbud Manager: GadgetBridge
ExpenseManager: MyExpenses
VPN: ProtonVPN/Mullvad
Browser: Chromium based are better from Firefox from security perspective Read here
WeatherApp: Breezy Weather
Maps: Organic Maps
Messaging: Signal.org(<3)/Molly
HackerNews: Harmonic

Come Hangout here: https://discuss.grapheneos.org/

Please ask If you have any specific question, I'll be happy to help to the best of my capability and remember this is a process.

edit: Keyboard: FlorisBoard/Heliboard

edit2: read this post on OpSec

I use several things without fully de-goggling.

1. PiHole DNS setup on a RPi at home
2. NetGuard firewall from FDroid on my phone in whitelist mode and IP filters using a similar ruleset to my PiHole for when I'm away from my home WiFi
3. Firefox+uBlock origin+privacy badger on both my phone and desktop
4. No twitter, Facebook, Instagram, or Reddit
5. Refrain from the use of unnecessary apps. McDonalds, coffee shops, etc. None of them need to be on my phone hovering up my data thank you very much.
6. Meticulous permissions management. I don't grant permissions to apps just because they ask. I limit what apps are allowed to access and wherever feasible, I use NetGuard to deny apps internet access. Keyboards and launchers don't need internet access.

Listed all out like this it seems like a lot, but none of it is a real impediment to my daily activities so once setup, it's mostly unnoticeable. I just have to remember to whitelist new apps through NetGuard if they need the internet.

If you're blocking most cookies, don't share unnecessary data with apps, and have deleted your AdID, you're 90% of the way there. Internet privacy boards are tough places because the people who lurk there tend to be absolutely nuts - and often believe a lot of stuff that's just not substantiated by the facts. ("Your phone is constantly listening to your conversations to sell you ads!")

The bottom line is you've got to understand your actual threat model. Are you trying to sell drugs on the darknet or blow the whistle on an oppressive regime? Okay, let's talk about tails or whonix or whatever. You just want to limit the amount of data that could potentially identify you? Delete your AdID and keep location services off when you don't need it and you're pretty much good.

Hi @willopillo, the first thing i would say is that: you are not alone! From catastrophizing (as you noted elsewhere in this post), to finding that right balance of privacy and dare i say convenience, there are plenty of people in a similar place to where you find yourself. As others noted, get an understanding of your threat model, level of comfort, etc...would be good idea to re-assess (I say "re-assess because you aren't starting from scratch here). And the privacy guides that another person posted is pretty good too! I guess the other aspect i would suggest is not to let this negatively impact your mental health. I say this from experience! I'm quite sensitive about my privacy, but then also need to maintain a balance to not let that desire for privacy and data sovereignty overtake my actual, real life. Stay safe, but do take care of yourself! :-)

I have used exclusively FOSS OS and apps on nearly all my devices for a very long time, for privacy reasons. One thing that has recently-ish made my life a bit less insane was setting up a secondary user on my phone and using it to install any proprietary apps I need (essential stuff like like banking apps, etc) in that environment (via aurora store).

It keeps them niftily sandboxed away from any of my day-to-day data, gives them their own settings profile for things like GPS, and I have a little shortcut on my main home screen that kills the entire user session - making sure there are no sneaky background processes running when I'm not actively using that 'workspace'. Obviously it would be better to have a dedicated phone for this purpose, but this is an acceptable balance between secure and convenient for me. I originally had a whole bunch of different user profiles for different tasks but I found it to be overkill for my needs and reduced it to just a couple. YMMV.

Tl;Dr: my tip is to use multiple user sessions on your phone to segregate less trusted apps from your 'clean' main environment (and maybe from each other).

Edits: mostly just tidying and clarifying

All great suggestions by many here, but one I haven’t seen is to use Firefox Focus for general browsing. It deletes cookies, history, and local storage after each session. Alternatively you can just start a new session at any time. Removing the ability for any site to track you longitudinally is just another method of covering your tracks when you can’t ensure privacy blockers will work for 100% of trackers.

Side benefit is a decluttered browsing experience. On my other browsers I have and endless growth of tabs I keep forgetting to clear out. Firefox Focus removes the need to think about maintaining data hygiene.

Occasionally I do need to switch to Chrome (ugh) or Vanilla Firefox because I need to persist my browser state (signing into services or online shopping), but it’s nice to force me to be more thoughtful when I do need to switch to a different context. It’s similar to having to use a !bang operator in DuckDuckGo/Kagi when I want to switch to Google Search (thankfully less and less common these days).

If you have an Android, check out TrackerControl (TC) from the F-droid app store.

It allows you to control where apps are allowed to send data to, and disable them from sending your information to ad/tracker companies.
It's very granular and can also prevent apps from working if you disable too much, but it's categorised well and you just unstick restrictions until the app works again

I’ve been focusing on all smart home stuff lately. I was always very much against connecting appliances to the internet, but I really needed to control the heating remotely. Also got solar installed recently and I wanted to monitor production. For both I ended up writing Home Assistant connectors, because the available stuff still required the devices to connect to the lan. It took me quite some effort, but it’s running well now.

For TV I started using Kodi. This was triggered when I received an Android TV device, that thing was a privacy nightmare.

I've been debating switching Android phones and iPhones every 5-6 years just to create darkzones in my history with corporations like that but. Maybe better to get some of your opinions on that first :P

Since Google seems a primary issue for you, have you considered switching to the Apple ecosystem and disabling the services you find creepy on that? It has a lot of the same features of the Google ecosystem but they can be disabled.