Week 3 of rm -rf

umask

In Unix, umask sets the default permissions for every new file you create. Instead of locking each one down after the fact, you set the defaults once and everything new is born restricted.

That's this week. You've spent two weeks cleaning. Now you set defaults so anything new doesn't leak you by default.

Think of it like brushing your teeth. You don't deep-clean once and call it done forever. (If you do, please see a dentist and a therapist.) Privacy is the same — a habit, not a project.

Task 1: Email Aliases — The Single Most Important Change

Your email address is the master key to your digital identity. If every service has the same email, a breach on any one of them leaks the key to all of them. The solution: unique email aliases for every service.

A quick trick: Gmail and some providers let you use you+servicename@gmail.com. This does not hide your real email — anyone who sees it can strip the + part. It only helps you track where your data leaked from. Use it as a supplement, not your main privacy strategy.

How It Works

Instead of giving each site your real email address, you create aliases that forward to your real inbox. If an alias gets compromised, you simply disable it — the breach is contained.

Free Options

• SimpleLogin — Open source. Free tier gives you 10 aliases, you can reply from them. Owned by Proton.
• AnonAddy — Open source. Free tier gives you 20 aliases. More generous, same concept.
• DuckDuckGo Email Protection — Free, unlimited aliases. Strips tracking from incoming emails. Also reads your emails on their server — pick your trade-off.

What to Do

1. Pick one alias provider (SimpleLogin recommended)
2. Create an account using your primary email
3. Go through every active account you have and swap the email to a unique alias
4. For new sign-ups, generate a fresh alias each time
5. Critical: Never reuse the same username or password across platforms. Unique email + unique username + unique password = three locks on every door.

Caveat: You're trusting the alias provider with your email routing. SimpleLogin and AnonAddy are open source, which means the code is auditable, but you still rely on their servers. Self-hosting is the ultimate option if you have the technical ability.

India Note

If you primarily use Indian services (Zomato, Swiggy, Flipkart, Amazon.in, Paytm, etc.), alias them too. Indian services have had significant data breaches. Your Flipkart email + password being leaked shouldn't compromise your Reddit account.

Task 2: Browser & Search Privacy

Your browser is the single biggest vector for digital fingerprinting. Every extension, every setting, every site you visit contributes to your profile.

See for yourself: visit Cover Your Tracks by EFF to see how uniquely your browser can be fingerprinted. Check Browser Leaks to see what data your browser leaks in real time.

Browser Choice

• Firefox — Best balance of privacy and usability. Enable Enhanced Tracking Protection (strict). It's the privacy browser that doesn't make you feel like you're wearing a tinfoil hat.
• LibreWolf — Firefox fork with privacy hardcoded. Harder fingerprints, uBlock Origin built-in. Slightly more annoying for daily use. Worth it unless you value convenience over privacy (no judgment, we all have lazy days).
• Brave — Chromium-based, strong fingerprinting protection. Controversial crypto stuff, but privacy-wise it's solid out of the box. Just ignore the crypto tab. We do.
• Tor Browser — Maximum privacy. Every window is a new fingerprint. Slow enough to remind you of 2003 dial-up. Many sites block it. Use for sensitive research only, not for ordering pizza.

Essential Extensions (All Free)

• uBlock Origin — Blocks ads, trackers, and malicious domains. Not just an ad blocker — a privacy tool that happens to make the web load faster. Install it. Thank us later.
• CanvasBlocker — Spoofs canvas fingerprinting. Firefox only.
• Privacy Badger — Learns which domains track you and blocks them. From EFF. It's like a watchdog that actually works.
• ClearURLs — Strips tracking parameters from URLs before they're sent.
• Decentraleyes — Serves CDN resources locally to prevent CDN-based tracking.

Search Engine

• DuckDuckGo — Default privacy search. No tracking, no filter bubble. Bang commands (!w, !a, !yt) make it powerful.
• Mojeek — Independent search engine with its own crawl index. No Big Tech influence.
• SearXNG — Self-hosted meta search engine. Aggregates results from multiple engines without revealing your IP.
• Brave Search — Independent search index, privacy-focused.

What to Do This Week

1. Switch to Firefox or LibreWolf
2. Turn on Enhanced Tracking Protection (strict)
3. Install uBlock Origin
4. Install CanvasBlocker (Firefox only)
5. Set DuckDuckGo as your default search engine
6. Disable third-party cookies in browser settings
7. Clear all existing cookies and site data

Task 3: Password & Authentication Hygiene

You can't secure your accounts if you reuse passwords. One breach exposes everything.

Password Manager (Free Tier)

• Bitwarden — Open source, unlimited free tier. Works everywhere. Self-hostable. The boring, reliable choice — and boring is good in security.
• KeePassXC — Fully offline, local database. No cloud. Slightly more effort to sync. For people who don't trust the cloud (valid).

What to do: Pick one. Generate a unique, random 20+ character password for every account. Write down your master password on paper and keep it somewhere physical. Not a sticky note on your monitor. Somewhere actually safe.

Passphrases Over Passwords

P@ssw0rd123! gets cracked in seconds. correct-horse-battery-staple takes centuries. Your call. This isn't opinion — it's math. Read the logic on Wikipedia, then try it yourself with an entropy calculator to see the numbers live.

Use 5-6 random words. Your password manager can generate them. Let the machine do the heavy lifting — that's what it's for.

Two-Factor Authentication

• Authenticator app (Aegis, Raivo, 2FAS) — Use these instead of SMS-based 2FA. SMS can be intercepted (SS7 attacks), and India has seen increasing SIM swap fraud.
• Hardware keys (YubiKey, NitroKey) — Best option for critical accounts (email, password manager, social media).
• Never use SMS 2FA if you can avoid it. In India, SIM swap fraud is rampant — someone gets a duplicate SIM, intercepts your SMS, and resets your passwords.

Audit Existing Accounts

1. Change passwords on all accounts you kept (use the password manager)
2. Enable 2FA where available (authenticator app preferred)
3. Remove unused apps and devices from "authorized sessions"
4. Revoke old API tokens and OAuth grants

Task 4: Ongoing Monitoring Schedule

Privacy leaks are like weeds — pull one out, two more pop up somewhere else. New breaches happen. New data brokers appear. Old opt-outs expire. You need a schedule. Not a fun one, but neither is getting your identity stolen.

Quarterly (Every 3 Months)

• Re-check the people search sites from Week 1 to see if your data reappeared
• Run the Google search queries from Week 1 again
• Check HaveIBeenPwned (or use manual breach search)
• Review connected apps on social media accounts
• Re-audit your app permissions (apps add new permissions with updates)

Yearly

• Request a GDPR/DPDP data access report from major platforms
• Re-do the full data broker opt-out cycle (new brokers appear)
• Rotate your email aliases (disable old ones, create fresh ones)
• Review your password manager for weak/reused passwords
• Update your browser and extension privacy settings

Ongoing Habits

• Always use a unique email alias for new sign-ups
• Always generate a unique password for new accounts
• Never use "Sign in with Google/Facebook/Apple" — it shares data between services
• Keep your browser extensions minimal and reviewed
• Be skeptical of "free" services — if you're not paying, you're the product
• Before installing any app: check what permissions it asks for. If a calculator needs your contacts, it's not a calculator — it's a data harvester with a fancy skin.
• Every 3 months: do a quick app permission audit (like Week 1 Task 4). Apps update and sneak in new permissions like they hope you won't notice. Notice.
• When you uninstall an app: first delete the account (like Week 2), or use the "edit to fake" method. Never just uninstall. Ghost accounts haunt you later.
• When an app asks for a permission: ask yourself "does this app really need my camera/mic/location to function?" A flashlight app does not need your location. It needs to turn on the LED. That's it.

🌍 Region-Specific Maintenance

India (🇮🇳)

• Use India-based privacy tools cautiously. Some "Indian VPN" and "Indian privacy" apps are data harvesting operations in disguise. Stick to the open-source, globally audited tools listed here.
• Beware of Aadhaar-linking scams. Never link your Aadhaar to services unless legally required. Services often ask for Aadhaar unnecessarily — you can refuse.
• Use UPI wisely. UPI payments are convenient but create transaction trails. For privacy-sensitive purchases, consider cash.
• SIM card security: Contact your telecom provider and set a "SIM lock" or "SIM swap protection" if available. This prevents someone from getting a duplicate SIM without your authorization.
• DND registry: Register on the National DND registry on the TRAI portal to reduce commercial calls and messages. It won't stop all of them — political parties and surveys are exempt — but it helps.

European Union (🇪🇺)

• Leverage GDPR regularly. The Right to Erasure (Article 17) and Right to Data Portability (Article 20) are powerful tools.
• Use the EDPB (European Data Protection Board) to find your country's supervisory authority. If a company ignores your GDPR request, file a complaint with your DPA.

United States (🇺🇸)

• State-level privacy laws are expanding (CPRA in California, CPA in Colorado, CDPA in Virginia, etc.). Check if your state has a privacy law and use it.
• OptOutPrescreen.com — Use this to stop credit bureaus from selling your data for pre-screened offers. Valid for 5 years.

Asia-Pacific (🌏)

• Singapore: Use PDPC's breach notification portal to stay informed about local data breaches.
• Australia: The OAIC handles privacy complaints. Use the Notifiable Data Breaches scheme to check reported breaches.
• Japan: Under APPI, you can request disclosure and correction of personal data. File complaints with the PPC (Personal Information Protection Commission).

Wrapping Up — You Are Not Done, But You Are Ahead

You are not invisible now. But you've gone from being an easy target to someone who requires actual effort to track. Most data brokers will move on to easier prey. Congratulations — you are now privacy-annoying. It's the best kind of annoying to be.

The internet's memory is long. New data will accumulate. Old opt-outs will expire. Breaches will happen. The habits you built this week are what keep you ahead — not a one-time fix, but a permanent mindset shift that costs you a few minutes every quarter.

Need Help?

If you want us to perform OSINT on your exposure or help you navigate takedowns, reach out to us at afterthedot@proton.me. We can help identify where your data is circulating and guide you through the opt-out process.

← Week 2: PULL THE PLUG    Back to Module Home