Technical Resources for Sex Workers
Technical Resources for Sex Workers
Guidance for Contributors
Useful Articles
Spyware/Virus/Tracking Protection
Email Protection
Tracking Protection for Laptops and Desktop
Video Chat / Skype Alternatives
General
Recommended Providers
Servers
Recommended practices for one-to-one emails
Recommended practices for mass emails for organizers
Recommended mailing list providers
Messaging Apps
General
Known messaging apps
Cloud document storage and sharing
General
Real-time collaboration
Known providers
Group Chat
Websites and Hosting
Domains
Common Questions
Registrars
Recommended Domain Registrars
Hosts
Common Questions
Recommended Webhosts
Example configurations
Online Protection
VPNs
Recommended Providers
TOR (Open Source)
Browsers
Community
Advertising and Marketing
Recommended advertising platforms
Recommended marketing platforms
Alternative Social Media Platforms
Guidance for Contributors
When adding recommendations to this document, please keep the following in mind, and provide answers/details in your contributions where possible:
1. What is accessible to less tech-savvy folks?
2. What are the TOS policies of the service being recommended and how have those policies been enforced?
3. What has been the past experience of sex workers on the platform or service?
4. How accessible is the platform or service? Will it work on a burner phone? Is it paid or free?
Useful Articles
Riseup - Why Security Matters
How to Stay Anonymous Online - This article is comprehensive in covering mobile phones, to emails, to browsers and more.
NSA and Their War on The Internet - This article goes over what techniques NSA uses to gain information and which security programs they find easy to near impossible to crack. Based on Snowden’s Papers. Found it insightful.
Why Open Source is Good for Business - Looking towards Open Source products which will give us the best non controlled safety we can get.
The Fourteen Eyes Explained - This refers to the 14 countries (5 originals + 4 added later) that abuse online privacy. This is important for all sex workers to know when deciding what country they will seek services from.
How to Find Alternatives - This is a site called Alternativeto. It is a great starting place when seeking alternative sites for those who are not sure where to begin looking. Or if you think of something that is not listed yet that will help.
Ruckus Society - Security Culture for Activists - page 9
A DIY Guide to Feminist Cybersecurity - Take Control of your Digital Spaces
Medium - Current Digital Security Resources -[a] ‘Digital technology doesn’t die — it just ages really, really fast. Even the richest digital security resources become quickly out-of-date, and while there are a remarkable number of toolkits and guides for learning digital self-defense, relatively few have information you can use right now. This “meta-guide” highlights current resources, and tips on keeping them timely and relevant.’
What is Security / Disclaimers?
When thinking about security and privacy, think about the choices that are best for your circumstances and make sure your practices are sustainable. Ask yourself are these practices sufficiently private / secure for my purposes?
-Do what’s best for you.
-Be aware of risk mitigate it to your comfort level / ability.
-Create layers of protection / obfuscation
Suggested things to Turn Off:
-Thumbprint access
-Facial recognition to unlock phone
-Location from photos
-Facebook 3rd party apps
-Google Takeout Exports a copy of your Google Data (5 archives limit)
MetaData Removal - List of metadata software
The most effective way to remove most, if not all, identifying data from media files is to use exiftool (perl script/executable run on the command line), it has heaps of options, but there are only two you really need to use:
1. To check all metadata in a file run: exiftool -all
2. To clear all the metadata that can be removed safely run: exiftool -all=
1. Yes, those two commands are very similar, fortunately it backs things up by default.
2. PDFs are a frequent exception, there is a lot of data, including metadata, which cannot be removed ever. Most redacted PDFs are either recoverable or actually entirely new files with only the acceptable for release data included.
1. For the geeks who want to really dig into why sanitising PDFs is pretty much impossible, this document explains much of it: http://okbounty.adversary.org/pdf_risks.pdf – original author is the NSA, but they took their copy offline (shortly after I found it and cited it in the report on that same subdomain) and I still had my copy ... you're welcome. ;)
LAPTOP/CPU/USB Security
VeraCrypt - Disk Encryption Software based of TrueCrypt 7.1a
Creates a virtual encrypted disk within a file and mounts it as a real disk.
Encrypts an entire partition or storage device such as USB flash drive or hard drive.
Encrypts a partition or drive where Windows is installed
PasswordSafe - Open Source, File integrity checks to stop modifications,
No back door / recovery mechanism - there's no way for users (or developers) to access the passwords without the master key.
Hard to brute-force - In the absence of back doors, an attacker can try a brute-force attack. The master passphrase is never stored the clear. It stores something that derived from the master passphrase, but hard to calculate. Memory with sensitive data is wiped as soon as possible.
Spyware/Virus/Tracking Protection
AdNauseum - Adblocker / obfuscates data. ‘As online advertising becomes ever more ubiquitous and unsanctioned, AdNauseam works to complete the cycle by automatiningg Ad clicks universally and blindly on behalf of its users. Built atop uBlock Origin, AdNauseam quietly clicks on every blocked ad, registering a visit on ad networks' databases. As the collected data gathered shows an omnivorous click-stream, user tracking, targeting and surveillance become futile.’
Container Tabs - on FireFox - make multiple (work, personal, Facebook…) similar idea to multiple browsers (may help avoid algorithms outing you to clients if you use personal social media in a separate container tab)
Email Protection
Pixel Tracking: Check Images in turned off in your emails. A common Tracker that is used is 1 image pixel. It is impossible to see but can track your email movements. As it is a image file, it will be blocked when Images are turned off.
Tracking Protection for Laptops and Desktop
SuperAntiSpyware: (DeskTop) The Free version will remove any trackers off your computer that Anti Tracking/ AdBlocker PlugIns miss. I have this on my computer. It is every effective and should be frequently. It can also remove programs that won't normally delete.[b][c]
Video Chat / Skype Alternatives
VSee - This is an end to end encrypted video chat program. It’s used by medical professionals to ensure confidentiality and there is a free download. https://vsee.com/
Jitsi - Uses WebRTC to have end-to-end secured video chat. The jitsi server still gets access to metadata and WebRTC does have potential security and privacy flaws[d].
Riot.IM (https://riot.im) - Encrypted messaging, video, and filesharing app. Open source. Has a Slack-like user interface.
Wire (https://wire.com/en/) - Encrypted messaging, video, and filesharing app. Open source. Created by the founders of Skype. Very easy to use UI. Supports disappearing messages.
You may want to use a throwaway email, or something, but for the most part it should be safe.
General
In general, email produces a lot of information that is visible to mail servers and service providers, such as to/from, timestamp, subject line, size (this can indicate if an attachment is present). All of this is seen as ‘public’ information and a requirement for emails to generally work. So I would avoid using for organizing unless absolutely necessary.[e][f] It’s probably better to use a secure messenger (that choice[g][h][i] can get really complicated[j][k][l][m][n][o][p][q]).
There are benefits towards all of us being on the same email, as noted below, the encrypted mail services (or at least ProtonMail) work best when both people have accounts on the same service.
You may want to make multiple emails and not use the same email that is client facing to post ads with or sign up for social media and chat services or fintech platforms.
Recommended Providers[r][s][t][u][v][w][x][y][z]
* ProtonMail https://protonmail.com/
* Free
* End-to-end encrypted email based on the OpenPGP standard.
* Works best if the recipient also has a ProtonMail account (but has a solution for sending mail to non-ProtonMail accounts)
* When sending to non-ProtonMail accounts, emails can be sent unencrypted, or encrypted with a password that you share with the recipient[aa].
* Emails are stored encrypted on their servers, so they are unable to give your data to law enforcement
* Web and mobile apps
* Based in Switzerland
* Offers 2-factor authentication for extra account security
* If you forget your password, your account and emails cannot be recovered
* Self-destructing messages (but recipient is still able to make their own copies)
* Company claims they don’t log [ab][ac][ad]personally identifiable information, such as your IP address
* ProtonMail has about 2 million users, it's not exactly a small fish in any danger of shuttering and losing us all out.
* Pretty stellar track record telling foreign powers to piss off when they request information.
* ProtonMail response
* Tutanota[ae][af][ag][ah][ai][aj]
* Based in Germany
* There are some downsides to people being split across email providers when it comes to encryption - if you and ano