Category: Privacy

Lessons Learned from Skiff’s Shutdown

Several months ago, I tested a new end-to-end encrypted (E2EE) email provider called Skiff. They had a great interface and promising product. I never promoted them, aside from a brief mention in the eBooks, because the service was too new. I had learned my own lesson from adopting CTemplar before it had matured, and I did not want to invest my digital life into Skiff until I could see how things developed. Recently, Skiff announced they had been sold to a documents workspace provider called Notion, and that all Skiff email addresses would be terminated in six months.

Fortunately, I had never used my test Skiff accounts for any communication or account creation. However, many people in this community adopted Skiff heavily and are now concerned about the inability to access these accounts in the near future. I want to present some ideas about email adoption, much of which I have already published in previous books, to serve as a reminder for personal email policy.

Password Manager: This is not just to generate and store passwords. You should also store any email address used within a service. When I place a username and password within my password manager, I always record any current or previous email addresses which I provided during signup, or changed after creation. This way, I can always search an email address or email domain to identify any accounts which could be at risk. When CTemplar shut down, I was able to quickly see the five accounts which possessed a CTemplar email address; sign into them and change the address; then not worry once CTemplar shut their doors.

Domains: I have always preached using your own domains for all vital email. Sure, we all have burners with various providers for all of the junk, but I would never use a Proton Mail, Tuta, or Fastmail domain for anything which is important to me, such as a financial institution or work communications. ANY service could shut down or kick you out tomorrow. When you use your own domain, you can easily forward it to another service within an hour.

Redundancy: If Andy gets tired of my weekly emails asking for a new feature at Proton Mail and suspends my account, I can forward my domains to Tuta within a few minutes to keep receiving email. If Hanna over at Tuta decides I am shady and suspends my account for review, I can switch those domains over to Proton Mail (Don't get any ideas you two). I maintain a paid package through Proton Mail, Tuta, and Fastmail at all times. I can store all of my domains at any of them whenever needed. While I doubt any of them are going away any time soon, I have redundancy. Both Proton Mail and Tuta offer secure E2EE, and both have proven their intent at longevity in this space. While I originally focused on Proton Mail due to high adoption within my circles, I now see many more Tuta addresses in my inbox, which encourages me to communicate directly with those people through one of my domains on Tuta.

Business: I see a lot of Skiff bashing online. People say they are sellouts, traitors, liars, etc. They are a business. Businesses pivot, become acquired, and sometimes go broke. We should never rely on a free service to provide us with a lifetime of communications. This is why we should focus on reputable and established paid services, own our own domains through a third-party provider which can be transferred when needed, and possess redundant services which are ready for our communications within an hour of bad news.

Skiff is shutting down. We should get over it. We should move on. We should find a better provider. If their closing forces us to adopt a better email protocol, then we should be thanking them.

Digital Guide Updates 2024.02.01

Today we have updated all five digital supplement guides. If you purchased any, please check your email for the download link(s). If you would like more information on these guides, please visit https://inteltechniques.com/books.html. The following provides details of each update:

OSINT Techniques-Leaks, Breaches, & Logs:
Page 81: Updated two commands to correct a file name and use sort instead of gsort.
Page 152: Updated paths within script for options 22-24 for functioning full-disk queries.
Page 157: Added a section about internal drive data storage.
Page 164: Added an option to export a SQLite database to CSV file.
Pages 170-171: Updated eBook price increase for new orders.
Updated DataTool and DataTool.sh scripts on the website to reflect changes.

Extreme Privacy-Mobile Devices:
Page 74: Eliminated line about Telnyx not having voicemail capabilities.
Page 77: Added new section about Telnyx voicemail configuration.
Page 78 & 147: Added new Voip.ms signup code with less scrutiny on new accounts.
Page 80: Added new section about VoIP.ms voicemail configuration.
Page 81: Added URLs for VoIP.ms sanitization.
Page 82: Added new warning about MySudo purchases.
Pages 158-159: Updated eBook price increase for new orders.

Extreme Privacy-macOS Devices:
Page 60: Added clarification about encrypted DNS within macOS.
Pages 79-83: Replaced the Twilio sanitization options and script for better stability.
Page 84: Eliminated line about Telnyx not having voicemail capabilities.
Page 86: Added new section about Telnyx voicemail configuration.
Page 87: Added new Voip.ms signup code with less scrutiny on new accounts.
Page 88: Added new section about VoIP.ms voicemail configuration.
Page 90: Added new section about VoIP.ms API access.
Page 101: Added a new section about UTM Network Connectivity.
Page 109: Corrected Documents path in script.
Pages 116-117: Updated eBook price increase for new orders.

Extreme Privacy-Linux Devices:
Page 18: Added command to remove dark theme background.
Pages 69-74: Added a Twilio access and sanitization script.
Page 75: Eliminated line about Telnyx not having voicemail capabilities.
Page 77: Added new section about Telnyx voicemail configuration.
Page 78: Added new Voip.ms signup code with less scrutiny on new accounts.
Page 80: Added new section about VoIP.ms voicemail configuration.
Page 81: Added new section about VoIP.ms API access.
Pages 112-113: Updated eBook price increase for new orders

Extreme Privacy-VPNs and Firewalls:
Page 20: Added further clarification about PIA's dedicated IP usage.
Page 24: Added brief warning about self-hosted VPN service.
Pages 94-95: Updated eBook price increase for new orders.

Digital Guide Updates

To help ring in the new year, we have updated all five digital guides. If you purchased any, please check your email for the download link(s). If you would like more information on these guides, please visit https://inteltechniques.com/books.html. The following provides details of each update:

OSINT Techniques-Leaks, Breaches, & Logs (2024.01.01):
Page 6: Provided a new email address for reporting broken techniques.
Page 82: Added a new section about telephone number leaks.
Page 83: Added a new section about Facebook telephone number leaks.
Page 84: Added a new section about Instagram telephone number leaks.
Page 85: Removed Verifications.io reference due to dead links (to be replaced soon).
Page 106: Added Rename installation command for Linux.
Page 108-109: Added new online breach search resources.
Page 126: Updated stealer log commands to extract additional password files.
Page 133: Reorganized Telegram channel information, added new rooms, and added search query.
Page 140: Added alternative ransomware monitoring option.
Page 161-164: Added a new section for creating SQLite databases.
Pages 171-172: Added new pages summarizing all digital books content.
Entire Guide: Corrected minor typos and grammar.

Extreme Privacy-Mobile Devices (2024.01.01):
Page 6: Provided a new email address for reporting broken techniques.
Pages 25-26: Added section about Vanadium's custom search options.
Page 49: Applied very minor update to the Mint Mobile data plan.
Pages 79 & 146: Slight clarification on Acrobits software requirements.
Pages 157-158: Added new pages summarizing all digital books content.
Entire Guide: Corrected minor typos and grammar.

Extreme Privacy-macOS Devices (2024.01.01):
Page 6: Provided a new email address for reporting broken techniques.
Page 106: Added commands to the Homebrew uninstall script to clean up data.
Pages 114-115: Added new pages summarizing all digital books content.
Entire Guide: Corrected minor typos and grammar.

Extreme Privacy-Linux Devices (2024.01.01):
Page 6: Provided a new email address for reporting broken techniques.
Pages 105-106: Added new pages summarizing all digital books content.
Entire Guide: Corrected minor typos and grammar.

Extreme Privacy-VPNs and Firewalls (2024.01.01)
Page 6: Provided a new email address for reporting broken techniques.
Pages 93-94: Added new pages summarizing all digital books content.
Entire Guide: Corrected minor typos and grammar.

All Digital Guides Now Available as Gifts

After releasing our latest digital guide, we have now made all seven of our eBooks available as gifts. Whether you purchase one or all PDF guides, you now have an option at checkout to gift the purchase to someone else. You can even choose the date when they will receive the files. Click the purchase links within any of our guides to send a gift this season.

OSINT Techniques: 10th Edition
OSINT Techniques: Leaks, Breach, & Logs
Extreme Privacy: 4th Edition
Extreme Privacy: Mobile Devices
Extreme Privacy: macOS Devices
Extreme Privacy: Linux Devices
Extreme Privacy: VPNs & Firewalls

Login Notification Benefits

Hopefully, we are all using secure unique passwords and proper two-factor authentication (2FA) on every account which supports it. This alone will stop most online attacks. However, I believe login notifications are just as important. Unfortunately, many services do not provide this feature, which I hope changes soon. A login notification gives you a warning that someone (possibly you) has accessed one of your online accounts. A great example of this is Standard Notes. Any time I log into my account from a new device or browser, I receive the following alert.

This is vital to me since I use Standard Notes as my primary 2FA token solution. Some may view this notification upon every new login to be an annoyance. I find it reassuring. If someone is able to access my account via credentials and 2FA, I have a big problem. I have comfort knowing that Standard Notes will alert me if this happens, even if that means a false alert when I access my own account. You may already have this feature enabled, but this can be confirmed in the following setting.

Make sure the mute option is disabled to receive alerts. This behavior is on by default with secure messaging service Wire. Upon every login, I receive the following.

Again, if someone successfully accesses my account I receive a notice. Some financial institutions provide similar services, but there can be settings which block the notification. With one financial institution, notifications are blocked throughout the night by default. I assume this is to prevent waking you up, but it offers an open schedule to criminals. The following default settings should be changed to "Send messages any time".

Proton offers this service, but in a different way. You must have the mobile app installed on a device to receive the notification. Upon successful login, a system notification from Proton is presented on your mobile device, which opens a browser to display a website with generic details.

If you host a web site, you should enable notifications on the host account page and within cPanel. After configuring the following menu in the "Contacts" setting, you will begin receiving new notifications via email of every login, FTP access, etc.

Knowing the IP address of the access is great. I wish all services offered this feature. The following is my email notification during testing.

Proton offers the ability to capture the IP address of every login, but I do not enable the feature. I only enable "authentication logs" without "advanced logs", as seen below. I do not want Proton storing my access IP addresses, even if they are encrypted. Besides, anyone who successfully accessed my account would be using a VPN anyway.

Throughout a typical day, I receive many of these alerts since I wipe my stored logins every night. I am never annoyed. I wish more services offered a similar service. Receiving false alerts due to my own actions is justified. If a notification arrives without my action, I know I have a problem. The absence of alerts gives me comfort as I know those accounts are currently safe. Please consider researching your own accounts to see what options are available. Make sure your settings are optimal, and check them again every few months. When you find a high-risk account which does not offer any login notification option, let the service provider know you want it. If enough of us demand change, we just might get it.