pranav chakkarwar

Single user WKD setup

Sun, 15 Jun 2025 00:30:00 +0530

A WKD server makes it easy to find genuine PGP keys and avoid fake ones. But, maintaining a WKD server for a one or just a few email addresses would be an overkill.

Fortunately, there are simpler alternatives:

Self-host the public key.
Proxy-serve the public key from a third-party keyserver.
Point a DNS record to the keyserver hosting the public key. Assuming, the keyserver allows this setup.

I like the first option because it gives us more control over how our keys are handled and we only need a webserver FTW! So, let’s self-host!

Create a PGP key pair

Quickly generate a key

gpg --generate-key

Generate a key with advanced options

gpg --full-generate-key

View metadata of your key

gpg --list-keys

Example metadata

pub  rsa4096 2025-05-10 [SC] [expires: 2035-05-10]
     0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
uid  [ultimate] Name <name@example.com>
sub  rsa4096 2025-05-10 [E] [expires: 2035-05-10]

0000 0000 ... is the KEY_FINGERPRINT

Export the public key

The public key should be saved unarmored, and named after the WKD hash of itself.

View the WKD hash of your key

gpg --with-wkd-hash --fingerprint KEY_FINGERPRINT

Example output for the WKD hash cmd

uid  [ultimate] Name <name@example.com>
     WKD_HASH@example.com

The next cmd will save the public key in your Downloads folder, named after the WKD_HASH of your key.

Don’t forget to replace KEY_FINGERPRINT and WKD_HASH with the fingerprint and WKD hash of your key.

Delete whitespaces from the fingerprint, if any.

gpg --no-armor --export --fingerprint KEY_FINGERPRINT > /home/$USER/Downloads/WKD_HASH

Web server configuration

I’ll assume you’ve copied the exported key file to the server.

I use Caddy, so I’ll focus on it’s configuration and skip tutorials for other web servers. Sorry.

Add this to your Caddyfile after replacing example.com and WKD_HASH with your domain and your key’s WKD hash.

openpgpkey.example.com {

    header /.well-known/openpgpkey/example.com/policy Content-Type text/plain
    respond /.well-known/openpgpkey/example.com/policy `protocol-version 5`

    handle_path /.well-known/openpgpkey/example.com/hu/WKD_HASH {
        header Content-Type application/octet-stream
        root * /path/to/wkd/file/WKD_HASH
        file_server
    }
}

Comments on Caddyfile configuration:

As per WKD’s RFC draft, the webserver must serve a policy file at:

/.well-known/openpgpkey/example.com/policy

with headers:

Content-Type text/plain
protocol-version 5

The headers are important, this policy file can be empty.

The webserver must serve the unarmored public key file at:

/.well-known/openpgpkey/example.com/hu/WKD_HASH

with header:

Content-Type application/octet-stream

Testing the WKD setup

When set up correctly, any WKD-compatible client should be able to retrieve the public key from the server over an encrypted TLS connection, potentially with DNSSEC verification against the domain.

You can test your setup using the --locate-keys option in gpg.

gpg --locate-keys whatever@domainname.tld

It should say new keys imported or output the key’s metadata if it already exists on your machine.

As per my test, the OpenKeychain app on Android could correctly fetch the key from my server using just my email address. Third-party keyserver search was turned off during the test.

It’s almost as if all this setup is just a way to bypass using the --fetch-keys option. lol

gpg --fetch-keys https://link-to/public-key.asc

Nokia's deceptive designs to collect our data

Mon, 10 Jul 2023 00:00:00 +0530

Setting up a Nokia device

Last week, I was obliged to use an old phone of mine (a Nokia) because my bank’s app refused to work on my primary de-googled device. And, during it’s setup I was kinda shocked to discover the many dark patterns Nokia used to manipulate my decisions.

Right at the start, I was obliged to press a very logically named Let’s go button, which would let Nokia collect my device’s location and a device activation code. I think Nokia should replace Let’s go with Take my data.

They somehow also came to the conclusion that it was absolutely necessary for them to know my location and device activation code for me start using my phone.

As you can see in the screenshot below - I can’t opt-out, it’s COMPULSORY.

After that, I had to accept the usual BS of Google wanting access to my device analytics, my device location, and whatnot.

Dark patterns

And, just as I thought the setup was complete, Nokia decided to step back in with a deceiving congratulatory screen that said in huge font You are nearly ready to go…! and in a smaller font By tapping LET’S GO! You agree to join the User Experience Programme … something something.

To complete the setup, I can either tap a big blue Let’s go button or tap a less noticeable Not now… button.

A dark pattern, indeed.

Fuel for the upcoming fire

Nokia should get full marks for diverting people’s attention from important links by making the colour of links the same as rest of the text.

Even if you manage to click on links, you will be shown more pop-ups, obscure links, and useless jargon.

As an example, the link to User Experience Program’s data collection policy is hyperlinked to here instead of User Experience Program.

I wonder why a multi-billion dollar company doesn’t care about accessibility? Or maybe they care more about monetizing our data?

Nokia’s terms of User Experience Program.

If you agree to join it, Nokia will collect,

Your device’s IMEI number
Mobile country code
Mobile network code
Device model
Nearby Wi-Fi access point names
System version
Installed apps, and how often you use those apps
App crash info
Location
IP address
Battery level
Features you use
LINKS you use!!!

Shame on you Nokia.

Crisis proofing my communications

Sat, 08 Oct 2022 00:00:00 +0530

Looks of a Crisis

Amini’s death over Hijab sparked protests in Iran, so the government decided to use censorship + its so-called Moral police in response to the protests.

Such is the nature of Authoritarian Governments, where people lack basic rights, where decisions often benefit the wealthy, and where people have almost no influence over the state.

The need to Communicate Privately

In such times, effective and private communication can protect people from abuse and even life-threatening situations.

So, during the protests, people from privacy and security communities started recommending WhatsApp, Telegram, and Signal, due to their commitment towards encryption and privacy. But, of course, these apps were quickly blocked by Iran. So, to tackle censorship, many people started hosting proxies for these messaging apps.

IMO, Signal is the best choice here because of it’s commitment towards transparency, encryption, and political stance. Unlike Telegram and WhatsApp, Signal also doesn’t store detailed information about it’s users.

So is it the best app?

Hmmm… Not really.

You see, proxies can help you bypass censorship, encryption can preserve your privacy, but these “secure apps” aren’t really designed to handle a political breakdown.

Issues with Centralized Messaging Apps

Let’s first talk about the most used app in Iran - Telegram. They say it’s private, but technically it is not even close to private. To make matters worse, less secure third-party clients of Telegram are very popular in Iran. Who knows, some of these clients might even be operated by the state to collect data and disrupt communications during a crisis. See, how the two most popular Telegram forks of Iran were used to scrape data from millions of users.

Moreover, people can be tracked using metadata that is beyond the control of these apps. For example, the telecom operators, which are probably already involved with the state, can get into a Telegram account by intercepting Telegram’s OTP and export the entire chat history (unless the Telegram registration lock is enabled). This at least not possible with apps like Signal or WhatsApp because your chat history isn’t stored on their servers. However, their requirement of phone numbers still puts people at risk as the telecom operators can determine the location of phone numbers receiving the OTPs.

All in all, these secure apps can only protect your messages but not you, and during a political crisis even strong privacy protections becomes useless without anonymity.

Internet Censorship

When the internet is censored, proxies to one or two services can’t help. You can send messages with Signal, but where will you get your news from? How will you find out what’s going on at the protests? How can you follow people when social media is blocked? Furthermore, proxies hosted outside of Iran are kinda useless are they are inaccessible due to ISPs blocking connections to Non-Iranian IPs.

At this point, Tor might be the only option to connect to with the real Internet. So, if you want to help, I’d suggest hosting Tor nodes rather than service-specific proxies. Visit Tor’s website to learn more about their goals and technology.

Internet Shutdowns

Now comes the worst part.

What will everyone do if the internet goes down completely? Are proxies or even Tor useful then? Centralized systems can’t work when the center itself is the culprit.

Of course, this does not imply that all systems should be crisis-ready, but recommending them during a crisis is the absolute last thing anyone should do.

Instead, we should recommend, the most decentralized, zero-trust solutions like Briar, which allows people to communicate without relying on third parties services of any kind, not even the Internet.

Meet Briar

What if you could send messages using, only your phone? Yeah, that’s possible with Briar.

Briar doesn’t ask for a phone number, or any other personal identifiers. When connected to the the Internet it can route your messages over Tor. So, you can communicate privately and anonymously while also bypassing censorship. There are no centralized servers involved.

During an Internet shutdown, Briar can use Wi-Fi or Bluetooth to communicate with other Briar users nearby, and also share the Briar app to those who don’t have it. With enough devices, people can even build a large scale Briar communications network.

If wireless is not your thing, Briar allows you to send messages by exchanging USB drives.

All communication is always end-to-end encrypted. So, almost nothing can stand between you are your right to communicate.

According to Briar’s website, it is already resistant to attacks involving Metadata Surveillance, Content Surveillance/Filtering/Takedown orders, like some other E2EE apps, but it is also resistant to DDoS attacks, Server side Zero-day vulnerabilities, Internet Blackouts, Communication interference/failure, Compromised users, and even attacks where someone decides to deploy nearly unlimited Briar devices.

The only caveat is that Briar being only available on Android. This is not because the team is uninterested in it, but because Apple is uninterested in user freedom and privacy, while advertising that it does. Anyways, Briar project is planning something for iOS users.

Now, go visit Briar’s homepage and its Manual, where you can, explore download options, and learn more about how the app works, the team, and their funding strategy.

Safing my digial life

Tue, 12 Jul 2022 00:00:00 +0530

The story

I can still picture my young self enjoying funny videos from YouTube or browsing forums to get a cheat code that helps with a difficult gaming mission. The web at the time was difficult to navigate, but it was still a place where I could have fun (even with my 256 Megabit connection). The search results were a little sloppy at the time, but they did the job.

Today’s internet is after your data, money, time, and I’m not sure what else. It seems that we can no longer tell what is garbage and what is not. Without tools like an Ad blocker, all you see are sponsored search results, tailored ads, trackers, analytical tools, re-targeting mechanisms, dark patterns, and other BS.

In the early days, companies like Google and Facebook promised good technology, but as they grew into large data collection companies, they simply became gatekeepers and manipulators that we didn’t elect. As an individual, I am no different than you are. I was a power user of their services.

I have also observed that many other data collecting services are marketed with an emotional story. Sure, there is some utility but the overall experience of such products/services is BS, because the value of the utility and people that are supposed to deliver the utility value are earning profits from elsewhere, which can change anytime that they want.

One fine day, YouTube recommended me a video by The Hated One, and from there I got to know about websites like privacytools.io, which helped me realize a lot of things in a short amount of time. At first, I was stunned to hear totally opposite opinions in this space, and it was hard for me to believe them right away. Only after I started to tinker with software and hardware myself, I started to respect some opinions. I was also misguided many times along the way, but it appears that I am now confident enough to guide others. At least, I don’t recommend Qubes OS to everyone I meet :P

I wish I could cover all the details of my journey, but as I began writing, the details themselves turned out to be a 15-minute read. So, I’ll try to get straight to the point, and by the end you’ll understand how my approach and my setup is designed to fight adware, spyware, and other nonsense that they promote. If you have any questions or suggestions, feel free to contact me.

Overview of my digital space

Read my article on a simple and effective guide to online privacy for suggestions on devices, operating systems, apps, and more.

Eliminating points of trust

For me, eliminating (and sometimes replacing) points of trust from the products and services has proven to be the most effective tactic to get some degree of digital privacy, freedom, and data ownership.

I’ve never heard of “Points of Trust” in this context, but I’m sure I may not be the first to mention it.

Points of trust can be:

Hardware
Firmware
Surrounding Devices
Operating System
Network Stack
System Apps
App Repositories
App Dependencies
Browsers
Other Apps
???

Try to strike a balance between your trust in the hardware, software, services, how much you spend, how many devices you use, off-topic personal factors, and so on. You simply need to learn to identify points of trust and try to eliminate/replace points that you believe are SUS.

Choosing better points of trust

It is obvious that you can’t eliminate all points of trust, so when you replace one, you should do it carefully. Some points are easier to replace, like apps, and some are harder, like hardware.

A common recommendation that I’ve seen is that you need to spend some money to achieve good levels of privacy and freedom, but consider this: You are not paying for your privacy and freedom, but for the convenience and reliability. For example, you can pay for Google Photos or Ente or Stingle Photos, all of which are reliable, but Google does not come with the privacy features that others promise. Only If laws had been stricter or customers more aware, Google might have shipped their products with features that are better than the others.

Privacy and Freedom are fundamental, whereas convenience and reliability are essential. Fundamentals should have been the default. Unfortunately, that is not the case and most of us are paying for the fundamentals. Although, there are times when you need to sacrifice one for the other, but you should try to find a happy medium. Currently, we know how unbalanced everything is.

You can also go the self-hosted route and use one of your devices as a server, but to make it convenient and reliable, you may have to invest more time and money for things like offsite backups. There are some times when going with hosted solutions is advantageous. As an example, all the people that use the @anonaddy.me alias achieve better privacy compared to self-hosting it with a custom domain.

I would say self-host what you can, as apps that connect to the internet are often the most vulnerable points. Furthermore, I prefer Free (as in Freedom) Software because of its design philosophy that gives a user complete control over their hardware and software + Open source code. That combination is so good that I’ve abandoned nearly 5 self-hosted services that were simply not designed for networks, but instead work well as offline apps with frequent backups.

Distributing points of trust

Even the most promising points can fail to deliver on their promises if you do your research on the wrong corners of the web. Jurisdiction in which your services are hosted also play an important role. This is, unfortunately, a thing, so keep yourself informed about the jurisdiction in which the service operates and where your data is hosted. Everyone may not have the time, skills, or knowledge to conduct their own research, So that’s another obstacle you’ll have to overcome. Yes, you can pay someone for consultation, but it’s better to ask questions online first.

Not all products or services will remain unchanged throughout their journey. So it’s probably a good idea to stay up to date on product news and updates. See how DuckDuckGo Browser allows Microsoft trackers while blocking others? While DuckDuckGo as a search engine is not a complete failure, but it will make you feel uneasy.

In my case, I have split my points of trust between a VPN provider for traffic and a DNS resolver for DNS queries. I have a Raspberry Pi 4B for self-hosting apps like Pi-Hole, Home Assistant, and Node-Red. The Raspberry Pi also serves as a point of TLS termination for some services that are proxied using my VPS (like, Jitsi Meet). TLS certificates are handled by an ACME bot. All my devices only ever connect to the RaspAP hotspot, and most traffic is goes through a trusted VPN provider.

Before using a VPN, consider watching this video.

I made great effort to separate my traffic from my DNS queries. Most services are hosted on a few platforms and, separating my traffic from my DNS queries definitely helps.

Debian and Fedora are my primary operating systems, and I try to use apps that come with the OS rather than apps from third-party repositories. I also try building apps from source (such as Signal) and I’m currently looking for a self-hosted build service so that I can easily build more apps from source.

From simple Notepads and Markdown Editors (Apostrophe is a good one) to full suites like LibreOffice, freedom software lets me own my data and allows me to make my apps look and feel the way I want them to be. I regularly make backups of my data to a cloud service after encrypting it with Cryptomator. If you’re searching for an easy-to-use backup solution, take a look at Déjà Dup.

Security

There is no point in using insecure hardware or software just for the sake of something. While nothing is completely secure, open source code, security audits, ability to build from source, and regular software updates play an important role to help secure your tech.

I prefer to work offline, so I miss out on real-time cross-device features that come with hosted services. As an example, I use KeePassXC, which comes with some sacrifices, but it helps me advance my OPSEC. Offline first also removes a large attack surface that is usually present in software just because it connects to the internet. With offline apps, you can truly own and protect your data as if it were physical property. If you think an app is misbehaving, use a firewall.

Going unbound

I was previously bound to the few internet gatekeepers, and today I am on my way to self-host the Unbound DNS resolver. I have used unbound as a pun to describe how Unbound describes how I no longer care about the overloaded commercial interests of already rich people.

Freedom is fundamental, but it is declining in the digital space and the physical world. As access to information, jobs, identities, government services, benefits, and everything else goes online, it is crucial to take measures and guide others because soon enough your useless memes may determine what you are allowed to do in real life. Umm… it’s called social credit score in China, and it is, indeed, dystopian.

Encrypting emails without managing keys

Sun, 08 May 2022 00:00:00 +0530

Who should use this?

This is not for you if you might be subjected to targeted surveillance. Please continue to use a proven setup that fits your use case. I’m writing this article so that we can explore into new ways to combat automated surveillance. Many people use something like Gmail and connect third-party apps to it. These third-party apps frequently request your permission to scan your emails for a variety of reasons. One app I came across used Gmail scanning to pinpoint and remind you of your flight/train/event tickets, but it would have to scan all of your emails to determine which ones are ticket-related. So, If you use something like that, your only point of trust is their privacy policy.

Speaking of policies, Yahoo’s Privacy Policy states that the company has the right to “analyze and store all communications content, including email content from incoming and outgoing mail, as well as incoming and outgoing messages to messaging apps.” Yes, it’s that bad, they scan your communications themselves, but but but, they don’t use it to steal money using our bank pin. They are trying to earn money by automatically scanning our communications and then influencing us into buying things. Which, in my opinion, is like indirectly taking your money.

My post was downvoted and removed from some Reddit communities, because I was not using recommending something that that protects Edward Snowden and deals with every kind of surveillance.

I am saying this again: This approach is not designed to protect us from the best hackers, but to keep our communications private from all of the automated scanning and targeting around us.

Password protected emails are somewhat useless

Many email providers like, Tutanota, ProtonMail, and others have an option to send password protected end-to-end encrypted emails to people who do not use PGP or some other form of encryption. When you send a password protected email, the recipient receives a notification email that points them to a webpage where they can enter a password and view the original/unencrypted email.

When I first learned about it, I thought, that’s a stupid feature, because the email providers need you to send the encrypted email’s password over another secure channel. So, what’s the point of exchanging a password using something like Signal when I can just use Signal? It appeared to me that email providers were promoting a pointless feature, but later I discovered that many people prefer only email, so they can keep records, or avoid giving their phone number, and so on. Now, we have some use cases for the feature, but no solutions.

We could use something like the session app (which does not require phone numbers) to exchange a password, but then, a recipient will have to use/install a whole new app which brings us back to square one. Anyway, after some thought, I came up with a simple, private and reliable solution.

Making password protected emails useful

Meet Private bin, a zero knowledge paste bin that lets you share text using self-destructing links. The idea is to paste/submit a password to private bin and share the link to your password via email. Once the recipient has the password, you can use it to encrypt all future emails.

You could argue that the link was sent as a regular email, so how can I be certain that the contents of that email were not read by a third party, like an automated bot scanning our emails or Private Bin itself? Your question is genuine, and the answer is very simple. When you create a link with Private Bin, the message is end-to-end encrypted, so even Private Bin cannot read it (a zero knowledge solution). This claim can be verified using Private Bin’s open-source codebase. If you are too paranoid, you might as well self-host Private Bin. Moreover, you can set a link to self-destruct after a single view. So if the link is targeted automatically, the contents are destroyed and can never reach the intended recipient.

Let us take a look at the two possible scenarios:

Possibility one

You create a one time link and send it over email.
The link automatically scanned and is self-destructed.
The real recipient asserts they didn’t get the password because the link is empty.
You are now aware that your emails are being monitored in some way.
You can change apps or deal with the issue in your own way.

Possibility two

You create a one time link and send it over email.
The link is visited by the real recipient and is self-destructed.
The real recipient confirms they got the password.
You are now aware that your emails are not monitored in any way.
You can now encrypt future emails with your exchanged password.

Many of you pointed out that if the emails are being scanned/surveilled, why can’t the email provider or another similarly privileged user act as your recipient and continue reading and responding to your emails? The answer is given by the distinction between targeted surveillance and automated surveillance. Automated surveillance include threats from authorised third party apps scanning your emails or exposed email data due to lax server security. If your threat model is so high that you can’t trust your email provider or its security, then, I’m not sure why you’re using email at all.

Anyway, this method will protect your communications without requiring you to exchange phone numbers or switch apps. Your messages will remain private, even if your recipient is using a non-private email service. You on the other hand only need to use a private email service that supports “Sending encrypted emails to external recipients.”

Ditch email

I’ve already pointed that it’s ideal to exchange contacts via email and switch to a secure messaging app. If you still need to use email, consider using Private Bin or an app like Delta chat, it uses autocrypt to encrypt emails. If you’re comfortable switching apps, use an app like signal or session that will not only encrypt your messages but also metadata. Use whatever works for you and your recipients, but try to use a more secure communication channel whenever possible.

I browse social media without being tracked

Sun, 27 Mar 2022 00:00:00 +0530

Privacy vs Anonymity & Censorship

This isn’t a guide that will help you become anonymous on social media, but a guide to help you stay updated, without giving up your privacy. It’s not about politics or platform liberties, sometimes I just want to know about new features introduced by a chat app or get the latest news even if they use twitter or facebook instead of Mastodon. At the same time, I don’t want the social platforms to track how much time I spend on their app, which posts I like/comment on, how long I watch videos, or how long I stare at a particular post.

Likewise, I will only cover platforms that most people use. Alternatives such as Odyssey (an alternative to YouTube) or Mastodon (an alternative to Twitter) and others are trying to solve problems other than just privacy. So it’s best if I write a separate article on them and don’t confuse you by explaining multiple views at once.

I hope my recommendations will make your life easier while avoid being profiled for an advertisement. I felt a need to write this because most people end up spending money or putting in a lot of effort to protect their privacy, only to end up back where they started.

Define your approach

I don’t believe there is a “one-size-fits-all” approach to prevent all tracking. You must define or choose a strategy based on your threat model.

Opt-out of tracking

Social media is free because you have to see generalized or curated. So, the first step is to make your intentions clear by changing your privacy settings and opt-out of tracking, personalized ads, etc. Most online services allow users to opt-out of personalized advertisements, but in some cases opting out won’t stop them from collecting data about you. It may mean that they will not use the collected data for targeted advertisements and even if a service allows you to opt out of tracking, there is no guarantee that the service will respect your settings. Due to lax privacy laws in many countries, some businesses consider breaking law and put money aside to fight a potential lawsuit. As, sometimes, your data is more valuable than the money required to settle a lawsuit. They can track you illegally, make large profits, and then spend a small percentage of the profit to settle a lawsuit.

As people say,

Taxes are paid to do the right thing, while fines are paid to do the wrong thing.

For reasons like this, I recommend you to do more than just opt out. Read along to learn the techniques.

Use web apps with ads, and trackers blocker

Apps downloaded from app stores have more privileges than websites in your browser. So, it’s better to use websites or install the PWA version of a website. Also, try to use a more private browser and If possible you should install extensions like uBlock Origin and Privacy Badger. Extensions are not a problem on desktop versions of browsers, but mobile browsers may or may not allow you to install extensions. Like, Firefox for iPhone does not allow extensions, but Firefox for Android does. The Brave browser maybe a good choice for most people as it includes built-in ad and tracker blocking, but it’s not ultimate. Personally, I’ve noticed brave allowing a lot of trackers from Twitter. For Android, I recommend using Bromite or FOSS browser.

If installing extensions is not possible, or you wish to block trackers in native apps, you will need additional apps or use external services. Some apps block ads and trackers at the system level, while others do so at the network level. Pi-hole or NextDNS do it at the network level, whereas AdAway or Portmaster block trackers locally on the device.

Keep your account private

Apart from the service, you might want to prevent other users from tracking your activities. It’s better to keep your account private and only accept follow requests from people you know. This prevents stalking and your social media activity will be hidden from search engines. But keep in mind, this will not protect you from the service itself. For example, you can use a private Instagram account with no followers to store unlimited photos that no one can see but Instagram very well can.

Hide your identity

You can consider hiding your real name If you don’t intend to use social media to connect with people you know. Again, the platform on which you are creating an account most likely knows who you are as you provide them an email or phone number and other metadata like IP addresses. In my opinion, it doesn’t matter because the goal of an alt account is to hide your identity from other people, not the service itself. If you need anonymity, consider using a VPN or TOR, but nothing can make your activity untraceable.

With enough determination, funds, and power, almost anyone can be tracked down.

Although I came up with this quote, it’s possible that it’s been said before.

Go accountless

Going accountless will limit your ability to interact with accounts or posts, but that will not necessarily prevent you from customizing your feed’s content. You could also use the accountless approach to get updates and only visit your account once in a while. Open source third-party apps such as Fritter (for Twitter), NewPipe (for YouTube, SoundCloud, and PeerTube), and F off for Reddit, as it killed most third-party apps, let you browse the underlying services without creating an account. For e.g. Fritter allows you to follow Twitter accounts and even create account groups. These apps will retrieve the content from services and display the posts in chronological order. Along with ads and trackers, these apps will also remove service specific bloatware. Like, Fritter removes Twitter shortened URLs or NewPipe helps you stay focused by giving you an option to turn off recommended videos.

if you prefer using a browser, try using privacy frontends to limit website tracking. These frontends also allow you to follow channels and accounts using RSS feeds. You can use apps like farside or UntrackMe to automatically redirect you to a working frontend when you click on a link.

Use site feeds

Feeds are the next level of going accountless. Yes, feeds still exist and are still one of the best ways to get updates while also aggregating all of your sources. Feed readers also give you an advantage over other methods because they allow you to hide your IP address from original services. The trick is to use the feeds of privacy frontends, so the content is loaded from servers of frontends and if you decide to visit a site from your feed app, It will launch the frontend and not the underlying platform. This way, you do not reveal your IP address to underlying services. If you use feeds, may have to give up some service specific features that other apps provide.

Personally, I use Feeder on Android and Fluent Reader on desktop. For Apple users, NetNewsWire is a good option. Thunderbird also has a feed reader, but It feels outdated. If you are looking for a self-hosted alternative, I recommend Miniflux.

Aside from privacy benefits, you will spend less time on social media and avoid unnecessary interactions curated for you by the algorithms. Please let me know If you know an app that I should include. I’ll add your recommendations, as well as a link to your profile. Thanks for reading and Happy browsing :)

Protecting my emails

Sun, 27 Feb 2022 00:00:00 +0530

Email is messy

Your inbox is most likely flooded with promotional emails, spam, and even emails from scammers. An email address allows you to access the majority of the internet and is essential when communicating online. It can help you get discounts or even job opportunities, but it can also be misused by scammers or sold to marketers. Email, as important as it is, is also the most vulnerable. In terms of security, data privacy, metadata, profiling, and identification, it is worse than any other communication channel.

Emails almost always contain trackers

Most email contains trackers that are used to track open rates, click rates, etc. These can then be used to determine if you will purchase or subscribe if you’re a re push a little to do so. These tracking techniques can also be used for personal emails. There are many services that allow you to track individual emails. Good email clients and providers block these trackers by default.

Your email address is on sale (Probably)

Every day, data breaches occur, and your email address is most likely available for purchase through a data broker. You might expect a rush of emails offering discounts, employment, or even frauds once your email address is offered to several marketing companies. You can check if your email is leaked at Have I been Pwned. Protecting your email address, on the other hand, is very simple. You can set up an email forwarding service and share your genuine email address only to people you trust. At other times, when you sign up for a website or shop at a store, you can easily create an email alias by using the email forwarding service. These services often have many domains to choose from. Thus protecting your real email from leaks, spam and scams.

Let’s take an example to better understand this. If you’re signing up for a social media site and also shopping at a store. You can create a two email alias like social-acc123@my-email.tld and tempuser-shop@notfakeemail.tld. One for the website and one for the store. If any of the email addresses are leaked or sold, and that email address begins to receive spam, you can disable that alias, but the other alias will still receive emails. Aliases also help safeguard your identity from being traced. As in this case, the social network would have no way of knowing that you purchased an item at the store because you saw an ad for the same. Yes, if happens because many small stores sell your data to big tech companies. The companies can then try to track you even in the physical world.

Email exposes a lot about you

If possible, I would never use email again, but I guess the freedom to communicate with anyone without an ecosystem is great. Anyway, Email exposes a lot of data. It doesn’t even matter if the email itself is encrypted. The subject line is often passed in plain text. If you look at the headers of your emails, you’ll see how much metadata is exposed with each email you send. The metadata exposes things like who is talking to whom, when, how regularly, and from where! Even your own IP Address can be leaked if you are using a sub-standard email service provider/email client. This data is frequently abused for mass surveillance. To add fuel to the fire, most people are using ad supported email providers.

To avoid spammers, most email providers require personal information such as phone numbers when signing up. You may argue that phone numbers have nothing to do with the confidentiality of our messages, and you are correct to some extent, but these identifiers can be abused for mass surveillance. It is critical to safeguard our metadata since it can be linked to data obtained elsewhere. Don’t worry if you’re new to this or don’t understand what I’m saying. I’m working on an article about metadata that will offer you a better understanding. Stay subscribed.

Overall, email is very bad for privacy

Email is insecure in terms of privacy, but because of its decentralized nature, it allows people to interact effortlessly even if they use different email providers. So it is very important to choose the right email provider and use an alias service with it. If you need help picking an email provider or other privacy services, read my post on improving your privacy online. You can self-host an email server to achieve the best privacy with email, but it’s not easy. If you are interested in a guide to do so, please let me know.

Solutions summarized

Use a privacy respecting email service
Deploy an alias service in front of it
Don’t give your real email to services/people, instead give an alias
Don’t expect privacy from email
If possible, avoid using email and use messaging apps instead

Building a static site with Jekyll

Thu, 06 Jan 2022 00:00:00 +0530

Jekyll - A static site generator

A static site generator creates a static HTML website from a template and raw data. In essence, it automates the job of generating and maintaining individual HTML pages and prepares them for serving to users ahead of time. A static site is ideal for something like a blog, where the material doesn’t need to be updated frequently. We can use a content delivery network to cache the site, thus storing a copy of it on hundreds of servers around the world. The CDN can then offer the site to any user from the server that is closest to them. This helps us save money on servers while allowing users to access the site faster.

Jekyll is my choice because it claims to be “blog-aware”, offering features that will make it easier for us to maintain our code and keep the blog running smoothly. It also offers hundreds of community-created plugins, including a feed generator, a sitemap generator, an admin panel, among others. I assume you have some basic knowledge of HTML, CSS, and JS as I cannot cover that here.

Creating a fresh site with Jekyll

To begin, install jekyll for your operating system.
Following that, we’ll create a basic Jekyll structure.
Create a new directory and open it in VS Codium.
Ctrl+Shift+’ opens a terminal in Visual Studio.
Run jekyll new-theme [Replace this with whatever name you want] to generate a new site in the current directory.
You should now notice some generated files and directories.

Here are some important ones.

_includes
_layouts
Gemfile
config.yml

Jekyll’s directory structure

The key directory to organize your site is _layouts. This directory contains a default.html file. The default file’s HTML structure will be used by jekyll to produce all the site’s pages. The structure of all your blog post pages can be defined using a post.html file, etc.
You can write short bits of code in the _includes directory that you can place on different pages of your site. For example, an HTML file that contains the navbar’s code can be included in the default layout, ensuring it appears on all of your site’s pages. The site’s post.html can be included with an _includes file for the comment box which will only appear on the pages of your blog entries.
Jekyll runs on ruby, and all the plugins that you install for jekyll are ruby gems. What are gems? Let’s ignore for now. You can include gems using the Gemfile that was generated with the site. We will come back to this file when we install some plugins.
The file _config.yml is crucial because it contains the site’s metadata like, Name of the site, URL, author, domain, schema site category, social network links or other static data. It can be used to exclude or include files, change plugin settings or control the use of plugins. You can use your Gemfile to install dozens of plugins, but ask jekyll to use only a few of them using the config file. A file or directory whose name starts with a fullstop or underscore is excluded from the final site, but the config file can override this too. Ultimately, use the config file if you want to tweak something.

Crafting some pages

My blog features an index.html page with information about me and the latest blog entries, a blog page with all the posts, a contribute page where you may support my selfless work, a contact page with my end-to-end encrypted contact form, and a search page to search through all the published articles. Once your site is built, you can use the name of the file to visit these pages.

You’re free to make as many of these files as you’d like.

index.html
contact.html
contribute.html
etc

Each page will use the data defined in default.html of the _layouts directory, unless you specify otherwise. Jekyll uses YAML to customize the title, description, meta image, layout, and any other metadata for each of all pages. An example YAML of my index.html page is shown below.

---
title: Pranav
description: I'm a minimalist writing on privacy...
layout: default
image: /images/metaimg.jpg
---

To make a page available at a different URL than its file’s name, use permalink in your YAML. The YAML below will make a page available at example.com/custom-url, regardless of the page’s name.

---
title: A new page
description: Just a page
layout: default
image: /images/image-name.jpg
permalink: custom-url
---

Build your website

To build your site jekyll uses some commands that must be typed into the terminal of the directory containing your website. The jekyll build command will build your site using the layouts, config.yml customizations, YAML in individual pages, and export it to the _site directory. You can serve the _site directory locally using the jekyll serve command, and your site will be available at localhost:4000 through your browser.

This _site directory contains all the files you’ll need to launch your website using a cloud provider.

Crafting a minimal, fast, but a feature-rich blog

Wed, 24 Nov 2021 00:00:00 +0530

Establish your identity with a blog

Thanks to the internet, people can build an identity that spans countries and continents, opening up new opportunities for you to work and interact with people you would never have met otherwise. Businesses, too, use blogs to establish a presence of their product or service, it also helps them develop a transparent relationship with customers and competitors.

Be creative

Overlooking the technological aspects for a while, it will be your articles that determine whether you grow or fail. All the tactics used to keep people engaged for longer periods of time, such as dark patterns and keywords, may result in a rapid up-sell or more messages. But, they will not develop a genuine and long-term relationship with the reader. Your writing, and only your writing will be valued by the reader.

Stick to a niche - or don’t

Commercial/Marketing blogs are typically focused on a specific topics. Personal blogs, on the other hand, are supposed to create a relationship with the reader, not to make money off of them. Take, for example, my own blog, which covers themes such as privacy, web development, and others. And eventually, I might start writing about my life experiences. So, in the end, the decision is yours.

Buy a custom domain

Your domain is your unique identity on the internet and will be in charge of your website, email address, analytics, and your reputation. Don’t spend too much time thinking about a name or paying a lot of money for a premium name. The domain market wants you to acquire pricey domains that pretend to increase your search ranking. Your meta tags, keywords, or domain names are no longer believed by search algorithms. They’ve refined their AI to examine and sort information appropriately. For a personal blog, try using your first and last names with a .com, .xyz, or your country’s top-level domain and see if it sounds nice.

Understand your tech

There are far too many website builders to choose from, both free and paid. I’ve tried Over 30 different website-building softwares. Each tool having its own set of features, benefits, and limitations. However, almost none of them could give me complete control over the data, hosting infrastructure, security, architecture, and other factors. Although I believe that coding the website yourself is preferable, but if you do not want to learn new skills, you may have to use a website builder or hire someone to code it for you. Don’t be fooled by internet guides into thinking that buying expensive themes and hosting would guarantee you top search rankings.

Loading speed matters

Nobody wants to stare at a loading circle much longer than a few blinks. To have your website load quickly, you must first generate it and then submit it to a content delivery network (CDN). A static site will load much faster than a website built with a website builder like WordPress, as the pages are ready to be served from the closest server. We’ll use Jekyll to generate a static site that can be hosted on Uberspace, Alwaysdata, Codeberg, Netlify, GitLab, and a variety of other services. Some are CDN’s, others are not. We will also explore how to host it on a Raspberry Pi.

Monetize your blog - or don’t

No one wants to work for nothing unless it’s for a cause they believe in. There are a variety of techniques to monetize your blog, some of which are transparent and others which are not. You can learn about dark patterns, which are designed to extract more money than the value they provide. Please evaluate and avoid such tactics when defining the the blog’s design principles.

Facebook is filtering thoughts, not photos

Fri, 29 Oct 2021 00:00:00 +0530

Years along, we fought wars purely to gain control of power and wealth. At some point, we decided to stop a person or a group of people to have the power to control and manipulate everyone else. With the birth of democracy, the power was distributed (perhaps unevenly) among the people. Centralized social media is attempting to change this.

However, the important question is, “Are we attempting to rectify our wrongdoings? or are we heading towards a doomsday?”

“Probably, yes”, because Facebook is now Meta.

Limiting the discussion to Facebook

One of the reasons to limit this discussion to Facebook is due to a fact that other centralized platforms act in similar ways. But the major reason is Facebook’s user base.

With over 2.8 billion people actively using Facebook services, it has long led the social media business. As of 2021, Facebook alone has a market share of 72 percent, see StatCounter. The most popular social media platform also controls the second and third most popular social media platforms, Instagram and WhatsApp. When competitor social networking platforms WhatsApp and Instagram saw their user bases grow, they were purchased by Facebook in order to eliminate the competition. Facebook now has the power to convince those users as well. It is undeniable that Facebook has a significant impact on our lives.

After a survey of Indonesians, Quartz Media quoted -

“It seemed that in their minds, the Internet did not exist; only Facebook.”

Not only Indonesians, millions of Facebook users have no idea they’re using the internet.

Overlapping of public and private interests

With the rise of social media, it was possible for most people to express themselves to the rest of the world. Similar to a parliament, but for ordinary people. But, Facebook is a privately held business and private corporations have their own goals, including increasing the shareholder value. Nothing’s compelling them to care for the entire community. Facebook can maximize its shareholder value by allowing people with money to get their voice to stand out from others, as Facebook is the one who deciding the engagement rate of your posts. To a certain extent, Facebook’s filtering maybe required to avoid hate speech, online bullying, and other similar issues. But, the Facebook algorithm isn’t publicly available. As a result, the mechanism that determines whose voice is heard and whose voice is silenced lacks transparency.

Facebook makes every effort to develop a relationship with the public that promotes a positive image. However, confidential papers recently obtained by Frances Haugen (a former Facebook employee) contradict Facebook’s policies and actions. Facebook was allegedly biased with misinformation, algorithm bias and promotion of violence in some countries.

Frances Haugen in her testimony stated,

The company’s leadership knows how to make Facebook and Instagram safer, but won’t make the necessary changes because they have put their astronomical profits before people.” She added that Facebook was “buying its profits with our safety”.

Facebook literally has a Wikipedia page titled Criticism of Facebook.

We have put our faith in Facebook’s transparency using mechanisms other than open-source code. However, revelations over the years have repeatedly demonstrated that Facebook’s algorithm requires more transparency for the public good.

Your data has been zucked

Facebook’s business model runs on collecting more and more data to profile people and show them highly personalized ads. This is totally contradicting to our right to privacy. You may think that regulations may stop Facebook from using the data from other purposes unless you know about like the Cambridge Analytica scandal. Facebook collects data about you that includes, purchase history, what kind of content you engage in, your political beliefs, your financial status, your adverts’ engagement. Facebook deploys an excellent AI algorithm that may trick you into buying things that Facebook wants. And In the case of Cambridge Analytica leak, all the data was used to manipulate the elections. Data is changing the way how people control the world.

Promotion of harmful content keeps people engaged on Facebook

Internal Facebook research reveals how Instagram impacts teenage girls, exposing them vulnerable to anxiety, depression, and other mental health issues.

The Wall Street Journal looked at a slide presentation that was put on Facebook’s internal messaging board and discovered,

“Thirty-two percent of teen girls said that when they felt bad about their bodies, Instagram made them feel worse,”

In response to the charges, Mark stated that Instagram would never encourage dangerous content because advertisers would not want their ads next to it. This, in my opinion, is a stupid statement, because Instagram need not display ads next to hazardous content, and would instead leverage harmful content to keep you engaged before putting ads next to good content. Feel free to contact me if I am missing something.

Maybe it’s not only teenage girls, because every time I opened Instagram, all I saw were people with more money, knowledge, fame, fantastic looks, and flawless lifestyles. Everyone knows, no one’s life is as good as it seems on Instagram. As you close the app, your mind starts making social comparisons with incomparable lifestyles than yours. Many of your newly formed beliefs may not be shared by those around you. If they do, you will be friends and if they don’t, you will be pseudo proud enough to ignore their reality. Over time, you’ll want to emulate the fake influencers’ lifestyles and use the items they promote, even if that costs you a fortune. You are now a perfect fit for Facebook to trap you in a loop of social comparison delivered by Instagram.

Instagram is the one profiting handsomely from your choices. It will continue to show you advertising that meet your toxic lifestyle standards set by influencers and sell you items and services that you may not even need. And don’t forget that even if you spend thousands over thousands, you’ll still be a long way behind the folks you’re comparing yourself with. You are now deep inside a rabbit hole where Mark is waiting for you with an advert for a therapist.

Facebook uses the main feed to keep you online

Facebook has displayed news feed items in reverse chronological order since its early beginnings. That means the most recent posts from your followers will appear first. However, in 2011, a new sorting algorithm launched, displaying posts that the users were most likely to engage with. The algorithm decided what to present first based on previous interactions, engagement and more.

Unfortunately today we don’t really have the knowledge of where AI takes us. And It may be possible to verify and improve the algorithm if Facebook makes it open source. But, again, it is best in Facebook private interest to keep it close sourced and, maybe, use dark patterns to keep users engaged while making more money by promoting a culture and brands that pay its bills.

Polarization and isolation between communities

People apparently refuse to listen to anything that contradicts their presumptions. Today, Facebook has made it easier to do just that. For example, if a message or image does not correspond to your values, Facebook allows you to hide similar content from being shown to you again. Perhaps this is a good thing. However, the AI will eventually catch up to you and will only serve you information that is entirely skewed towards a particular topic. Slowly, you’ll feel that your assumptions were correct all along and never listen to any other opinion.

Consider this: You are a flat earth believer (Yes, such people exist). In real life, people may make fun of you and explain more and better logical principles. At some point, you will have to accept some opinions that are against your thinking. This process of adjusting your opinions over time will help you develop a sensible thought process. However, in the social media era, if people don’t agree with you, you don’t have to discuss it with them or try to decipher their reasoning. You can join a Facebook group where someone else continues to highlight what you already believe in. You keep feeling good and keep engaging with people on Facebook thousands of miles away, while ignoring every other opinion, only to fall into a perfectly constructed loop by Facebook. Facebook can easily examine your interactions with posts and videos to establish that you believe the earth is flat and will keep you engaged and make more money. Such isolated communities may eventually drive you away from your closed ones, leaving you with mental health issues.

Facebook engagages in unethical censorship

Censorship is when a state’s government decides to restrict access to information for everyone or a group of people. Censorship can be challenged and exposed by independent media, but only if people allow them to exist. In the earlier times, traditional media could only convince a fraction of the population with common interests. Welcome to 2021, where advanced machine learning algorithms anticipate your every action and learn new strategies to select content curated for you each time you open the app, giving it great ability to control your ideas. The centralized social media is engaging in a different type of censorship that cripples control of the people. User uploaded content is inspected by Facebook to ensure that it is safe and harmless. This could be an excellent first step towards preventing abuse. However, the same scanning may be used to determine the level of engagement it will receive from other users. For example, Facebook may easily tamper with the algorithm that favours posts that encourage unethical articles, images or videos. Again, it appears that Facebook’s problem is a lack of transparency regarding its filtering process.

#DeleteFacebook isn’t easy - but not impossible

Businesses are on Facebook, and whether you like it or not, businesses must thrive in order for a society to exist, as they not only give jobs but also help advance us scientifically and improve our quality of life. You will always require products or services from a business to continue your daily life. With its advertising business, Facebook has positioned itself in a unique position that helps growth of a wide range of businesses all over the world. Facebook’s users are encouraged to use products, services, that pays Facebook’s advert fees. The centralized social media is dependent on the business model of Surveillance capitalism.

It’s difficult to delete Facebook because all of your friends, relatives, and co-workers are already there. And, No one will switch to signal or another app to chat to you, unless you’re Elon Musk. You may also face other problems while switching services. Perhaps your employer requires you to use applications and services that violate your privacy. That’s OK. Everyone wants to make a living, but not everyone is aware of or savvy enough to comprehend the invisible risks of closed source software and ecosystems. Your personal accounts are probably a good place to start a pro-privacy life. Read my article — a simple and effective guide to online privacy, if you need a list of tools that respect your privacy.

Facebook also makes the process of deleting an account more difficult by employing dark patterns, such as making the procedure lengthy or sending frequent account recovery emails. Don’t fall for that.

Why is everyone pointing fingers at Mark?

Shareholders of a publicly traded firm have the right to vote on the company’s choices. As you can anticipate, the more money you put into the company, the more power you have over it. This is not the case with Facebook and many corporations. There are three categories of Facebook shares currently available: Class A, Class B, and Class C. Class A shareholders have one vote per share, Class B shareholders have ten, and Class C shareholders have no voting rights. The Class A shares listed on the stock exchange available for ordinary people are under the name “FB.” Mark’s entire holding in Facebook is less than 51 percent, but he owns the class B shares. This practically gives him control of the corporation to the tune of 51%. Even if the entire board disapproves to his decision, his one vote has the power to overturn it.

To provide a strong solution that is unaffected by censoring platform providers or governments, the most recent decentralized alternatives are being built upon open technologies like activity pub. This is beyond the scope of this article, but watch for a follow-up on fediverse technologies like Mastodon, Peertube, Pixelfed, and more in the near future.

End-to-end encryption for HTML forms

Wed, 01 Sep 2021 00:00:00 +0530

Inspiration

In Jul of 2021 I came across a post from Tutanota as they introduced secure connect, an end-to-end-encrypted contact form for Journalists and alike. I then forgot about it until one fine day it stuck me that I could use the OpenPGP JavaScript library to implement something similar to secure connect. Within an hour, I was able to implement a basic end-to-end-encrypted contact form. Thank my skills to write 10 lines of code and thank the contributors who wrote much more lines to implement PGP in JavaScript. Tutanota’s secure connect has more features and better privacy protections than my form, but my implementation is secure enough for most people and can be self-hosted for free. In the end, it’s up to you.

Advantages of using end-to-end encryption

Almost all form backend providers support submissions over TLS/HTTPS. That means, if someone submits a message on your website, the message is already encrypted between the sender, form’s backend provider, form’s email provider, your email provider and you, but that also adds more participants to your conversation: form and email service providers. So, if you want to keep your conversation between you and the sender only, you’ll need an end-to-end encrypted contact form that encrypts messages on the client side before transmitting them. This way, email or backend service providers would not understand the contents of a message and as a result, you can use this approach to handle sensitive communications. This solution is also resistant to person-in-the-middle attacks. But, keep in mind that metadata, like, time of submission, IP address, etc, may still be recorded. I have also not considered any security aspects of end users or browsers. Like cross-site-scripting attacks or browser extensions. I will probably work on it when I have some time.

Take a look at my contact form to get an idea of the user experience.

Building a basic contact form

Add two inputs (name and email) outside the form because we obviously don’t want to any data that can be understood by some server. Rather, we will combine all the information and encrypt it before submission. I have surrounded the inputs with a div and assigned and id=useless to hide it using JavaScript after encrypting the message.

<div id="useless">
  <input
    class="form-input"
    type="text"
    id="visitor-name"
    placeholder="Your Name"
  />

  <input
    class="form-input"
    type="email"
    id="visitor-contact"
    placeholder="Your Email"
  />
</div>

Now, we will add a basic form with a submit button and a textarea for the main message. I am also adding a paragraph tag with id=form-result that can be modified using JavaScript to indicate submission status of the form.

<form id="e2ee-form">
  <textarea
    class="form-input"
    id="visitor-message"
    name="message from visitor"
    cols="70"
    rows="10"
    placeholder="Your Message"
  ></textarea>

  <input class="form-input" type="hidden" name="apikey" value="ACCESS_KEY" />

  <p id="form-result"></p>

  <button class="btn" id="submit-button" hidden>Send encrypted message</button>
</form>

Lastly, we need a button to call the encryptUserMessage() function.

<button class="btn" id="encrypt-button" onclick="encryptUserMessage()">
  Encrypt my message
</button>

Make the form look pretty

body {
  font-family: "Segoe UI", Tahoma, Geneva, Verdana, sans-serif;
  text-align: center;
}

input,
textarea {
  font-family: inherit;
  font-size: inherit;
  background-color: inherit;
  color: #fff;
  border: 2px solid #000;
  border-radius: 0.5em;
  outline: none;
}

.btn {
  font-family: inherit;
  font-size: inherit;
  padding: 0.5em;
  margin: 0.5em;
  background-color: #000;
  color: #fff;
  border: none;
  outline: none;
  cursor: pointer;
  border-radius: 0.5em;
}

#submit-button {
  color: #fff;
  background-color: #1e7e34;
  border-color: #1c7430;
}

Using JavaScript to make magic

Firstly, we need some external JavaScript files (openPGP.js) for encrypting the sender’s message. You can either download the openPGP.js script or let UNPKG deliver it for you. Instructions for both are available on openPGP.js github readme.

<script src="openpgp.min.js"></script>
<script src="main.js"></script>

Did you notice that I also added a main.js file? Yes, we will use it to pass our public key to openPGP.js, which will be used to encrypt the sender’s message.

OpenPGP provides a readKey function to read your armoredKey. We will pass a public key to it and store the result in a const.

const key = *PASTE YOUR PUBLIC KEY HERE*;
const publicKey = await openpgp.readKey({ armoredKey: key });

Once a user enters their contact details, name and a message, we will combine all three inputs as one whole message.

var combinedMessage =
  "Message: " +
  document.getElementById("visitor-message").value +
  "\n" +
  "Name: " +
  document.getElementById("visitor-name").value +
  "\n" +
  "Contact: " +
  document.getElementById("visitor-contact").value;

Encrypting a message is fairly simple and can be done by using an encrypt function from the OpenPGP library. You just need to pass a message and a processed public key as arguments to the function. To do that, create an async function, so you can call it using the encrypt button.

The encrypt button will also hide all unnecessary fields (email, name, encrypt message button) and assign the encrypted message as the value to the textarea, because the form will send any text that is included within the textarea. It also serves as a visual cue to the user that their message has been encrypted!

var encrypted = await openpgp.encrypt({
  message: await openpgp.createMessage({ text: combinedMessage }),
  encryptionKeys: publicKey,
});

document.getElementById("visitor-message").value = encrypted;
document.getElementById("submit-button").removeAttribute("hidden");
document.getElementById("encrypt-button").setAttribute("hidden", "");
document.getElementById("useless").setAttribute("hidden", "");

Below is the full function to encrypt a message.

async function encryptUserMessage() {
  const key = *PASTE YOUR PUBLIC KEY HERE*;
  const publicKey = await openpgp.readKey({ armoredKey: key });

  var combinedMessage =
    "Message: " +
    document.getElementById("visitor-message").value +
    "\n" +
    "Name: " +
    document.getElementById("visitor-name").value +
    "\n" +
    "Contact: " +
    document.getElementById("visitor-contact").value;

  var encrypted = await openpgp.encrypt({
    message: await openpgp.createMessage({ text: combinedMessage }),
    encryptionKeys: publicKey,
  });

  document.getElementById("visitor-message").value = encrypted;
  document.getElementById("submit-button").removeAttribute("hidden");
  document.getElementById("encrypt-button").setAttribute("hidden", "");
  document.getElementById("useless").setAttribute("hidden", "");
}

The code to submit the contact form should be self-explanatory.

const form = document.getElementById("e2ee-form");
const result = document.getElementById("form-result");

form.addEventListener("submit", function (e) {
  const formData = new FormData(form);
  e.preventDefault();
  var object = {};
  formData.forEach((value, key) => {
    object[key] = value;
  });
  var json = JSON.stringify(object);
  result.innerHTML = "Please wait...";

  fetch("https://api.form.form/submit", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Accept: "application/json",
    },
    body: json,
  })
    .then(async (response) => {
      let json = await response.json();
      if (response.status == 200) {
        result.innerHTML = "Congrats your message is recieved!";
        document.getElementById("visitor-message").setAttribute("hidden", "");
        document.getElementById("submit-button").setAttribute("hidden", "");
      } else {
        console.log(response);
        result.innerHTML = "Something went wrong!";
      }
    })
    .catch((error) => {
      console.log(error);
      result.innerHTML = "Something went wrong!";
    });
});

I hope this will serve as a cool programming project for your weekend. Stay subscribed.

Get an E2EE contact form

In the past, I had a section where people could easily get their own contact form. It turns out that the process wasn’t all that simple for many people. I’m now working on a better solution.

Towards a private digital life

Sat, 17 Jul 2021 00:00:00 +0530

You are being watched

Our innocent clicks and scrolls on the internet can have far-reaching consequences in the real world. Big internet companies have invested millions in building server farms to run AI bots that monitor and analyze your emails, phone records, texts, and everything else that they can get hold of. Believe me when I say that they know you better than you know yourself. This problem has already been discussed in one of my other posts Why is privacy important?

Choose the right hardware

For Laptops and desktops, I would recommend purchasing from System 76. They deliver with Open source POP OS (GNU/Linux), Intel management engine disabled and mostly everything here is open source.

For Mobile devices, buy an Android phone (more on that later) and strictly stay away from Apple devices. GNU/Linux phones are also an option if you have the money to try something new.

Choose the right operating system

Choose GNU/Linux. It was once tough to use, but if you install it today, you may find it to be really simple. Many applications, such as the Adobe suite and games, are still incompatible with GNU/Linux. However, if you are a typical user who mostly uses a web browser, you should be alright. If you can’t use as a daily driver because of a compatibility issues or other reasons. Try dual booting it with other operating systems, then using GNU/Linux for private work. Encrypting the drive while installing an OS is always a wise decision. You can evaluate distribution options on Distrochooser.

For Android phones, I recommend buying a Pixel phone (The Irony) and installing Graphene OS or Calyx OS on it. If you are already using android, try to find an open source ROM for your current phone on XDA Forums. The AOSP (Android open source project) and Lineage OS are compatible with many devices. See if these are available for your device. These OSes will come without any Google apps. If you can’t live without Google, consider installing MicroG rather than a GApps package (Google Apps). Download apps using F-droid

Network privacy

Still figuring out the best ways.

It is difficult to substitute a social network because all of your friends and relatives are probably wasting their time on Facebook, Instagram, WhatsApp, Twitter, Reddit, YouTube, etc. I suggest you to read my post on browsing social media without being tracked

Try using these alternatives to popular social media services.

Fediverse (Mastodon) > Twitter, Facebook, and Similar
pixelfed > Instagram
lemmy > Reddit
peertube > YouTube

If you still can’t live without the mainstream platforms, try using privacy frontends to limit their tracking. These frontends also allow you to follow channels and accounts using RSS feeds. Apps like Farside and UntrackMe can automatically redirect you to a working frontend when you click on a link.

Communicate privately

Brair
XMPP
Session
Signal
Threema
Jami (Not audited yet)
Wire
Many people recommend Telegram (but It’s not E2EE by default)
XMPP, E-mail or Matrix with E2EE.

Change your search engine

Everytime you search on google, it’s recorded and used for you, or … against you. Google provides many such free services that rely on collecting user data. Google has managed to sneak it’s trackers in millions of apps and websites to build user profiles. These profiles are used to show so called relevant search results and personalised ads. All of this may not be a problem if you search to find What does a cat look like? It’s not going to show you an picture of a dog. But, when you search for subjective topics (e.g. politics). Your profile may be used to show you information that you already believe in. For e.g. If Google determines you are a flat earth believer it will keep showing flat earth videos to keep you engaged on YouTube and earn from the ads. By the way, The earth is not f**king flat and google knows it too.

Here are some alternatives

Change your email provider

I know this one is hard as you are using your email address since years, but It’s important to switch to a better email provider. In the long run, your email may become more valuable than your phone number. Consider buying a custom domain to make switching email providers easy.

I usually check the following when using an email provider

Audited or at least open source clients and optionally servers
Zero access encryption for storage of contacts, calendars
Zero knowledge notifications
Support for PGP

These have worked well for me

You can buy multiple domains to seperate your email identities. Some domains, like 1.111B Class .xyz domains are just 99 cents per year. But, beware some email providers deduct points for a fully numeric domain.

Don’t forget to deploy an Email alias service in front of your new email account. This will protect you from unintentional spam, automatic tracking, and if some service’s database is leaked, your original email address or other aliases will remain unexposed to threats. All the recommended Email providers also offer aliasing services, but I prefer using a dedicated one.

Phone numbers

Purchasing a phone number without a valid ID is not possibe in many countries. Just search for how to get a burner phone in your counrty. I will add some providers after I test some.

Block ads, trackers and malware

Browser add-ons will stop trackers on websites.

Device level add-ons will stop trackers on websites as well as native apps.

Network level add-ons will stop trackers on any devices connected to your network. Laptops, Phones, Printers or even those stupid Fridges with useless apps.

More tips

I understand that abandoning a service or a device is difficult, but try to avoid companies whose operational patterns are similar to the following.

Facebook and acquisitions by Facebook. Includes Instagram and WhatsApp.
Alphabet.
Stay away from the Apple Ecosystem - Watch why Apple Is Terrible for Your Privacy.
Microsoft products.
Everything from Amazon retail to Amazon Web Services.

To put it simply,

Use FOSS (Free/Libre and open source software) and stay away from corporate ecosystems.

My browser has a new homepage

Sat, 05 Jun 2021 00:00:00 +0530

What’s MinDash?

MinDash is a personal, minimal dashboard that stores your bookmarks and allows you to search with multiple search engines. It can be deployed to the cloud or served from your device. It works across browsers and timezones.

Features

A clean and minimal look
Use the choice your search engine with every search
Dark and light themes adjusted to your OS preferences
Displays the current Date and Time (detects timezone from your browser)
Makes no inbound or outbound connections
No trackers, No other BS
Just static files, generated using jekyll
Modify the look and feel as you like
1. You need to understand jekyll for that
2. It will get easier when I add more features
3. Feel free to make a pull request though (repo is linked at the end)

Planned features

Password protected dashboard
Add notes sections (saved using local storage)
Edit and modify bookmarks (saved using local storage)
Import and Export settings
Ability to display web based news or articles (Like XML, Atom Feeds).

Open the dashboard on new tabs

On Chromium based browsers
On Firefox

Customize bookmarks

Navigate to _data —> bookmarks.yml
For each bookmark use the format below

- name: Anonaddy
  url: https://app.anonaddy.com

- name: Uptime Kuma
  url: https://github.com/louislam/uptime-kuma

Customize search engines

Navigate to _data —> search.yml
For each search engine use the format below

- name: Brave Search
  queryurl: https://search.brave.com/search?q=

- name: Too Much Info
  queryurl: https://toomuchinfo/search?q=

Get a dashboard for yourself

Get the latest code (A new version is WIP, stay tuned).
Edit the _data dir as you like it.
Build the site with jekyll.
Host the _site folder wherever you like. I recommend using Codeberg pages.
Feel free to make a pull request.

3 ways to implement dark mode on websites

Wed, 02 Jun 2021 00:00:00 +0530

Why add dark mode?

Adding a dark mode is a great way to make any website visually appealing while making it more accessible. This article will guide you to add a toggle switch for dark theme. Read till the end to avoid missing any important details. If I miss something relevant, please contact me.

Toggle dark mode using a button

Click the lightning bolt to try it out.

Hello, here's some text to demonstrate changing of styles using a toggle. Your preference will be saved in the browser's local storage as well. To test it, try refreshing the page.

To modify the colors of the text, background, and svg fill, we’ll use CSS variables.

.init {
  background: #ffffff !important;
  color: #000000 !important;
  --lightboltsvg: #fff348 !important;
  transition-duration: 0.5s;
}

body {
  background: #000000;
  color: #ffffff;
  padding: 3rem;
  border-radius: 0.25rem;
  --lightboltsvg: #505050;
  text-align: center;
  transition-duration: 0.5s;
}

In the html, make sure the element with the id #toggle-button is inside the element with the id #themebuttondiv.

<body id="themebuttondiv" class="themebuttondiv init">
  <div id="toggle-btn">
    <svg
      id="lightboltsvg"
      height="50"
      width="50"
      fill="var(--lightboltsvg)"
      viewBox="0 0 512 512"
    >
      <g>
        <g>
          <polygon
            points="426.667,213.333 288.36,213.333 333.706,0 148.817,0 85.333,298.667 227.556,298.667 227.556,512 		"
          />
        </g>
      </g>
    </svg>
  </div>
  <br><br>
Hello, here's some text to demonstrate changing of styles using a toggle.
Your preference will be saved in the browser's local storage as well.
To test it, try refreshing the page.
</body>

Coming to JavaScript, we’ll first define some constants in JavaScript.

const themetoggleexample = document.getElementById("toggle-btn");
themediv = document.getElementById("themebuttondiv");
const themetogglestore = localStorage.getItem("themetoggleexample");

To detect the preferred theme on each page load, we’ll use the browser’s local storage API to save an user’s preference locally. This will come in handy if an user navigates to another page.

A simple if statement will get the job done.

if (themetogglestore) {
  themediv.classList.remove("init");
}

The page will load initially with a light theme set by the init class. Whenver an user changes their theme, we need to check if the init class is present in the body tag. If it does, we’ll remove it and save the choice by storing a value in the local storage of the browser.

If an user decides to change the theme again, the if statement will render false but the else statement will restore the init class back to the body tag and delete the custom preference from the browser’s local storage.

themetoggleexample.onclick = () => {
  if (themediv.classList.contains("init")) {
    themediv.classList.remove("init");
    localStorage.setItem("themetoggleexample", "theme-dark");
  } else {
    themediv.classList.add("init");
    localStorage.removeItem("themetoggleexample");
  }
};

The complete javascript is quite easy to understand.

const themetoggleexample = document.getElementById("toggle-btn");
themediv = document.getElementById("themebuttondiv");
const themetogglestore = localStorage.getItem("themetoggleexample");

if (themetogglestore) {
  themediv.classList.remove("init");
}

themetoggleexample.onclick = () => {
  if (themediv.classList.contains("init")) {
    themediv.classList.remove("init");
    localStorage.setItem("themetoggleexample", "theme-dark");
  } else {
    themediv.classList.add("init");
    localStorage.removeItem("themetoggleexample");
  }
};

Adjust to the user’s preference

We’ll use simple CSS Media Queries to identify an user’s preference from the browser’s settings.

Hello, here's some text to demonstrate the use of CSS media queries. To see the style update, change your theme configuration using Dev tools (Crtl + Shift + I). No reload requried :)

The CSS is quite straightforward and does not require any JavaScript.

:root {
      background: white;
      color: black;
    }

    @media (prefers-color-scheme: dark) {
    :root {
      background: black;
      color: white;
    }
  }

Combining both approaches

To showcase the use of a combined approach, I’ll take the example of an user with JavaScript turned off.

We’ll utilize the noscript html tag to check if JavaScript is turned off and use CSS media queries to determine an user’s preference from the browser’s settings. Cool! isn’t it?

<noscript>
  <style>
    .init {
      background: #ffffff !important;
      color: #000000 !important;
      --lightboltsvg: #fff348 !important;
    }
    @media (prefers-color-scheme: dark) {
      .init {
        background: #000000 !important;
        color: #ffffff !important;
        --lightboltsvg: #505050 !important;
      }
    }
  </style>
</noscript>

Taking it further

We can geolocate an user or might use the user’s browser time to define a preference seamlessly and apply the theme. The JavaScript for detecting the time zone might look like…

var date = new Date();
var offset = date.getTimezoneOffset();
console.log(offset);

These approaches, however, may come with a number of drawbacks.

Certainly usable code

<body id="themebuttondiv" class="themebuttondiv init">
  <style>
    .init {
      background: #ffffff !important;
      color: #000000 !important;
      --lightboltsvg: #fff348 !important;
    }

    body {
      background: #000000;
      color: #ffffff;
      padding: 3rem;
      border-radius: 0.25rem;
      --lightboltsvg: #505050;
      text-align: center;
    }
  </style>

  <div id="toggle-btn">
    <svg
      id="lightboltsvg"
      height="50"
      width="50"
      fill="var(--lightboltsvg)"
      viewBox="0 0 512 512"
    >
      <g>
        <g>
          <polygon
            points="426.667,213.333 288.36,213.333 333.706,0 148.817,0 85.333,298.667 227.556,298.667 227.556,512"
          />
        </g>
      </g>
    </svg>
  </div>
  <br><br>
  Hello, here's some text to demonstrate changing of styles using a toggle. Your
  preference will be saved in the browser's local storage as well. To test it,
  try refreshing the page.
  <br><br><br>
  Also, try disabling script and change your theme preference through the
  browser to see the magic!

  <script>
    const themetoggleexample = document.getElementById("toggle-btn");
    themediv = document.getElementById("themebuttondiv");
    const themetogglestore = localStorage.getItem("themetoggleexample");

    if (themetogglestore) {
      themediv.classList.remove("init");
    }

    themetoggleexample.onclick = () => {
      if (themediv.classList.contains("init")) {
        themediv.classList.remove("init");
        localStorage.setItem("themetoggleexample", "theme-dark");
      } else {
        themediv.classList.add("init");
        localStorage.removeItem("themetoggleexample");
      }
    };
  </script>

  <noscript>
    <style>
      .init {
        background: #ffffff !important;
        color: #000000 !important;
        --lightboltsvg: #fff348 !important;
      }
      @media (prefers-color-scheme: dark) {
        .init {
          background: #000000 !important;
          color: #ffffff !important;
          --lightboltsvg: #505050 !important;
        }
      }
    </style></noscript
  >
</body>

Dark patterns are killing the internet

Thu, 27 May 2021 00:00:00 +0530

What are Dark Patterns?

Majority of websites on the internet exist to extract every last buck from your wallet. You will provide your valuable and personal information to get free eBooks, discount coupons, or something else. But, once you sign up or make a purchase, they will always keep you in the loop and make every effort to stop you from opting out!

Imagining some scenarios will help you appreciate my viewpoint.

Suppose you no longer wish to receive emails from a newsletter, you are searching for an unsubscribe link. Unfortunately, many newsletters disguise the link by changing its color to match the rest of the content. As a result, unsubscribing becomes more difficult.
Are you subscribed to amazon prime? If yes, let your prime membership expire, and Amazon will silently add it to your cart in the hopes that you are stupid and wealthy enough to buy it with your next order.
Even though the GDPR has set restrictions for cookie banners, even the most popular websites just display a “I accept” button and make it hard for the user to block the unnecessary cookies. Even if you try, websites like WIRED.COM are simply too stubborn to give user a choice to stop the tracking.

Wanna delete your Instagram account? You can look in the Account settings or the Privacy and security settings or any other settings, but it isn’t there. The only way to get rid of it is to go to their help centre and follow a lengthy process during which Instagram will manipulate you at every step to prioritize temporary suspension and stop you from deleting your account. Even if you manage to complete the deletion process, be ready for more manipulative emails with account recovery links.

Avoid using Dark Patterns

In most circumstances, using dark patterns will cause more harm than good, making the user’s experience worse. This could result in a never returning user or even worse, influence others to avoid your platform. These aspects are critical if your company is just getting started, but it doesn’t imply the major players are immortal. In 2015 Linkedin’s dishonest design cost it $13 million.

In case of newsletters, If an user cannot locate the link, they may mark the email as spam. As a result, your domain’s reputation will suffer. Now you can expect more of your communications to end up in the spam folder as a result of your bad reputation. So, what’s the point of having a large number of subscribers if they can’t read your emails?

Conclusion

These dark pattern examples should give you a decent notion of how important a design process is. Remember! It not just the visuals that count but the whole experience of an app or a website. So, it’s better to avoid incorporating dark patterns into your platform and instead improve the user’s experience. You can read more about dark patterns on www.deceptive.design.

Self-hosted web analytics

Tue, 04 May 2021 00:00:00 +0530

The “Free” analytics

Collecting more and more data to keep feed the advertising business model and make money while sacrificing user privacy has become a trend on the internet. Everytime you visit a website or open an app you can expect companies like Google, Facebook, Microsoft, Amazon, among others to track you using their analytics and they can track you because the developer of the website/app embed third party analytics as they are “free” and “advanced”.

These analytics are often advanced and promise conversions, sales, etc, they are also free because the users pay them with the user’s data. Every website/app developer wants to understand their website traffic. But when your source of income is the website (e.g. e-commerce), you want to understand user behavior, interests, and gather more data points to either retarget them later to boost conversions. But if you are a developer and use these privacy-invading analytics it can come at a great cost for you as well as the users of your website. You may want to read Why is privacy improtant?

Self-Hosted analytics

A self-hosted solution will give you complete control over your collected data and its storage. You can even self-host it on a raspberry pi and start collecting analytics right away.

There are other advantages of self-hosting an analytics solution, like bypassing AdBlockers. That sounds evil but as I don’t collect any personally identifiable data so it’s okay i guess :D

If you have are already using a third-party analytics solutions, they probably charge extra to serve the analytics from your custom domain. In case of a self-hosted instance, you can connect to multiple custom domains and subdomains at no cost.

Today we will host Ackee by electerious. It is a cookieless, non-invasive tracking solution that still providing useful insights.

Ackee has a great looking dashboard (Ackee dashoard demo) and the maintainer of this project also plans to support its development (correct me if I am wrong). If you want to support him, donate here.. So we can say it is a pay what you want to model (except for the hosting :p)

Let’s get started

My hosting stack will get you started for free (using Mongo DB, Netlify and Github) but you can also opt for other deploy options in the ackee documentation.

Requriments

Mongo DB account
Netlify account
Hosted Git account, like Github or Gitlab

Optionally

A custom domain

Setup a MongoDB database

Complete the sign up process at Mongo DB.
Create a free cluster
Choose your cluster hosting options. I am deploying an AWS cloud instance in Ireland.
Configure the connection details for the deployed cluster.
Choose the username and password for the atlasAdmin. Save these details as you will need them when connecting to the database from the Ackee instance.
Now allow access to the cluster from anywhere by adding the 0.0.0.0/0 IP address. The Serverless function will run at the closest possible server so allow access from anywhere is necessary. Don’t worry the username and password will prevent anyone else from accessing your instance.

Deploying Ackee frontend and serverless functions

This is the easiest step because you can deploy it to Netlify with a click of a button.

Deploy on Netlify
Set the Netlify Environment variables.

For the ACKEE_MONGODB variable use the following URI and Replace ADMIN_USERNAME & ADMIN_PASSWORD with the username and password that you created during the cluster setup. Also, replace FIRST_DATABASE with the name of your cluster. The default name is Cluster0.

mongodb+srv://ADMIN_USERNAME:ADMIN_PASSWORD@cluster0.mongodb.net/FIRST_DATABASE?retryWrites=true&w=majority

Set a new username and password for logging into the Ackee dashboard using ACKEE_USERNAME & ACKEE_PASSWORD variables.
Lastly, use the ACKEE_ALLOW_ORIGIN to accept traffic only from your domains.

Install a JS snippet on your website

You can either use Ackee from Netlify’s subdomain or add a custom domain in the netlify site settings. Avoid using subdomains like analytics or stats to stay away from Adblockers.
Log into Ackee dashboard, go the settings tab, add a website name and copy it’s tracking code.
The most privacy-respecting settings when installing the tracking script on your website can be set using data ops in the ackee tracker script.

In this example script, data-ackee-opts=’{“detailed”: false, “ignoreLocalhost”: true, “ignoreOwnVisits”: false} will ensure that any personal data is not collected and no cookies will be set because the ackee tracker will not ignore own visits.

<script async src="https://subdomain.domain.tld/tracker.js" data-ackee-server="https://subdomain.domain.tld" data-ackee-domain-id="DOMAIN_ID" data-ackee-opts='{"detailed": false, "ignoreLocalhost": true, "ignoreOwnVisits": false}'></script>

To start tracking, insert this script before the body tag of every page of your website. It is similar to installing any other analytics.

Some alternatives

We are Literally made of stardust

Sun, 25 Apr 2021 00:00:00 +0530

Spoiler alert

We are a way for the universe to know itself. Some part of our being knows this is where we came from. We long to return. And we can, because the cosmos is also within us. We’re made of star stuff ~ Carl Sagan

How can we be made of stardust?

About 13 billion to 14 billion years ago as our universe expanded and cooled to form protons, neutrons, and eventually atoms from subatomic particles, we had our first elements - Hydrogen and Helium. Today from various observations we know, earth and other solid objects are made of heavier elements but our sun and stars are made of Hydrogen and Helium during most of their lifetime, and heavier elements were formed at different stages during the life cycle of the star ;)

How do we know?

Firstly, we live on earth so we can study the composition of the earth but what about distant objects light-years away? How do we know what’s happening in the stars so far away from us? As Who Invented First quotes

The spectroscope, aided by a powerful telescope, provides a picture called a spectrogram or spectrograph, which spreads the light patterns out into a rainbow. Looking at the spectrograph gives scientists information on the position of emission and absorption bands – the “fingerprints” of atoms and molecules – causing the unique light spectrum coming from that particular object.

By studying the light (spectroscopy) from a distant star we can determine its composition and indirectly more characteristics as we collect more data.

Life cycle of a star

Stars are formed from vast nebulae, some spreading light-years across and mostly containing hydrogen, helium, and the remains of the previous star. Gravity slowly pulls the gas together to transform the cloud into a star. As the gas gets pulled in by gravity, the accumulated gas pulls in more and more material. There comes a point where the core gets hot enough to support nuclear fusion and the life of a star begins.

A star is powered by Nuclear Fusion at its core. Hydrogen is fused into Helium by a process known as nucleosynthesis. As it happens at the core of the star, it is termed as Stellar nucleosynthesis. This theory was initially proposed by Fred Hoyle in 1946, who later refined it in 1954.

Various categories of stars with different masses burn their hydrogen at different rates. Massive high mass stars generate high pressure and temperature at their core and burn up their fuel quickly only to live about 10 million years. While the tiny (are they?) low mass stars burn their hydrogen slowly to live 10 billion years or more.

All of this fusion generates an insane amount of energy because when two Hydrogen ions (two protons) combine at the core, a small part of their mass is converted into energy. If you are interested here is a link to a Wikipedia article on stellar nucleosynthesis. This generated energy keeps the star from collapsing due to its gravity.

The death of a star begins with its birth because a star will continuously fuse hydrogen into helium during a large portion of its lifetime. Eventually, the star runs out of hydrogen and its core will collapse more to become hot enough for helium to fuse into carbon and eventually oxygen. When this happens the outer layers of the star are blown away and a super dense hot core is left behind with the gas cloud around it. The core is a white dwarf and eventually cools to become a black dwarf. This is only the case for low mass stars.

A more massive high mass star has a much hotter core and can fuse Oxygen to Neon to Silicon and finally Iron. Why finally? Because Iron nuclei are very stable and cannot be fused further in a star, Till this point energy spreading outward and gravity pulling everything together were balanced. After the formation of iron, gravity wins over as Nuclear fusion stops and a star collapses to dies with a phenomenal supernova and turns into a neutron star or a black hole. During the collapse, even the Iron fuses into heavier elements like Radium, Zinc, Gold (Now we know why gold is rare), and others. 4.5 billion years ago our earth was formed during the birth of our solar system, literally from stardust ✨

Photo of a supernova by NASA

Now you know that the calcium in your teeth, the iron in your blood, the oxygen you breathe was synthesized in a dying star. Wow!

Smart home without a mess

Mon, 05 Apr 2021 00:00:00 +0530

Inspiration

My previous post on DIY Home automation with Node-Red was hosted in the cloud and didn’t work during public internet outages. So, I decided to use a local first, and private solution - Home Assistant.

Requirements

A SBC or any hardware that can run Home Assistant as its primary OS, in a virtual machine, or as a Docker container. I am using a Raspberry Pi 4B.
Edge IoT devices that can communicate via the MQTT protocol, like ESP8266, ESP32. I am using an ESP-01, compatible relay boards, and a compatible USB flasher
There are several ways to install Home assistant on a Raspberry Pi. I am installing it using Docker, so I have other self-hosted apps running alongside.

Network map of the setup

Advantages

Surface rewiring will work most of the time. No need to buy smart lights, fans, appliances.
Existing smart devices can be integrated into Home Assistant.
Low cost hardware with open source and free software makes a great combination for cheap but highly reliable solution.
Easily replaceable and up-gradable hardware.
Security issues about smart CCTVs not using end-to-end encryption or sometimes no encryption (unbelievable) were recently in the news. So all data is stored locally.
A large amount of data generated from smart home devices can be misused if a third-party server in some other country owns it. This solution respects your privacy by not sending your data anywhere. You own it.
Regular updates, security fixes for the software. Thanks to the Home Assistant community.
Devices communicate locally, but the dashboard can still be accessed remotely.

Install docker on Raspberry Pi

I am using the convenience script.

$ curl -fsSL https://get.docker.com -o get-docker.sh
$ sudo sh get-docker.sh

Pull and run the Home Assistant container

On Raspberry Pi 3

$ docker run --init -d \
  --name homeassistant \
  --restart=unless-stopped \
  -v /etc/localtime:/etc/localtime:ro \
  -v /PATH_TO_YOUR_CONFIG:/config \
  --network=host \
  homeassistant/raspberrypi3-homeassistant:stable

On Raspberry Pi 4

$ docker run --init -d \
  --name homeassistant \
  --restart=unless-stopped \
  -v /etc/localtime:/etc/localtime:ro \
  -v /PATH_TO_YOUR_CONFIG:/config \
  --network=host \
  homeassistant/raspberrypi4-homeassistant:stable

Tip: Use “docker ps -a” to see all your running containers and their status.

docker ps -a

Setting up the Home Assistant

After your Home Assistant container shows a healthy status, visit the IP Address of your Pi followed by port number 8123 (for e.g. mine is http://192.168.0.119:8123).

Tip: You can also visit http://raspberrypi.local:8123 (works most of the time).

Create a user account. This account is just used to log in to Home Assistant. It’s not an online account.

During the setup process, Home Assistant will automatically detect If you have printers, smart lights, cast devices, smart speakers, etc. Add them to your dashboard if you wish.

Setting up a MQTT broker

MQTT is one of the best open protocols used for home automation. Setting up a MQTT broker will allow us to control and check device status of all connected devices. MQTT allows two-way communication, message quality control and more.

I know about Matter, but I don’t like it for its proprietary nature. I recommend reading MQTT for dummies to get a basic understanding of the MQTT protocol.

I am installing the Eclipse Mosquitto MQTT broker (without docker).

   $ sudo apt update
   $ sudo apt install -y mosquitto mosquitto-clients

Set Mosquitto to auto-start on boot

   $ sudo systemctl enable mosquitto.service

Make Home Assistant talk to the MQTT broker

Navigate to Home Assistant dashboard -> Configuration -> Integrations.

Click on Add Integration -> search for “MQTT” and click on the MQTT integration.

Complete the setup by entering the IP Address of your MQTT client and it’s port. If you are following this tutorial, the IP Address will be 127.0.0.1 and the port will be 1883 (127.0.0.1:1883).

Setting up the Arduino IDE

Install the Arduino IDE.
Install the ESP8266 package using the Arduino Board manager.

Setting up the ESP-01

The following C++ program will allow the ESP-01 to connect to your Wi-Fi and communicate with the MQTT server hosted on your Home Assistant hardware. I have added useful tips as comments.

Tip: Alternatively, you can install Tasmota which has a lot of configuration options with it’s own easy to use web dashboard.

#include "EspMQTTClient.h"

EspMQTTClient client(
  "WiFi Name",
  "WiFi Password",
  "MQTT Broker server IP Address",      // IP Address of your Raspberry Pi
  "mqtt username",                      // (Leave blank)
  "mqtt password",                      // (Leave blank)
  "light",                               // Client name to identify your device
  1883                                  // The MQTT port, default is 1883.
);

void setup()
{
  Serial.begin(115200);
  pinMode(0, OUTPUT);
}

void onConnectionEstablished()
{
  client.subscribe("livingroom/light/com", [](const String & payload) {
    if (payload == "1") {digitalWrite(0, HIGH);
                          client.publish("livingroom/light/state", "1");
                         }
    if (payload == "0") {digitalWrite(0, LOW);
                           client.publish("livingroom/light/state", "0");
                          }
  });
}

void loop()
{
  client.loop();
}

Modify your ESP USB flasher to flash the ESP-01 with the code above.

Adding usable toggles to Home Assistant

As we are running our Home Assistant in a Docker container, we have to ssh into the Home Assistant container by using the following command and modify the configuration.yaml file.

   $ sudo docker exec –it homeassistant /bin/bash
   $ nano configuration.yaml  (If this command doesn't work, you will need to install nano using "apk install nano")

Example config:

light:
  - platform: mqtt
    name: "Living Room Lights"
    state_topic: "livingroom/lights/state"
    command_topic: "livingroom/lights/com"
    payload_on: "1"
    payload_off: "0"
  - platform: mqtt
    name: "Lounge Lights"
    state_topic: "lounge/lights/state"
    command_topic: "lounge/lights/com"
    payload_on: "1"
    payload_off: "0"

This is an example config and you can add more devices and categories if you like. Extended configuration options are explained in the Home Assistant Docs.

Tip: Notice how the Home Assistant publishes command to the “bathroom/lights/com” and the ESP-01 is subscribed to the same topic.

Extended configuration options are explained in the Home Assistant Docs.

Access your Home Assistant remotely

The most common way to access a device over the internet is to set up Port forwarding on your router, but I opt for a reverse proxy because I am behind a NAT and too lazy to get an SSL certificate.

Here are some good reverse proxy providers to choose from:

Nabu Casa - This method is recommended in the Home Assistant Docs.
PageKite - My choice. Always.

Setting up Pagekite for remote access is fairly simple and can be done completely from a command line. Just use the commands below.

   $ curl -O https://pagekite.net/pk/pagekite.py
   $ python2 pagekite.py 8123 SUBDOMAIN-THAT-YOU-WANT.pagekite.me

PageKite proxy client will start once you confirm your details with pagekite. You can visit SUBDOMAIN-THAT-YOU-WANT.pagekite.me and access your Home Assistant over the Internet. This URL can be used when you sign in with Mobile apps of Home Assistant.

Customize the Home Assistant dashboard

To demonstrate customization, I applied a custom theme using the configuration.yaml file.

# Example configuration.yaml entry
frontend:
  themes:
    happy:
      primary-color: white
      text-primary-color: black
      background-primary-color: #cefe8e

Tenet movie explained

Sat, 20 Mar 2021 00:00:00 +0530

It’s about time not the story

I won’t cover the story line by line as there are many articles out there. Let’s just focus on the concepts and details that will help us understand the movie TENET.

The concept of perceiving time

We as humans currently do not completely understand time but eagerly want to (I hope so 🙂). It is theorized that time moves in one direction —-> FORWARD —>

Can it be wrong? The answer maybe yes, because right now we are unable to figure it out.

TENET is trying to convince us that we are perceiving time as moving forward whereas it can move forward (Yes forward!) even if we are moving backwards relative to first case. Totally confusing?

Let me explain, FORWARD or BACKWARD is a relative term and depends on where in time you come from. Lets take a example in which we think of time as a road with two deadends namely A & B imagine two people named Pranav and Vanarp walking in the opposite directions, Pranav is going from A to B and Vanarp is going from B to A. Here Pranav sees himself walking forward on the road of time and same goes for Vanarp as he sees himself walking forward on the road of time, whereas they see each other walking in the opposite direction (BACKWARD!). You see, the nature of time is subjective.

As a human, imagining myself moving backwards in time makes me feel confused, as the world around me is reversed and my intuition will no longer be valid.

The movie seems, but is not, chaos

In the far future a scientist develops an Algorithm that can reverse an object’s entropy and thus the object can the move backwards in time from our perspective but from the object’s perspective it is still moving forward. The scientist then realizes that the algorithm is too dangerous and if misused can destroy our existence. So, she decides to split it and bury the pieces in the safest places of the past (Nuclear facilities).

The Protagonist is in search of the supplier of the inverted objects (Sator). Along the quest he meets Priya (A weapon dealer’s wife), she knows that Sator is getting those objects inverted from future humans.

Sator has control over his wife Kat using a art piece and now the Protagonist is trying to use this situation to get closer to Sator. In the movie Sator is not just an arms dealer but he is the one having contact with the future humans. Sator wants to assemble all the pieces of the Algorithm and bury them safely for the future humans to find it.

When the Protagonist meets Priya again, we get to know that the Plutonium 241 was actually one of the pieces of the Algorithm that Sator is trying to collect. To make the job easier Priya is planning to let Sator assemble the algorithm and then steal it.

On the yacht, Sator talks about the future; the oceans have risen and the rivers have dried up because of human actions. So, the future humans want Sator to assemble all the pieces of the algorithm and bury it safely. Many many years later, the future humans can then dig it up and reverse everything to erase the past. Now the whole plan to make Sator believe that the algorithm is buried safely and the future humans can use it.

The Grandfather paradox is driving the actions of the Protagonist. The paradox is well explained by Neil when he was traveling to Oslo.

The grandfather paradox is a paradox of time travel in which inconsistencies emerge through changing the past. The name comes from the paradox’s description: a person travels to the past and kills their own grandfather before the conception of their father or mother, which prevents the time traveller’s existence. Despite its title, the grandfather paradox does not exclusively regard the contradiction of killing one’s own grandfather to prevent one’s birth. Rather, the paradox regards any action that alters the past, since there is a contradiction whenever the past becomes different from the way it was.

He also says, the future humans believe that killing all the past won’t affect the future regardless of the what will really happen (Their belief is driving their actions).

Temporal pincer movement and the turnstile

In the armed forces a pincer movement is used to confuse the enemy by coordinating an attack from different directions. In a temporal pincer movement the temporal stands for time and there are only two possible directions for an attack using time (one forward and one backward as we can imagine). The turnstile is just a tool that helps us reverse our direction in time.

Throughout the movie we get to see two prominent pincer movements while the whole movie is also a third temporal pincer.

The first temporal movement is the exchange of so called Plutonium 241 between Sator and the Protagonist. Half of Sator’s team is moving forward in time and the other half are moving opposite to them. Sator is standing near the Turnstile and the team which moving forward in time is reporting each and every detail of the exchange to Sator. Once the exchange is complete Sator can use the turnstile and move back in time and use the knowledge that he gained from his first team to take part in the exchange. It is important to realize that reverse Sator can take part in the exchange but can’t manipulate it because the events will happen as it was and is supposed to happen because reverse Sator was going to participate in the exchange anyway (I know this one is a little counter intuitive). You get a clearer view if you watch the movie Predestination.

In the end we also see a temporal pincer movement carried out by the red and blue teams. The blue team gains knowledge of the events and then the red team plans accordingly.

Throughout the movie the Protagonist and Neil are in a third temporal pincer movement. Near the end of the movie, the Protagonist asks (to Neil) “Who recruited you?” and he replies “You (The Protagonist) recruited me and this is the end of a beautiful friendship”.

That means Neil was recruited by the future version of the Protagonist and the Protagonist is just half way in the Temporal Pincer movement of his whole life. At last the Protagonist stops Priya from killing Kat and now we know for sure that the whole TENET was planned by the future Protagonist and he sent Neil to help his past self.

No one can say for sure but Neil could be Kat’s son!

Digital privacy is important

Sun, 10 Jan 2021 00:00:00 +0530

Privacy x Security x Anonymity

Let’s understand the difference between privacy x security x anonymity before we explore why digital privacy is important, why it is non-existent on today’s internet, and what can we do about it.

Security determines how difficult it is for someone to penetrate a system, be it an app or a data center.

Privacy, on the other hand, about our right to keep our matters to ourselves.

Privacy x Society

We need feedback (data) from people to effectively run a civilized society. Traditionally this data was collected manually and people had the choice to understand what information they’re giving up in exchange for participation in society.

Today’s internet collects our personal data automatically and without our consent. Big tech companies can literally track every aspect of our life better than we can ourselves.

All of this data is used to keep us engaged on social media, sell us useless products & services, to influence our opinions, and even manipulate elections.

Your data is not your data

Big tech companies like Google and Facebook provide tools to website and app owners that let them measure traffic to their website and track us (users). But, website owners indirectly allow Google and Facebook to track us on all websites and apps which use their trackers.

Google maintained more than 70 percent of the total market share, in the web analytics market, according to statista.

Then there are an infinite number of free services like photo editors, audio clippers, file format converters, email providers, messaging apps, cloud storage providers who offer free services to users while earning money by collecting and selling our data. Smaller players can’t collect as much data as the big tech can, so the only option for them is to sell the collected data to data brokers and big tech companies, making big tech even more powerful.

In short, data about us is all over the internet and it can end up in the hands of marketers, governments, and F knows who else.

Privacy is power

Companies spend millions to showcase how secure their devices, apps, and services are, but it’s very rare for them to explain how private our data is when we use their service. Who will protect our data from the protector?

Moreover, governments keep saying that You have nothing to fear about if you have nothing to hide, which would have been true only if people didn’t discriminate other people based on their appearance, beliefs, opinions, choices, etc.

This is where our right to privacy protects us from the judgemental thoughts and actions of our society. So, let’s fight for our right to privacy, so we don’t have to keep fighting for a livelihood that every human deserves.

What can we do?

Spread the word!!! An aware consumer is the biggest enemy of evil corporations.

Participate in policy making. Ask the people running your state about why they allow our data to be collected without our consent?

Lastly, take a look at my Simple and effective guide to protect our Privacy Online.

Your are the reason for your sadness

Fri, 04 Dec 2020 00:00:00 +0530

What’s up with me?

You feel as if you want to give up on everything. You are unable to see a brighter future or appreciate what you already have. When you’re in a terrible mood, your brain shuts down, and you can’t ignore what others say about you, or you lose hope and believe you’ll never be able to achieve your goals. But that’s exactly when you should take a step back and recognize that perhaps the interpretation of yourself you’re condemning, is someone’s version of you. You’re attempting to acquire what others believe is appropriate for you!

You are the problem

You’ve created your life’s screenplay in your head. but you forgot to ask if it is even consistent with your core beliefs! The answer, most probably, is NO. You wrote the script, but it was crafted by the people around you. After all, the script doesn’t even matter, because life is not a movie! We are a flexible species, and the individuals we associate ourselves with, will shape our personalities. Your views and actions would be different if you were born in a different era or dealt with unusual people.

Just take a moment with your earphones and listen to this masterpiece by M83.

Listen on YouTube.

Lyrics

We didn’t need a story, we didn’t need a real world
We just had to keep walking
And we became the stories, we became the places
We were you before you even existed
We carry on, carry on
Hail!

You are the solution

To be truly satisfied, we must disregard the rules that others follow. Look around and explore all the possibilities that this life has given you.

Good Luck!

Node-Red can make your home smart

Thu, 19 Nov 2020 00:00:00 +0530

Update

This is an outdated solution. Take a look at my better approach.

Also, Heroku has decided to retire it’s free tier, so it’s not free (as in price) anymore.

Home, Office, Industrial Automation, and control using Node-Red, Heroku, MQTT, Raspberry Pi, other edge IoT devices (like esp8266, Arduino, etc.)

Advantages of using this solution

It is an open-source solution (So you are the one in control of the critical internal data, not a multi-national conglomerate).
The dashboard is available over the internet but password protected. For more security, we can use a free OpenVPN server (in the cloud or on our Raspberry Pi)
It’s free, so why NOT!!! (Except you need to pay for the hardware lol)
Your Node JS app will never sleep.

Features

Access the Control center from anywhere in the world.
Control will be transferred locally to the Raspberry Pi (ex - in case of internet failure)
Easily change automation rules or rewire controls with instant deployment.
Automation rules can get as complex as you like.
It is effortless to integrate third-party APIs like the OpenWeatherMap.
AND MUCH MORE TO EXPLORE.

Requirements

Hardware

Edge IoT devices (I am using esp-01 for demonstration)
Raspberry Pi for local control and override rules (Note: The Raspberry Pi control center can also be accessed remotely on demand)
Relay boards or Custom PCB boards
And other devices like CCTV’s (optional)

Other requirements

App platform to deploy the project (I am using Heroku)
MQTT provider. I am using Hive Public MQTT Brokers. Not recommended for final deployments

Initial setup and deployment

Fork the Node-Red Repo (This easiest way that I found while writing this post)
Recommended settings change for the Node app
In the forked repo edit settings.js as requried (located at yourgithubusername/node-red/packages/node_modules/node-red/)
Uncomment httpAdminRoot: ‘/admin’,
Uncomment and change ui: { path: “ui” }, —> ui: { path: “/” },
These edits ensure that the flow editor is available at eg.herokuapp.com/admin
Control (Dashboard) is available at appname.herokuapp.com
Don’t forget to secure your Node-Red deployment Official Guide
We can make our initial deployment to Heroku once the settings.js is updated.

Hinal setup

Deploy the app to Heroku using the git deployment method (choose the forked repo)
Once the app build is completed, you can access the node-red editor at the /admin path.
Gather information and learn to use Node-Red.
Next we will install the dashboard and core nodes.
Setup the MQTT connections in Node-Red and click deploy in Node-Red.
Your Control Center/Dashboard will be accessible at yourappname.herokuapp.com
Flash the hardware (in this case esp8266) with MQTTclient program.
Test the connection.
NOTE that the app is deployed internally in Heroku and will not persist across app failures or reboots. (Read helpful notes for a solution to this problem)

Helpful notes

Node-Red can be deployed to IBM Cloud with a few clicks but the app sleeps when using the free plan whereas In Heroku if we add a credit card we can run our app 24x7x365 without spending a single buck If you are not careful with your settings in Heroku your card will be charged
Helpful Info about the Heroku free plan
Very Imp when using Heroku After every Deploy (In Node-Red NOT IN HEROKU) Make sure that you export the current flow Official Guide. I will update this once I find a better and automatic method.
Always secure Node-Red Editor, Dashboard, and other static and node paths Official Guide
Setup Guide for Node-Red on Raspberry Pi
To make your app persistent across reboots or sleep times, export your node-red flow from the editor and update the flows.json file and the package.json file in the FORKED repo. In Heroku deploy the app again. I am still working on a better and automatic solution to this problem.
To prevent the Heroku app from sleeping, send an HTTP request to your app URL using a timestamp node with a 5-15 min interval and an HTTP node.

For any suggestions or queries feel free to send me a message. Now go DIY!

pranav chakkarwar

Single user WKD setup

Create a PGP key pair

Export the public key

Web server configuration

Testing the WKD setup

Nokia's deceptive designs to collect our data

Setting up a Nokia device

Dark patterns

Fuel for the upcoming fire

Nokia’s terms of User Experience Program.

Crisis proofing my communications

Looks of a Crisis

The need to Communicate Privately

Issues with Centralized Messaging Apps

Internet Censorship

Internet Shutdowns

Meet Briar

Safing my digial life

The story

Overview of my digital space

Eliminating points of trust

Choosing better points of trust

Distributing points of trust

Security

Going unbound

Encrypting emails without managing keys

Who should use this?

Password protected emails are somewhat useless

Making password protected emails useful

Ditch email

I browse social media without being tracked

Privacy vs Anonymity & Censorship

Define your approach

Opt-out of tracking

Use web apps with ads, and trackers blocker

Keep your account private

Hide your identity

Go accountless

Use site feeds

Protecting my emails

Email is messy

Emails almost always contain trackers

Your email address is on sale (Probably)

Email exposes a lot about you

Overall, email is very bad for privacy

Solutions summarized

Building a static site with Jekyll

Jekyll - A static site generator

Creating a fresh site with Jekyll

Jekyll’s directory structure

Crafting some pages

Build your website

Crafting a minimal, fast, but a feature-rich blog

Establish your identity with a blog

Be creative

Stick to a niche - or don’t

Buy a custom domain

Understand your tech

Loading speed matters

Monetize your blog - or don’t

Facebook is filtering thoughts, not photos

Social media is a tool to help the 1% stay in Power

Limiting the discussion to Facebook

Overlapping of public and private interests

Your data has been zucked

Promotion of harmful content keeps people engaged on Facebook

Facebook uses the main feed to keep you online

Polarization and isolation between communities

Facebook engagages in unethical censorship

#DeleteFacebook isn’t easy - but not impossible

Why is everyone pointing fingers at Mark?

Welcome to the Fediverse - where social media is owned by everyone

End-to-end encryption for HTML forms

Inspiration

Advantages of using end-to-end encryption

Building a basic contact form

Make the form look pretty

Using JavaScript to make magic

Get an E2EE contact form