~/captain-dumbass®
Digital Rights & Surveillance

Locking Down Your Devices and Your Network: The Privacy Setup, Part Two

Captain Clippee, avatar of Dennis Ayotte
Dennis Ayotte // The Captain Dumbass® · 8 min read ·
#privacy#security#self-hosting#networking#how-to

In part one I covered identity: credit freezes, passwords, hardware keys, virtual cards and the small hardware I carry. This part is about the devices themselves and the network they sit on. Same idea as before. Take back as much control as you reasonably can, one layer at a time.

Some of this leans into physical security, which is really its own topic, so I am keeping it high level here. On the network side I will share the approach and the reasoning but not my own layout or screenshots, for reasons that should be obvious.

A note on the products here: I bought every item in this post with my own money and I actually own and use each one. Nothing is sponsored, and none of the links are affiliate links. These are my recommendations based on my own use and experience. I do not recommend anything I have not used myself, and if that ever changes I will say so.

Start with a clean install you control

What I do: On my laptop, a System76 Pangolin Pro 16”, the first thing I did was wipe it and put on my own Linux so I knew it was a clean install with nothing I did not put there. Kubuntu is my daily driver, and I also like Fedora with KDE Plasma. I am also building my own Linux from scratch, which I write about in the Fathom-OS series.

Why: An operating system you did not install is an operating system you have to trust blindly. A clean install of a distro you chose strips out the factory image, the preloaded extras and the telemetry that ships turned on. On Linux you can see what is running and turn off what you do not want.

Benefit: You start from a known state. Nothing is phoning home unless you decided it should. If you want to go all the way, building from source (Linux from scratch) means every piece is there because you put it there.

Cover your cameras

What I do: Every camera I own has a physical cover, and it stays closed unless the camera is in use. My laptop has a built-in privacy slider. When I use a USB webcam on my Linux desktop I pick one with a shutter, like this one. My phone lives in a privacy case with a door over the rear cameras, either a case like this or a cover kit. For front phone cameras, my iPad and any laptop without a built-in slider (my Dell XPS 13 Developer Edition, for example) I use thin camera dots.

Why: Software controls can be bypassed by malware or a bad app permission. A piece of plastic over the lens cannot. It is the one camera control that does not depend on trusting the software.

Benefit: Certainty. A covered camera sees nothing, no matter what is running on the device.

Use a throwaway phone number

What I do: When something wants a phone number, I hand out a Google Voice number instead of my real one. It is free. Yes, it ties to my name, it is Google after all, but it keeps my actual carrier number off the form.

Why: Your real mobile number is a strong identifier. It gets tied to your identity across services, sold between data brokers and it is the weak point in a SIM swap attack. The fewer places that have the real one, the smaller that target gets.

Benefit: You can give a number out freely, and if it gets spammed or leaked it is not the number tied to your bank and your SIM.

Pick a carrier that is not the default

What I do: My carrier is Mint Mobile rather than one of the big three. It runs about 60% less than I was paying before and works fine for me.

Why: This one is as much about cost as privacy, but the point stands. You do not have to default to the largest carrier. A smaller provider that meets your needs is a choice, and choosing is the whole theme here.

Own your network

This is the deep end, and it is where I keep the specifics to myself. What I can share is the shape of it and why each piece matters. You do not need my exact setup to apply the same ideas at whatever scale fits your home.

Segment everything. I run multiple VLANs so different classes of device live on separate networks that cannot freely talk to each other. Your laptop does not need to reach your doorbell, and your doorbell definitely does not need to reach your laptop. IoT gadgets, guests, servers and trusted machines each get their own lane.

Default deny at the firewall. The rule set starts from “block everything” and only opens what is actually needed, rather than allowing everything and trying to block the bad parts. Combined with blackhole routes for known-bad destinations, most junk never leaves the house.

Filter DNS. A Pi-hole with a healthy set of block lists stops a large share of ads and trackers across every device on the network before they ever load, including on gadgets that have no ad blocker of their own.

Self-host what you can. A Proxmox environment lets me run my own services instead of renting someone else’s cloud. If my data lives on my hardware, it is not sitting in a vendor database waiting to be breached or mined. The homelab series walks through this from the ground up, starting with why build a homelab.

Add detection and geo-blocking. Intrusion detection watches for the traffic that should not be there, and geo-blocking drops connections from regions I have no reason to talk to. Neither is perfect on its own, but together they cut the noise way down.

Cut the smart devices off. My smart TV is blocked from the internet entirely, since a TV does not need to phone home to show me the input I plugged into it. My PlayStation is blocked at the network level too, and IoT devices sit on their own locked-down VLAN. For why a TV is worth blocking, see LG Is Turning TVs and Monitors Into Surveillance Devices.

If you want starting points that are approachable rather than overwhelming, Pi-hole across your whole network and locking down a Linux box with UFW are two good first steps.

Turn off the surveillance in your car

What I do: On my car I disable as much of the in-car data collection as I am allowed to, the “connected services” features in particular. It gets harder every model year, and on some newer cars you cannot fully opt out.

Why: Modern cars collect and ship driving and personal data to brokers and insurers. I went into the detail on that here: Your Car Is Selling How You Drive to Your Insurance Company.

Benefit: Every feature you can switch off is one less stream of data leaving the car with your name on it.

Cut the cloud

What I do: I do not use Google or Apple cloud accounts for my files or photos. Those live on my own hardware, self-hosted. I keep an email account, but it is for junk mail when a throwaway alias will not do, not for anything that matters. I do have Office 365, only because my contract work requires it, and it stays inside a locked-down VM. I do not touch it on my Linux laptop. For everything else I use LibreOffice and open source tools.

Why: When your files and photos live in a big cloud, you are trusting that company not to scan them, not to lose them and not to lock you out. Self-hosting puts that back in your hands. For photos specifically, Immich is a self-hosted stand-in for Google Photos. For email, why you should ditch Gmail covers the reasoning.

Benefit: Your data is on hardware you own, running software you can inspect. The only account that can lock you out of it is your own.

Put it together

None of this is about paranoia. It is about defaults. Most devices, networks and services ship set up to collect as much as they can, because that is what benefits the company, not you. Changing those defaults, one at a time, is how you take the control back.

Start small. Cover a camera. Point one device at a Pi-hole. Wipe one machine and install a clean OS. The point, same as part one, is layers. You do not have to do all of it at once, and you do not have to do all of it perfectly.

The tools I mention

Bought with my own money, owned and used by me. No sponsorships, no affiliate links.

// comments

← all posts more in Digital Rights & Surveillance →