Most important? SSH, WireGuard, HTTP proxy. (Services I need accessible to me without a VPN.) Email, authoritative DNS, web server. (Services I need accessible to anyone on the Net.) Mumble, various game servers. (Services I need accessible to my friends.)
Before using VPSes, I hosted from my home IP directly. This has serious privacy downsides: from your IP address, it’s mostly trivial to find out who you are (e.g., by seeing your IP has port 443 open and checking the domain names of your TLS certificates), and from your domain name, it’s trivial to find out where you live (by way of the ISP whose IP address your domain points to). Using a VPN for general browsing helps with the first point but not the second. There’s also the threat of DDOS (if your server gets attacked you lose access to the Internet entirely, and then you’re really in trouble). Also, residential ISPs are rare and people who need a static IP (or even a non‐CGNAT IP) are not reliably catered to; VPS companies have plenty of competition and having a publicly accessible IP address is the default.
Once I started running VPSes, I ran many services directly on the VPS. Over the years, I’ve migrated everything to physical hardware in my house (or a secure offsite location), for privacy and performance reasons. I can add as much storage and RAM as I want. Incoming connections are port‐forwarded over WireGuard to my LAN, so the VPS provider can only gather metadata from encrypted connections. Unfortunately the game servers mostly don’t support TLS; I’d prefer to hide them behind a VPN, but that would be too difficult for the players.
I actually use three VPSes, each in a different datacenter. VPS downtime (that’s not caused by me) is pretty rare, but happens periodically, and is almost entirely due to maintenance being performed in the datacenter. Email and DNS both support redundancy.
My VPSes are from different providers, too. One time an OS bug caused high CPU usage for an extended time, and the provider nearly terminated my account on suspicion of crypto mining. If a particular company ever drops me or goes out of business, I can just change a few DNS records and firewall rules and be back in business.
The vast majority of my downtime has been from power outages at home and the residential ISP going down (it's crazy how often that happens, I had no idea until I started measuring it). So I got a second residential ISP. If one route goes down, the VPSes port forward over the other, or over a third route to my offsite LAN.
Each service runs in a separate VM. Some might consider that overkill, but I like how simple it is to move VMs between hosts. Services run as unprivileged non‐root users with no ability to initiate outgoing connections.
Services for which I’m the only user stay entirely within the LAN. I do have extrnal access to the LAN, three ways: WireGuard, SSH, and HTTP proxy. The proxy is a last resort, but it’s been a lifesaver when I was stuck for a week at a conference whose wifi blocked SSH and WireGuard (in fact, everything but HTTPS and DNS).
Tor is great at reducing tracking done by ad companies. I use Facebook and Reddit (a big chunk of my social media activity) exclusively over Tor.
Step 1, block all Facebook and Reddit domains and subdomains at the DNS level. This is not to prevent visiting the cleartext websites (I could just, you know, not visit them), it’s to block the Like buttons and Reddit share icons embedded in normal websites from tracking my browsing activity.
Step 2, bookmark the Reddit and Facebook onion sites in Tor Browser.
These are faster and more secure than visiting reddit.com and facebook.com in Tor Browser (hidden services require fewer hops and have no exit node), and since they’re official means of accessing their respective sites, you’re less likely to get treated as a bot or banned for suspicious activity.
How well does this work? Pretty well, if the ads I get are any indication. Facebook and Reddit ads used to be highly correlated to my general browsing activity. When I first started doing this, I would still log in without Tor occasionally, and instantly ads would start matching my browsing activity again. Now that I’ve used these sites exclusively over Tor for years, the ads are either entirely random or based solely on my activity within the respective sites (which is exactly what I want), or they expose a privacy leak from something other than IP address or cookies (for example, it’s clear from the ads I get that my bank sells my credit card purchase history to Facebook, which has made me more open to using cash).
As long as Tor Browser isn’t illegal or dangerous to possess in your jurisdiction, I highly recommend downloading it and using it for mainstream sites that provide onion services. I wish more sites would provide them!
Once you’ve had the PIN scramble turned on for a while, it becomes second nature. I enter my GrapheneOS scrambled PIN about as quickly as the unscrambled PIN on my non‐GrapheneOS work phone. But it’s more of a defense against figuring out my PIN from the finger marks on my screen.
In environments where shoulder surfing is a concern, I prefer to use the multiple profiles feature: log out of my main profile (which is actually a secondary profile) to completely evict its keys from memory, and switch to a burner secondary profile containing no personal data, which unlocks with my fingerprint for convenience.
Second nature or not, I’m not sure how this protects you against the security camera watching you enter the passcode. I guess you’re hoping it can’t read the digit on each key?
How does one “demand better” from a handful of giant corporations? Did you personally negotiate that plan with your phone operator?
Besides that, neither tethering (for reasons other than cost, mentioned above) nor international roaming (increased latency) are a perfect replacement for fast local Wi-Fi at this point.
Cell signal is terrible for privacy, uniquely identifying each individual’s location at all times. Though Wifi can also be tracked, it at least is possible to use anonymously with MAC randomization as is the default on many phones. (Leaving aside countries like Switzerland which outlaw wifi without mandatory registration.)
I browse social media sites like Facebook and Reddit using their onion services. I was sick of seeing ads pop up that were clearly based on tracking my general browsing activity through IP correlation, tracking pixels and embedded “like” buttons. So now I block all cleartext Facebook/Reddit traffic completely.
Using Tor this way doesn’t anonymize me—on Facebook at least, I’m logged in under my own account—but it limits the profile Meta builds on me to the union of what it directly observes on Facebook and what it can purchase through data brokers. Ever since I started doing this, I’ve noticed a huge drop in relevance in my Facebook ads, so apparently it’s working. When the ads become suddenly relevant again (which has happened a few times), it exposes an information leak: usually a credit card purchase that Meta must have obtained from either my bank or the shop vendor and tied to my identity.
Using a VPN could theoretically provide the same benefit, but in practice Facebook tended to temporarily lock my account when using a VPN and Reddit blocks VPN traffic completely. So I stick to the onion services, which are run by the websites themselves and so are less likely to be treated as malicious traffic.
If you use these platforms, I recommend bookmarking their onion sites in Tor Browser and using it as your primary interface to them for a while. Then, if you don’t find it too inconvenient, start blocking the non‐onion versions of the sites on your network.
(P.S.: You shouldn’t trust the links I just posted; I could have posted fake ones! I recommend double‐checking against https://github.com/alecmuffett/real-world-onion-sites which links to proofs of onion site ownership under their usual domain names.)
For games, the equivalent level of ownership comes from DRM‐free digital purchases. That means buying games from platforms like GOG, Itch, and Zoom Platform, and then backing them up. Steam is distantly behind in terms of user ownership—their installers are always DRM‐locked, but some games can be run DRM‐free after that—and Xbox, PlayStation and Nintendo aren’t even on the same planet due to their hideous DRM and online service tie‐ins.
Before using VPSes, I hosted from my home IP directly. This has serious privacy downsides: from your IP address, it’s mostly trivial to find out who you are (e.g., by seeing your IP has port 443 open and checking the domain names of your TLS certificates), and from your domain name, it’s trivial to find out where you live (by way of the ISP whose IP address your domain points to). Using a VPN for general browsing helps with the first point but not the second. There’s also the threat of DDOS (if your server gets attacked you lose access to the Internet entirely, and then you’re really in trouble). Also, residential ISPs are rare and people who need a static IP (or even a non‐CGNAT IP) are not reliably catered to; VPS companies have plenty of competition and having a publicly accessible IP address is the default.
Once I started running VPSes, I ran many services directly on the VPS. Over the years, I’ve migrated everything to physical hardware in my house (or a secure offsite location), for privacy and performance reasons. I can add as much storage and RAM as I want. Incoming connections are port‐forwarded over WireGuard to my LAN, so the VPS provider can only gather metadata from encrypted connections. Unfortunately the game servers mostly don’t support TLS; I’d prefer to hide them behind a VPN, but that would be too difficult for the players.
I actually use three VPSes, each in a different datacenter. VPS downtime (that’s not caused by me) is pretty rare, but happens periodically, and is almost entirely due to maintenance being performed in the datacenter. Email and DNS both support redundancy.
My VPSes are from different providers, too. One time an OS bug caused high CPU usage for an extended time, and the provider nearly terminated my account on suspicion of crypto mining. If a particular company ever drops me or goes out of business, I can just change a few DNS records and firewall rules and be back in business.
The vast majority of my downtime has been from power outages at home and the residential ISP going down (it's crazy how often that happens, I had no idea until I started measuring it). So I got a second residential ISP. If one route goes down, the VPSes port forward over the other, or over a third route to my offsite LAN.
Each service runs in a separate VM. Some might consider that overkill, but I like how simple it is to move VMs between hosts. Services run as unprivileged non‐root users with no ability to initiate outgoing connections.
Services for which I’m the only user stay entirely within the LAN. I do have extrnal access to the LAN, three ways: WireGuard, SSH, and HTTP proxy. The proxy is a last resort, but it’s been a lifesaver when I was stuck for a week at a conference whose wifi blocked SSH and WireGuard (in fact, everything but HTTPS and DNS).