If you are really worried somebody could spy on your digital data,
shut down your computer, unplug the power, sharpen your axe and smash it...
I'm sorry, but that's the only possible way to full 100% digital privacy and data security. It's not really usable in these days any more though, so let's not spend too many words on it.
After destroying your naive illusions of total security and protection, let's become serious.
Here are a few things (this list does not attempt to be complete!) you can do to improve your data security and raise your protection against specific attacking scenarios, but none of them will lead to universal security.
However, although the basic security tips should always be followed by every user, I don't recommend to blindly follow every advanced security advice here or anywhere else on the web. Instead, thoroughly reflect each method's advantages and downsides and only do what you think is useful for your situation.
Please note that when I'm talking about malware etc. in general, this does not only include destructive malware which wants to delete your data etc., but also programs that can spy on you and steal your data.
Basic security tips
You should always install all available updates to fix possible security vulnerabilities in your applications or the system as soon as possible. Fortunately this is very easy with automatic updates which are enabled by default on Ubuntu. See How do I enable automatic updates?
- Install software only from trusted sources
Ubuntu uses repositories to provide you all available software packages and updates. The four official Ubuntu repositories
multiverse as well as the
partner repository can be considered very safe with regards to malware. Applications you find in your Software Center are only from those sources by default.
However, Ubuntu is open and you can add unofficial third party repositories or PPAs (personal package archives on https://launchpad.net) to your list of software sources. Those are not tested and should be used with care. Commonly used PPAs can also normally be assumed safe though.
You can also download single
.deb packages or source code archives you have to compile yourself from any arbitrary website. Those are usually not tested in any way by Canonical or reviewed by the community and must be used extremely carefully. You should avoid them wherever possible.
- Do not just copy-paste and run commands from the web
I mean, of course you can and will do this, especially here on the site you get told to run this or that command all the time. However, you should invest a few minutes to read the command you encountered and understand what it does. The
man command to show manpages of commands is your friend here, make heavy use of it.
A common example are the various "jokes" (not funny though) that advise you to run
rm -rf / or variants of that. If you type this command correctly (I left out some stuff), it deletes every single file on your computer. Such accidents can be prevented if you know what the command you are going to run is supposed to do.
To sum up, use your common sense. You would not jump out of the window if some stranger told you to do so, right? Run commands advised on the web with the same care.
Advanced security tips
- Use a simple firewall at least
Ubuntu offers you a very simple firewall,
ufw, which you can just install and forget. It will run automatically and its default configuration is usually good enough for home users. YOu should not mess with it unless you understand what you do. It has a graphical frontend (
gufw) which can make configuring it a bit easier for you though.
- Perform malware scans on a regular base
This point may be debated, some say that there are no Linux viruses, others say you need antivirus software. Let's say there is few malware that could attack Linux systems directly and some which are platform independent. The question whether you should have an antivirus scanner installed is heavily discussed here: Do I need to have 'antivirus software' installed?
However, there is another kind of malware called rootkits which does very well exist for Linux. They can be hard to detect and remove though. More information might be found e.g. at How do I remove rootkits? and Best rootkit removal tool for a server?.
Of course you should scan data passing through your Linux computer for Windows threats if you have Windows machines in your network though that might receive the data.
If you care about security (inaccessibility) of your data in case someone gets physical access to your machine, you should use full disk encryption or at least encrypt your home directory and the swap space.
But please note that any kind of disk encryption only protects data on turned off computers from attackers with physical access. While your computer is running, the encrypted disks are mounted and the key is stored in memory. That means every program that can access your computer can also access all data on the encrypted (but unlocked) disks. I wrote more about this in my answer about securing computers against hackers with physical access, you can find the link at the bottom (or here).
What you could do instead would be to separate sensitive data from the rest of your system and use many small encrypted containers to store them. That way you can always unlock only those containers you need for your current work and lock them again as soon as you're finished. This way you minimize the time during which the sensitive data is accessible.
Most data companies and agencies can obtain about you will not be obtained by hacking your computer though, but by looking at your online identity and by tracking your browsing behaviour.
The rule of thumb not to post any content publicly online (e.g. in social networks) with which you would not be comfortable if someone wrote it above your front door always applies, of course.
But also seemingly private channels like unencrypted emails or Skype chats can be read along by at least the companies responsible for delivering them. You should not use them for really private data.
You can also get tracked while simply browsing the web, e.g. if you use Google, Facebook etc. to log into multiple sites, a profile of your behaviour on all linked sites can be made easily. Avoid this and better log in with email and password separately for each service. You use different passwords (and ideally different emails, eventually throwaway addresses) for each site, of course.
Another technique to recognize you as unique visitor to the same site even if you visit it at different times are cookies. They are not evil by themselves, they are just small text snippets stored in your browser that may be accessed by the site who wrote them. It can be used by sites to store your preferences, your login status, or a unique ID that helps to recognize and identify you. Many services require cookies to work, so I would not entirely disable them but set your browser up to delete them (with a few exceptions for sites you trust and for which it is useful) whenever you close the browser window.
To even hide your real IP (which can be used to identify you as real person with the help of your Internet Service Provider), there are two common ways, browse through a VPN (few free offers, but often you need to pay unless you are okay with very restricted bandwidth and data volume - and you must ultimately trust the company to protect your traffic and identity) or TOR (free and secure, but slow).
There are tons more advices how you can leave less traces on the web, but if you have read this far, I'm already really proud of your stamina and don't want to bother you much longer. Research the topics that caught your interest on the web or leave a comment to ask about a particular clarification.
You may also want to view my answers to these security questions:
- How to secure my laptop so that hacking by physical access is not possible?
- Is Linux getting less or more secure?