Browsing securely

Most of your team’s work passes through a browser: email, shared documents, banking, social media. It’s also where fake login pages and harmful sites reach people (Phishing). This guide covers the settings that make any browser safer and what a VPN and Tor Browser can and can’t do for you. It ends with how to bring your team along.

What others can see when you browse

• Your IP address: every connection to the internet has an IP address, a number that identifies it. Every site you visit sees it, and it can show roughly where you are (EFF).
• What trackers collect: trackers are small pieces of code and files (cookies) that advertising and data companies place on websites. They follow you from site to site, building up a picture of who you are, where you are and what you read (Security in a Box).
• What your internet provider sees: the company that connects you, and whoever runs the network you’re on, such as a hotel or café, can see which sites you visit (EFF).

HTTPS limits what they see. It’s the secure way for a browser to talk to a website: it encrypts what travels between them, so people on the same network can’t read what you type or which pages you open on that site (Security in a Box). They can still see which sites you visit, and when (EFF). A web address that starts with https:// is using it.

Set up the browser

1. Use a browser built with privacy in mind. Security in a Box recommends Firefox, which is free and open source. Chrome and Chromium are secure too, but Chrome may send more about you to Google, so don’t sign in to your Google account in it (Security in a Box). On phones, Firefox Focus is a light browser with privacy settings already on. You can also keep two browsers, one for everyday browsing and one for sensitive work.
2. Keep it updated, and type important addresses yourself. If you search for a site instead of typing its full address, some of the results may be harmful (Security in a Box).
3. Turn on HTTPS-only mode and tracking protection. Both are in the browser’s settings; in Chrome, HTTPS-only mode is called “Always use secure connections”. Strict tracking protection can break some sites, so you can switch it off for a site you trust (Security in a Box).
4. Stop the browser saving your passwords. Remove the ones it has saved and keep them in a password manager instead. Passwords saved in a browser are easier to trick out of it, and anyone using the device can see them (Security in a Box).
5. Check which sites can use your camera, microphone and location. Only sites you use and trust should have them (Security in a Box).
6. Switch off the built-in AI assistant for sensitive work. Gemini in Chrome can be allowed to see the tab you have open, and Google keeps your Gemini activity unless you stop it. Firefox lets you block all its AI features with one switch (Security in a Box).

Extensions: a few, chosen with care

A tracker blocker such as uBlock Origin (uBlock Origin Lite in Chrome) or Privacy Badger blocks adverts and trackers, some of which carry harmful code (Security in a Box).

Beyond that, keep extensions to a minimum. An extension can see what you do in the browser, and some are harmful in themselves. Install only the ones you need, from the official add-on store, and remove any you don’t use or recognise (Security in a Box).

Private browsing, and its limits

Private browsing (Incognito in Chrome) doesn’t keep your history or cookies, which helps on a shared computer. It doesn’t hide you from the network, though: your IP address stays the same, and it won’t protect you from harmful software on the computer (Security in a Box). If others use your device, clear your browsing history too.

VPNs

A VPN (virtual private network) sends your internet traffic through an encrypted connection to a server run by the VPN company. Sites then see the server’s IP address instead of yours (EFF).

What a VPN does: it hides your IP address from the sites you visit and hides which sites you visit from your internet provider and the local network. It also gets you round many blocks on sites and apps (Security in a Box). Secure messaging covers what else to prepare for when the internet is cut.

What it doesn’t do:

• It moves your trust rather than removing it. The VPN company can see what your internet provider used to see (Security in a Box; EFF).
• It doesn’t make you anonymous. For that, use Tor Browser (EFF).
• It isn’t always the answer. HTTPS-only mode already stops people on your network reading what you type into sites, and tracking protection with a tracker blocker deals with advertisers’ tracking (Security in a Box).
• It doesn’t hide that you’re using one. Your internet provider can tell, and in some countries VPNs are illegal, so check first (Access Now; Security in a Box).

Choosing a VPN

Security in a Box’s list of tools names three to start from, each with a free version: Proton VPN, TunnelBear and Riseup VPN, which is made for activists. Whichever you look at, ask these questions (Security in a Box; EFF):

• Who runs it, and how does it pay its way? A free VPN has to make money somehow, and some sell their users’ data.
• Does it keep records of what you do? Check its privacy policy, and whether it has handed over users’ data before.
• Has an independent audit checked it, including its servers, and published the results?
• Where is it based, and would it hand your data to the authorities in your country?
• Does it use a modern protocol such as WireGuard or OpenVPN, and a kill switch that cuts your connection if the VPN drops?
• Does it work for people in your situation? Ask others near you who use it.

Being in an official app store doesn’t make a VPN safe (EFF). Install two before you need them, from their official store or website, and test them while the internet still works (Security in a Box; Access Now). Never install VPN files passed round in group chats: they’re a common way to spread harmful software (SIIRF).

Tor Browser

Tor Browser is a free version of Firefox that sends your browsing through at least three relays run by volunteers around the world. The sites you visit can’t see where you are, and anyone watching your connection can’t see which sites you visit (Security in a Box). It also gets round some blocks. When you need to stay anonymous, not just hide your location, it’s a better choice than a VPN, because no single relay can see your browsing (EFF).

It works on Windows, Mac, Linux and Android; on an iPhone, the Guardian Project’s Onion Browser uses the same network (Security in a Box). Expect browsing to feel different (Security in a Box). Don’t add extensions to it, since they can give away who you are (Security in a Box).

Tor is blocked or illegal in some countries, and using it can make your connection look suspicious to anyone watching, so check first (Security in a Box). Where it’s blocked, bridges (Tor relays that aren’t publicly listed) can help (Security in a Box).

Bringing your team with you

1. Set up your own browser first. Then you know where each setting is.
2. Run a short setup session. Everyone works on their own browsers: HTTPS-only mode, tracking protection, a tracker blocker, saved passwords moved to the password manager and AI features off for sensitive work.
3. Agree one VPN for the team. Use the questions above and install it on everyone’s devices before any trip or likely block. Keep a second one installed in case the first stops working (Security in a Box; SIIRF).
4. Help one to one where it takes longer. Moving saved passwords out of a browser can take a while, and colleagues who need Tor Browser may want help setting it up.
5. Keep a chat open for questions. Use it to warn each other about fake VPN files doing the rounds, too.
6. Build it into joining and leaving. Set up a new colleague’s browser in their first week. If you pay for a VPN, remove people from the account when they leave.
7. Check every three months. Look at whether browsers are up to date, extensions are the ones you agreed and the VPN still connects (Checklists and audits).

If it’s already happened

If someone typed a password into a fake site or installed something a site pushed on them, go to Clicked a bad link.

Teach it to your team

Try this at a team meeting. It takes about 25 minutes.

• Prepare: ask everyone to bring the laptop or phone they use most, and install the team’s VPN on yours.
• Exercise: each person opens their browser’s settings and finds three things: HTTPS-only mode, tracking protection and saved passwords. Then show the room a site that displays your IP address, turn the VPN on and reload it.
• Three questions: What can the VPN company see? When would you use Tor Browser instead of a VPN? Why install a VPN before you need it?
• Afterwards: help one to one with anyone moving passwords out of their browser, and answer questions in the team chat.