Don’t forget the best place to whistleblow and/or change the system is from within. Privacy minded people can better influence what policies and practices happen at a company when they work there.

uBlock is a content filter. Cookies are set when a server responds to a web (http/https) request. So if uBlock has a domain blocked, not only are any cookies blocked, but no requests make it to that domain (whatever.com) at all.

If a domain is not blocked by uBlock Origin’s filters, then cookies are set per your browser’s configuration. Firefox I believe blocks some 3rd party tracking cookies by default, but can be configured to block all third-party cookies as well, but this may break site functionality like single sign-on.

It’s already trivial to see that you’re connecting. You’re not making anything at all more difficult for state level actors, just yourself.

There’s no point in hiding the transaction. A state level actor will see that you’re connecting to the Mullvad VPN addresses and won’t need to check your credit card statement to determine that you’re using it.

Ah, didn’t realize pfSense is the OS, not something that runs on linux. My command examples won’t work for you.

So my first question is how can it be that my little mini J1900 Celeron (2 GHz) with 4 GB RAM cannot handle this bandwith?

• check ethtool for link speed: sudo ethtool enp2s0 | egrep 'Speed|Duplex' Your device name may be different from enp2s0. use ip link to see all devices. if it’s not

Speed: 1000Mb/s
Duplex: Full

then that’s probably a bad sign.

• that is a 10 year old celeron processor. celeron were the budget (a.k.a. cheapest, slowest) class processor at the time. it’s quite likely that it cannot keep up.
• If you still think it’s not CPU directly, use iotop to see if you have I/O bottleneck.

dmesg | less should allow you to scroll the output. You should use forward slash in less to search for the devices (hit enter), see if the modules are being loaded or if there some errors.

check lsmod before and after see what kernel modules are changing.

also look at dmesg for interesting kernel messages as you attempt to use / not use the offending hardware.

tcpdump, wireshark can capture packets. haproxy can be a proxy of many networking protocols mitmproxy can help see encrypted traffic by acting as a literal man in the middle. ssh with certain parameters can become a SOCKS5 proxy to encrypt and tunnel traffic out of a hostile network