Ask HN: Online Security Tips for Newbie Freedom Activists?

Post by quanticle » Mon, Jan 30, 2017, 3:30 AM UTC

throwaway122916 wrote: post #108

tptacek wrote: post #15

These answers are unlikely to make much of HN happy, but they are the correct answers. 1. Get an iPhone and use it in preference to your computer. 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP"). 3. Disable SMS 2FA on any account wherever you're using real 2FA. 4. Switch to Google Chrome, which is significantly more resilient against vulnerabilit…

This is a crazy list. 1. IPhone is closed source and any kind of rootkit can be installed by Apple/NSA secret court system. I suggest not using a smartphone if you are serious about security. 2. Good but difficult to anonymize 3. Good 4. Google Chrome is a botnet effectively and users lose their expectation of privacy there. Should switch to Firefox and use Chromium (Not Chrome) as a backup. Ideally Tor browser thoug…

    IPhone is closed source and any kind of rootkit can be installed by 
    Apple/NSA secret court system. I suggest not using a smartphone if you are 
    serious about security.

Post by guitarbill » Mon, Jan 30, 2017, 3:37 AM UTC

quanticle wrote: post #111

throwaway122916 wrote: post #108

Earlier quoted context omitted.

This is a crazy list. 1. IPhone is closed source and any kind of rootkit can be installed by Apple/NSA secret court system. I suggest not using a smartphone if you are serious about security. 2. Good but difficult to anonymize 3. Good 4. Google Chrome is a botnet effectively and users lose their expectation of privacy there. Should switch to Firefox and use Chromium (Not Chrome) as a backup. Ideally Tor browser thoug…

IPhone is closed source and any kind of rootkit can be installed by Apple/NSA secret court system. I suggest not using a smartphone if you are serious about security. I absolutely disagree. While you are correct that in theory an iPhone can have rootkits and other backdoors installed on it by the NSA, in practice, I've found that the average user's computer can be compromised far more easily than their smartphone. Re…

Post by sockopen » Mon, Jan 30, 2017, 3:54 AM UTC

snowwrestler wrote: post #109

tptacek wrote: post #15

These answers are unlikely to make much of HN happy, but they are the correct answers. 1. Get an iPhone and use it in preference to your computer. 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP"). 3. Disable SMS 2FA on any account wherever you're using real 2FA. 4. Switch to Google Chrome, which is significantly more resilient against vulnerabilit…

What is a better solution for remote file sharing, since email and Dropbox are out?

Post by bigiain » Mon, Jan 30, 2017, 4:37 AM UTC

Buge wrote: post #83

danso wrote: post #8

I like these guides by AP journalist Jonathan Stray: https://source.opennews.org/en-US/learning/security-journali... https://source.opennews.org/en-US/learning/security-journali... In general, I think the two things that activists and journalists need to do that they often don't do, yet is a very common attack vector: 1. Enable two-factor auth on all accounts, especially their email. 2. Care about proper access contr…

If you are worried about phishing (you should be) don't use SMS or code-based two-factor. They can and are being phished. Use U2F (yubikeys). They are phishing proof.

Post by jaredklewis » Mon, Jan 30, 2017, 5:03 AM UTC

quanticle wrote: post #112

charlietran wrote: post #71

Earlier quoted context omitted.

Thank you so much for this list, it's more concise and useful than any corporate security lecture I've ever received! Some questions: > 10. Install a password management application that doesn't store your secrets in the cloud. Great recommendation, but how do you handle syncing passwords between your computer and phone? > 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email…

Great recommendation, but how do you handle syncing passwords between your computer and phone? I use KeePass to encrypt my passwords and store the password vault in Dropbox. It's not a perfect system, in that an adversary can gain access to my password vault and try to brute-force my master password. But it's "safe enough", if you make sure to use a strong passphrase as the master password for the vault.