Ask HN: Online Security Tips for Newbie Freedom Activists?

Post by Esau » Mon, Jan 30, 2017, 1:09 AM UTC

PascLeRasc wrote: post #80

tptacek wrote: post #15

These answers are unlikely to make much of HN happy, but they are the correct answers. 1. Get an iPhone and use it in preference to your computer. 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP"). 3. Disable SMS 2FA on any account wherever you're using real 2FA. 4. Switch to Google Chrome, which is significantly more resilient against vulnerabilit…

This might be naive, but would you recommend being on iOS Beta to get security patches earlier? Also do you prefer Touch ID or password/passcode unlocking?

Post by Esau » Mon, Jan 30, 2017, 1:13 AM UTC

tptacek wrote: post #46

karyon wrote: post #43

Earlier quoted context omitted.

notes/questions: 4. a citation why chrome would be "safer" than firefox (or edge) would be appreciated. in terms of privacy, i wouldn't trust chrome as much as i'd trust firefox. 7 and 10: as others have noted, where is the security risk in storing the encrypted vault in the cloud? actually, choosing user-friendly solutions has a security benefit in itself because it doesn't make you switch to less secure alternative…

I think it's reasonable to trust Firefox's privacy more than Chrome's. But there are very few people in the industry who trust it's security more than Chrome's. Chrome has a more secure architecture and one of the best security teams assembled for any consumer product. The iOS and Chrome recommendations are the things I'm saying that I believe to be somewhat unpopular here. But in the software security community, the…

Post by [deleted] » Mon, Jan 30, 2017, 1:25 AM UTC

Esau wrote: post #82

PascLeRasc wrote: post #80

Earlier quoted context omitted.

This might be naive, but would you recommend being on iOS Beta to get security patches earlier? Also do you prefer Touch ID or password/passcode unlocking?

Personally, I would avoid Touch ID. In my opinion, a good security feature should work even when you are asleep or unconscious.

Post by secfirstmd » Mon, Jan 30, 2017, 1:33 AM UTC

tptacek wrote: post #15

These answers are unlikely to make much of HN happy, but they are the correct answers. 1. Get an iPhone and use it in preference to your computer. 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP"). 3. Disable SMS 2FA on any account wherever you're using real 2FA. 4. Switch to Google Chrome, which is significantly more resilient against vulnerabilit…

Post by tokenadult » Mon, Jan 30, 2017, 1:37 AM UTC

Mz wrote: post #68

tokenadult wrote: post #66

Thank you very much to all for the detailed comments. I appreciate you keeping advice simple enough for someone like me, who decades ago counted as a "power user" of PCs, but who has no particular technical training or computer-related work experience. I will have to digest some of this advice for women (they are mostly women in the local group) who are barely comfortable using Facebook. And I'll pass on other tips t…

Since you have a lot of women, I will suggest that you explicitly instruct them to be careful about talking about other people in their lives in identifiable terms. Men tend to invest their identity in their work. Women tend to invest their identity in their relationships. Telling anecdotes about "My sister/boss/mother/daughter/son/husband" is potentially putting those people at risk. Encourage them to use vaguer ter…