41–50 of 70 posts
Isn't 2FA considered dangerous now? We've seen how susceptible it can be to social engineering. On a related note, I noticed that my Windows Phone displays text message notifications even when it's locked... So adding a PIN doesn't prevent an attacker from doing 2FA if they have access to my phone.
2FA with, say, a hardware token or even a phone app is generally pretty good.
Signal is atrocious for security. You literally log in with your phone number. Anything you send is directly and irrevocably tied with your physical identity. What good is to me that the messages are encrypted? When the police come knocking, either I'll decrypt them, they'll beat me until I decrypt them, or I'll die in prison for not decrypting them. I do want my messages encrypted, but more than that I really want t…
You're describing a very different use case than what I use Signal for (discussing things that could be harmful for clients if it got out, not things where I'd want repudiation).
I think my use case is relatively well solved, but I'd be super curious to see how algorithms could be changed to solve yours.
Signal is atrocious for security. You literally log in with your phone number. Anything you send is directly and irrevocably tied with your physical identity. What good is to me that the messages are encrypted? When the police come knocking, either I'll decrypt them, they'll beat me until I decrypt them, or I'll die in prison for not decrypting them. I do want my messages encrypted, but more than that I really want t…
Too bad meta-data and social graphs will screw you over anyways. Unless you don't use the device for interacting with people you know, in which case, what's the point?
The article is very slightly more nuanced but the conceptss the title purports is DANGEROUSLY INCOMPETENT for any security expert / discussion / context. 1) idea that security is something you check off and be done with is dangerously wrong. Security must be continuous, must be updated, reviewed, etc. 2) idea that you can "encrypt" [secure] your entire life is ludacris and leads to many dangerous security misconcepti…
I tried using Signal but the problem is no one else wants to. So yeah I'd love e2e encryption but it requires both parties to use it, which is a problem.
I am not 100% sold on one particular password manager. Any hints/suggestions?
I like Keepass becuase it is not tied to any ongoing subscriptions or providers. You can use the file sync tool of your choice to distribute your file. The downside/feature is not having tight browser/app integration.
If you're being specifically targeted by a sufficiently capable adversary, this is, at best, a speed bump. Categorize your levels of paranoia appropriately.
I really wonder if intelligence services are paid to demoralize user groups when I see posts like this. If you do all these things, your resistance to even NSA-level incriminating evidence goes WAY down, and your vulnerability to local LEO and hackers goes to near-zero. This is, at best, a brick wall, through which an adversary would have to bulldoze.
Bluntly, if you want to tangle with the pros playing like an amateur and not calculating the risks, you're going to be demoralized in your jail cell or worse.
Understand, in depth, opsec before playing with the pros. Understand, understand, understand. Don't just grab random blog posts and mindless implement them. Understand specific details of what you're giving up and the tradeoffs.
Activists have been doing amateur hour opsec for forty years and most of have been cracked like a crab constantly. Pay attention to history, folks!
There's no such thing as privacy when using proprietary software.
If the goal is to secure your privacy, there no need to argue beyond that.
> In a single sitting, you can make great strides toward securing your privacy. There's no such thing as privacy when using proprietary software. If the goal is to secure your privacy, there no need to argue beyond that.
Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones.
(Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities)
EDIT: On second thought, don't you have to sign apps with a private key? I assume that raises the bar a bit, as long as the devs can keep those keys private which seems reasonable enough for such an app.