Live data from Hacker News

Basic Security Precautions for Non-Profits and Journalists

techsolidarity.org

111–120 of 182 posts

Re: Basic Security Precautions for Non-Profits and Journalists

#111

Earlier quoted context omitted.

Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.

What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.

Probably as long as it was patched for security updates but tbpfh, trusting a random stranger on the internet for security advice is likely unwise.

Re: Basic Security Precautions for Non-Profits and Journalists

#112
post #25

Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the pe…

> Use your fingerprint to lock/unlock devices. Fingerprints have a different and weaker legal standard than passwords to protect them > Use an Android phone. It may be possible to get a secure Android phone, however, it is unlikely that the one you have is. Varying levels of quality for disk crypto and TPM key storage will do you in. > Take the devices you work on across the US border Any data or passwords you have o…

> You have not been paying attention. Maybe consider accepting the advice of experts?

Nothing on the article's website suggests an affiliation or particular interest with security issues. This kind of patronising tone directed at people asking for help is the single most unpleasant part of the IT security industry.

Re: Basic Security Precautions for Non-Profits and Journalists

#113
post #88

Earlier quoted context omitted.

Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.

An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.

Is Edge + the new Windows Application Guard similar in protection?

Re: Basic Security Precautions for Non-Profits and Journalists

#114
post #39

Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the pe…

> I have not heard of any major security incident recently with Firefox. https://blog.mozilla.org/security/2016/11/30/fixing-an-svg-a... https://blog.mozilla.org/security/2015/08/06/firefox-exploit...

What can I subscribe to, to hear about news like that in a more systematic fashion? I mean, monitoring all CVEs might be a little to much for somebody who isn't full time security professional, but there surely must be some reasonable compromise between that and position like "this browser is secure because tptacek said so".

I don't mean anything against tptacek personally, but without any substantial grounding this is as good as believing Keith Alexander/Michael Rogers/Vladimir Putin/Osama bin Laden/coin toss. In fact, coin toss might be the most secure of all, as I surely know it doesn't try to fool me on purpose.

Re: Basic Security Precautions for Non-Profits and Journalists

#115
post #12

Earlier quoted context omitted.

Very few of the items in here have justifications listed, because that's not productive for the intended audience. They don't want to know "why" any more than most patients want to know "why" their doctor prescribes one antibiotic versus another.

Even if your intended audience doesn't care about the why, you must necessarily provide justification so that another audience, which would want to make sure that you're not selling snake oil, could verify your why. Knowledge sharing only really works when there's a vetting process on some level.

> you must necessarily provide justification so that another audience, which would want to make sure that you're not selling snake oil, could verify your why

Much of the audience that has the expertise to effectively verify the wisdom of the advice in such a document will have already encountered the views it contains and will be familiar with the reasoning behind those views already. None of the guidance in the article is likely to be something they're hearing for the first time. Even if they disagree with something in the article in whole or in part, they already know why the people who compiled the article likely believe it.

It is good for there to be more detailed explanations for interested non-experts, and there have been a number of more detailed explanations of many of these items elsewhere on the internet. But for most people it's more important to know that, for example, a recent iPhone is their best choice for a secure phone than it is to know the details of why experts on the topic have come to that conclusion, just like it's more important for most people to take a flu vaccine each year than it is for them to understand the process by which that vaccines was formulated.

Re: Basic Security Precautions for Non-Profits and Journalists

#116
post #10

Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine , but not workable for the audience these instructions are intended for. We're si…

It is time for journalism schools (of all sorts) to teach this stuff. Nobody should call themselves a journalist (or a lawyer) if they cannot communicate securely, if they cannot at least put up a good fight against the watchers.

Re: Basic Security Precautions for Non-Profits and Journalists

#117
post #88

Earlier quoted context omitted.

Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.

An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.

Agreed for the most part. There is Servo[0] which is Mozilla's playground for a Rust Browser. It's not really usable for day-to-day browsing, but it's a neat proof of concept. They are actively moving stuff from it into FF, and FF now requires rust to build. Google definitely cares a lot about security. It's great to see them embrace U2F so heavily, that even Chrome supports it out of the box. I'm not sure FF will ever become Rust-only, but if it did, it would take quite a while I think.

[0] https://servo.org/

Re: Basic Security Precautions for Non-Profits and Journalists

#118

Earlier quoted context omitted.

Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.

What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.

Disabling Verified Boot and not having Google Play Services would dramatically reduce the security posture of an Android device.

Disclaimer: I work at Google.

Re: Basic Security Precautions for Non-Profits and Journalists

#119
post #118

Earlier quoted context omitted.

What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.

Disabling Verified Boot and not having Google Play Services would dramatically reduce the security posture of an Android device. Disclaimer: I work at Google.

you can keep verified boot on custom roms. play services expose you to googles nsa'd taps we'll hear about in 5y.

source: im another google engineer

Re: Basic Security Precautions for Non-Profits and Journalists

#120
post #89
post #10

Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine , but not workable for the audience these instructions are intended for. We're si…

If you can't use your phone number for password recovery or SMS to your phone number as the 2FA, what do you use instead?

you don't lose your 2fa. thats it. all other options are unsafe
Post reply on HN