Earlier quoted context omitted.
Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.
What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.
Basic Security Precautions for Non-Profits and Journalists
111–120 of 182 posts
Re: Basic Security Precautions for Non-Profits and Journalists
#112Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the pe…
> Use your fingerprint to lock/unlock devices. Fingerprints have a different and weaker legal standard than passwords to protect them > Use an Android phone. It may be possible to get a secure Android phone, however, it is unlikely that the one you have is. Varying levels of quality for disk crypto and TPM key storage will do you in. > Take the devices you work on across the US border Any data or passwords you have o…
Nothing on the article's website suggests an affiliation or particular interest with security issues. This kind of patronising tone directed at people asking for help is the single most unpleasant part of the IT security industry.
Re: Basic Security Precautions for Non-Profits and Journalists
#113Earlier quoted context omitted.
Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.
An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.
Re: Basic Security Precautions for Non-Profits and Journalists
#114Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the pe…
> I have not heard of any major security incident recently with Firefox. https://blog.mozilla.org/security/2016/11/30/fixing-an-svg-a... https://blog.mozilla.org/security/2015/08/06/firefox-exploit...
I don't mean anything against tptacek personally, but without any substantial grounding this is as good as believing Keith Alexander/Michael Rogers/Vladimir Putin/Osama bin Laden/coin toss. In fact, coin toss might be the most secure of all, as I surely know it doesn't try to fool me on purpose.
Re: Basic Security Precautions for Non-Profits and Journalists
#115Earlier quoted context omitted.
Very few of the items in here have justifications listed, because that's not productive for the intended audience. They don't want to know "why" any more than most patients want to know "why" their doctor prescribes one antibiotic versus another.
Even if your intended audience doesn't care about the why, you must necessarily provide justification so that another audience, which would want to make sure that you're not selling snake oil, could verify your why. Knowledge sharing only really works when there's a vetting process on some level.
Much of the audience that has the expertise to effectively verify the wisdom of the advice in such a document will have already encountered the views it contains and will be familiar with the reasoning behind those views already. None of the guidance in the article is likely to be something they're hearing for the first time. Even if they disagree with something in the article in whole or in part, they already know why the people who compiled the article likely believe it.
It is good for there to be more detailed explanations for interested non-experts, and there have been a number of more detailed explanations of many of these items elsewhere on the internet. But for most people it's more important to know that, for example, a recent iPhone is their best choice for a secure phone than it is to know the details of why experts on the topic have come to that conclusion, just like it's more important for most people to take a flu vaccine each year than it is for them to understand the process by which that vaccines was formulated.
Re: Basic Security Precautions for Non-Profits and Journalists
#116Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine , but not workable for the audience these instructions are intended for. We're si…
Re: Basic Security Precautions for Non-Profits and Journalists
#117Earlier quoted context omitted.
Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.
An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.
Re: Basic Security Precautions for Non-Profits and Journalists
#118Earlier quoted context omitted.
Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.
What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.
Disclaimer: I work at Google.
Re: Basic Security Precautions for Non-Profits and Journalists
#119Earlier quoted context omitted.
What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.
Disabling Verified Boot and not having Google Play Services would dramatically reduce the security posture of an Android device. Disclaimer: I work at Google.
source: im another google engineer
Re: Basic Security Precautions for Non-Profits and Journalists
#120Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine , but not workable for the audience these instructions are intended for. We're si…
If you can't use your phone number for password recovery or SMS to your phone number as the 2FA, what do you use instead?