The Personal Security Checklist
github.com
The Personal Security Checklist
1–10 of 116 posts
Re: The Personal Security Checklist
#2The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes.
Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
Re: The Personal Security Checklist
#3I'm glad I saw this, it looks like an excellent resource.
However, I can't help but feel a bit of despair while looking at it. There is so much stuff to do / know about, that it's incredibly far beyond what the average person could understand, let alone follow. Most people won't get close.
I'm capable of doing everything described (and I follow a good chunk of it), but I have hundreds of accounts. The shear effort required to thoroughly roll out these protections for just myself (let alone my less-technical-than-myself-technical-family) across a such a large digital surface area make it seem an insurmountable task.
Maybe I need is a service that can automatically audit my networks / devices / accounts and give me security health scores, give me 1-click paths to enable protections, or even auto-fix security gaps. But that sounds like dropping an enterprise security blanket on my digital life, and any system capable of taking care of this for me is another single point of failure whose compromise would be catastrophic. Convenience and security must be inversely correlated.
Re: The Personal Security Checklist
#4The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource).
That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police.
Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and culture in your particular environment (I guess ranging from "extremely unlikely" to "almost certain" depending on where you are).
Edit: I don't mean to disagree with your overall point that understanding the threat landscape and threat model is very important, just to say that there is a very simple and plausible threat to which the precaution you used as an example can be relevant.
Re: The Personal Security Checklist
#5The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
Definitely agree with you, there's no need to waste resources on protecting against threats that would never target you - like attempting to capture your face from CCTV and spending real money and resources to get a mask and then stealing your device... etc like you noted.
The author does have face unlock listed as "Advanced" priority. The wording is a bit weird but I take it to mean, only someone who has "very advanced" security concerns would need to follow that recommendation.
If I were going to recommend this to a friend/family member I would just tell them to stick to the basic priority items and not worry about the higher pieces.
Re: The Personal Security Checklist
#6The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…
Definitely a good threat I hadn't considered. I imagine from someone who is less educated about technology in general, having a list of "example threats" that those items might protect against would be beneficial to help offer some more incentive to follow this list other than just "Good Security".
Re: The Personal Security Checklist
#7The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
>Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
I feel like this point misses the first point you made, about things being a lot more circumstantial and nuanced. It all depends on what you have to hide and on what device. Someone may need to go to the level of effort you mentioned to access someone's iPhone, while someone else may need to just print out a mugshot and hold it in front of a laptop webcam to unlock their computer.
Edit: I'll also second schoen's point about someone forcefully holding your own face up to the device.
Re: The Personal Security Checklist
#8With respect to password managers, it doesn't mention Apple's iCloud Keychain. Any reason why?
Re: The Personal Security Checklist
#9I would love a list like this which is geared towards more advanced users (and software developers who deal with a lot of sensitive data) and describes threat models more comprehensively.
Re: The Personal Security Checklist
#10I think this is just for information security, right?
It doesn't cover personal physical safety. Things like: pay attention to your surroundings, lock your doors, etc.