A check list is pointless when there's 300+ items...
Really needs to be extremely short, like 10 items tops. Then when sublists for specific situations.
The Personal Security Checklist
21–30 of 116 posts
Re: The Personal Security Checklist
#22This doesn’t talk about real world adversaries, only hypothetical countermeasures. It would be more useful to know how I’m likely to be attacked, not how to protect against every threat the author could possibly think of. For example, I want to know where the villains actually go when they want to dox someone. Then I can dox myself and do something about it. I have no idea where to start and wouldn’t want to pay mone…
The real villains will have access via gov agencies to make emergency data requests to tech companies. Maltego can also be used to pivot on any info you already have to collect more. I'd say the best you can reasonably do is to use this to find your trails and remove them or worst case obfuscate it with noise.
> The real villains will have access via gov agencies to make emergency data requests to tech companies.
The real villains are those entities which are not you. Survival of the fittest.
Re: The Personal Security Checklist
#23Check out the beautiful start page by the same author: https://github.com/Lissy93/dashy
Re: The Personal Security Checklist
#24The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
You are missing the legal distinction forcing a password from someone is illegal because of the right to remain silent.
But detaining someone and scanning their face is 100% allowed.
Re: The Personal Security Checklist
#25The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…
I agree, it very much depends on who is targeting you. If it's the police on the street or at your home, say in russia or another third world country, then they can just lock you up or go as far as torture to get access. If they want to access your phone they will. But someone random on the internet trying to get your google photos? Completely different.
Re: The Personal Security Checklist
#26Earlier quoted context omitted.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…
If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.
Clicking the side button five times will do the same
Re: The Personal Security Checklist
#27Earlier quoted context omitted.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…
If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.
Pressing the power button five times in quick succession does the same - another handy trick.
Re: The Personal Security Checklist
#28Earlier quoted context omitted.
More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…
If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.
I always feel that this should be promoted more. Simple but effective in sticky situations…
Re: The Personal Security Checklist
#29I'm glad I saw this, it looks like an excellent resource. However, I can't help but feel a bit of despair while looking at it. There is so much stuff to do / know about, that it's incredibly far beyond what the average person could understand, let alone follow. Most people won't get close. I'm capable of doing everything described (and I follow a good chunk of it), but I have hundreds of accounts. The shear effort re…
It's better to start late than never. You probably have only a handful of high-value accounts. Emails, hosting, domain names, utility providers, social media.
Then you can focus on anyone who has your private data. E-shops and such that store your address. Realistically those can be pretty damaging if they get breached - even if your password doesn't leak in plain text, your name and address would be up for grabs.
But think about adopting the habit of gradually building up your discipline and addressing old issues as you revisit old accounts.
Re: The Personal Security Checklist
#30This list should define the priority levels they're using.
I think it goes: Basic, Recommended, Optional, Advanced (in increasing effort|security|paranoia).