Check out the beautiful start page by the same author: https://github.com/Lissy93/dashy
Just set this up yesterday for my selfhosted services, it's a pleasure to use!
The Personal Security Checklist
31–40 of 116 posts
Re: The Personal Security Checklist
#32A check list is pointless when there's 300+ items... Really needs to be extremely short, like 10 items tops. Then when sublists for specific situations.
This list is specific and parochial of course. Rudimentary thematic
analysis of the list reveals common patterns fairly well known to
security people:
- Less is more.
- Convenience works for you, and adversaries.
- If it's old, maintain it.
- Never tell the truth.
- Keep moving.
- Don't underestimate the enemy.
- Have a plan B.
In the literature these have fancy names like Dolev-Yeo, Minimal attack surface etc. Interestingly they also correspond to the five-S principles {shape, shine, speed, spacing, silhouette) of stealth and camouflage and many foundations of guerilla craft - maximal mobility, carrying minimal gear, least contact and taciturn communication, knowing the environment, maintaining you equipment.
Re: The Personal Security Checklist
#33> You could store [2fa backup codes] in your password manager
Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager.
I do recommend a password manager, but not to keep would-be-two factors in one vault.
Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one for simplification reasons (reality: passphrases are equally secure if you use enough random words, just like using a password with enough random characters), but I've now read the recommendation for 3 points and 2 are bad and mediocre advice.
Re: The Personal Security Checklist
#34A check list is pointless when there's 300+ items... Really needs to be extremely short, like 10 items tops. Then when sublists for specific situations.
This list is specific and parochial of course. Rudimentary thematic analysis of the list reveals common patterns fairly well known to security people: - Less is more. - Convenience works for you, and adversaries. - If it's old, maintain it. - Never tell the truth. - Keep moving. - Don't underestimate the enemy. - Have a plan B. In the literature these have fancy names like Dolev-Yeo, Minimal attack surface etc. Inter…
Great list! Could you expand on the items a bit?
Re: The Personal Security Checklist
#35> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…
> statement about dictionary words being really crackable
Every time I see this statement I immediately think: which dictionary? There are more languages than usual suspects (eg English, Spanish, French, Italian, German, Mandarin) and L1/L2 speakers of those make up sizable portion of internet users. Are Welsh/Hungarian/Slovak dictionary words really as easily crackable than English ones? If you have dictionary for those, yes, otherwise I suspect no.
Re: The Personal Security Checklist
#36> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…
> statement about dictionary words being really crackable Every time I see this statement I immediately think: which dictionary? There are more languages than usual suspects (eg English, Spanish, French, Italian, German, Mandarin) and L1/L2 speakers of those make up sizable portion of internet users. Are Welsh/Hungarian/Slovak dictionary words really as easily crackable than English ones? If you have dictionary for t…
So, yes.
Re: The Personal Security Checklist
#37If you haven't seen it, Brian Lovin also has a fantastic, in-depth security checklist on his website that links to many more valuable resources: https://brianlovin.com/security
It's aimed more at "the minimum any person should do", so isn't as wide-ranging as the OP and a bit more practical to share with family & friends who might not be as technical.
Re: The Personal Security Checklist
#38There's an obvious tradeoff having an authenticator (2FA/OTP) separate from your secure password manager. If you lose the device with credentials, you're screwed. It's really easy to lose access to a device (and usually without advance notice).
Or you can override the 2FA, and then you're back to hoping the verification procedure of overriding 2FA is stronger than a dedicated attacker. A password manager managing 10 OTP accounts means 10 attempts at social engineering to bypass the OTP.
I realize having everything on the password manager goes against the "a thing you know plus a thing you have" security policy, but I imagine you'd have much more grief linking every account to a device (a smartphone, usually) you expect can (more likely: will) fail in the next 0 to 6 years.
On the flip side, if you decide to make the thing you have a biometric feature, there's the downside that this thing can never be changed but could possibly be spoofed. In twenty years, you'll still have the same fingerprints, and you even have the same fingerprints, iris, face, etc. when you're unconscious.
Maybe the best strategy is a hardware key with printed backup code? Then you really need to hide the printout somewhere only you know, where it won't get destroyed, where it can be accessed relatively quickly without a complicated lockout, where it won't get accidentally discovered by the HVAC repairman, and where you won't forget after 0 to 6 years. Solving this location riddle seems the most impossible of all...
Re: The Personal Security Checklist
#39Earlier quoted context omitted.
This list is specific and parochial of course. Rudimentary thematic analysis of the list reveals common patterns fairly well known to security people: - Less is more. - Convenience works for you, and adversaries. - If it's old, maintain it. - Never tell the truth. - Keep moving. - Don't underestimate the enemy. - Have a plan B. In the literature these have fancy names like Dolev-Yeo, Minimal attack surface etc. Inter…
Great list! Could you expand on the items a bit?
> Great list! Could you expand on the items a bit?
That would be funny, as the list is an attempt to reduce things.
Perhaps you mean - can we elaborate on the principles of reduction somewhat?
Maybe. I am wondering. The problem with pithy lists is that, in the limit, they end up as a collection of mutually-contradictory idioms, like; "Many hands make light work" but "Too many cooks spoil the broth".
Security is already a mess of theories in tension - "If in doubt don't." versus "Fortune favours the brave"
Perhaps we could make a more focused list for our readers, for innovative developers, with items like:
"Secure yourself before attempting to secure others."
"Don't assume you know what people want"
But I fear it would not be gladly received.
Re: The Personal Security Checklist
#40I would love a list like this which is geared towards more advanced users (and software developers who deal with a lot of sensitive data) and describes threat models more comprehensively.
For software developers working for a corporate: Use your corp laptop and phone only for corp work. Don't do any personal stuff on it, including browsing the general web. Just this alone reduces the risks significantly.
Add to that "don't be smarter than your IT department", even if you know how to do something on your own.
Remember that if you get compromised because you did something your IT dept should do or at least sign-off it will be your fault and one may face real consequences.