201–210 of 469 posts
As far as I know I did everything right, and someone called my bank with info we both believe they got from stealing from my paper mail and got access because they convinced some human at a bank's call center they were me.
Don't make it easy for people (rng passwords + password manager, 2fa, don't run as su, whole disk encryption, don't leave you computer unlocked, don't log into your bank on rando computers you don't control, don't use untrusted wifi). However, assume you already are compromised and will have to deal with it some day.
Once you think that way, you don't need to stress that much about getting the perfect hardware solution or being super paranoid - buy a device you like, and enjoy you digital life. Stuff happens sometimes and if it does you can deal with it ¯\_(ツ)_/¯.
ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…
Cryptographic verification of the boot chain with Hardware root of trust are real. Heavily sandboxed userspace is real. Everything else would seem to be a reimplementation of common best practices (disk encryption), or a mitigation of a self-created problem (there shouldn't be binary driver blobs running on the main CPU to begin with).
And from what I remember, a plain AOSP install seemed to still phone home to Google to check for Internet connectivity and whatnot. It's awfully hard to put my faith in an operating system primarily developed by a surveillance company, as the working assumptions are a drastic departure from individualist computing. And trying to question those assumptions with independent devs is often dismissed (for a particularly striking example, see LineageOS/"Safetynet").
Earlier quoted context omitted.
> Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.
When I was an intern at a company, I forgot to lock my screen once when I went to the toilet My colleagues edited my .bashrc to echo "lock your screen next time"
(Kidding obviously, at least for the latter).
Earlier quoted context omitted.
> it seems it is most further ahead of the mainstream OSes Noob here, I recall often hearing that iOS has superior security to Android. Has this situation reversed in the last few years, or was it never true?
Isn’t most of the value here in not allowing sideloading? In iOS your grandma/child cannot be tricked into clicking “allow apps from untrusted sources”, which is how most breaches happen.
Earlier quoted context omitted.
> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additiona…
I’ve no doubt you are referring to uBlock Origin but it’s real important to label it as such so the unaware don’t install uBlock.
> or me this amounts to enabling NoScript and uBlock
Hard to see how installing third-party extensions that can view and change data for every site makes the browser more protected.
Are there any somewhat easy-to-use solutions to isolate a development environment? Preventing or at least decreasing the damage malicious packages could do? Like deleting files or uploading a private ssh key/keychain to a 3rd party server? I was looking into things like GitHub Codespaces, I believe they're isolated per repository and integrated into VS Code, but I'd like something I could run on my machine or a serve…
Docker containers?
Earlier quoted context omitted.
Maybe you're thinking of privacy, not security? In terms of privacy, Android is "compromised" by default, i.e. Google collects and stores a ton of private information about you. I believe Apple used to be much better, and still is, but getting worse.
Both are one the same level at this point.
However, this is a speculation, so please take it as a grain of salt.
My TL;DR Summary With time I have moved further and further away from using the computer for important things and believe that tech has long since exceeded George Orwell's wildest fever dreams I assume a freshly installed OS is compromised [1] and the hardware it is on is also compromised in the BIOS and firmware at very least by state actors but then I also assume those state actors have poorly vetted contractors th…
>ECHELON AI is yawning Well, presumably it would stop yawning if you were, like, part of an armed rebellion. The perspective I'd like to hear would be the Ukranian civil and military resistance to Russia's invasion. How do they know their systems aren't compromised? Because, yeah, in their case, being compromised means getting killed.
In fact there have recently been articles about this and each side ordering their troops to stop using their cell phones. Both sides have attributed several mass casualties to cell phones. This is probably harder to enforce with conscripts and military contractors. Many of the first wave of troops thought they were just going on a training exercise.
Earlier quoted context omitted.
What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments. For example IT enforces that your screen becomes locked after 15 minutes of inactivity and also ties in your local computer 's user login password to your SSO login to access everything. It's a contradiction around password best practices. If you force people to input their password multiple times a day th…
> What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments. > For example IT enforces that your screen becomes locked after 15 minutes of inactivity If your OS is MS-Win, try playing an audio file when you don't want the auto-lock to go off. Provided IT's "checkbox security" parameters [1] did not include turning this off, MS-Win does not timeout lock the system…
This puts you into a grey area though no? You could make a case this is willingly trying to circumvent security protocols which could be grounds for being fired.