Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Bare Minimum You Should Do to Protect Your Family's Data

blog.mozilla.org

Post reply on HN
Print view View original

111–119 of 119 posts

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#111

Post by lsc »

porphyrogene wrote: post #66
hannob wrote: post #28

More than half of that I wouldn't advice or would have serious caveats about the advice given... This is really a strange document... Just a few examples: "Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" "Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks. "Even better, get a VPN (virtual p…

I agree and I'm glad that it was taken down. However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. Most phones should have certain network sharing features disabled before accessing an unsecured network. Among people I know it is common for someone to ask if anyone is currently running a mobile hotspot before opening their o…

>However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices.

I would call it an "appeal to practicality"

I mean, sure, you and I carry mobile plans with tethering capabilities; my iphone/verizon combo is nearly always better than your average free or included with purchase wifi network. But I also have a device that was like a grand up front and the service is north of $100/month. It's a totally reasonable and practical solution for me, sure, but for someone who doesn't work in tech, or for someone who has kids, etc, etc... for a lot of people, spending that much on connectivity is not particularly practical.

(you can get cheaper tethering setups, of course; those that I've tried have been worse in the areas where I've tried them; it has been more than a year since I tried, so the 'verizon is the best if you don't care about price' statement may be out of date, and of course, different areas have different coverage. YMMV, of course. My main point is just that if you want tethering that is consistently better than free wifi... that's going to cost you an amount of money that might be impractical for most people.)

I mean, sure, you could still just not use data... my computer would be more secure if I left it off. But it would also be a lot less useful.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#112

Post by yayana »

_8j50 wrote: post #109
yayana wrote: post #105

Earlier quoted context omitted.

You are moving the goal posts. The issue I take is with "threat actor". If a threat actor wasn't detected you have no idea if they exist. Only windows crapware tries to make the warped perception that what it doesn't know doesn't exist and priority obviously goes to where exploits provably exist. But insecurity is being attackable not being aware you are attackable (and certainly not knowing you are attackable but se…

Look,the concept is not subjective. I didn't say a threat actor,I said threat. I highly recommend looking these things up on your own but the goal of Information security is to reduce the risk that vulnerabilities will be exploited to where a breach of your security goals occurs(i.e.:CIA triad,confidentiality,integrity and availability mostly). It's not to make your system impregnable to all conceivable attacks. My e…

Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brought up threat actors.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#113

Post by _8j50 »

yayana wrote: post #112
_8j50 wrote: post #109

Earlier quoted context omitted.

Look,the concept is not subjective. I didn't say a threat actor,I said threat. I highly recommend looking these things up on your own but the goal of Information security is to reduce the risk that vulnerabilities will be exploited to where a breach of your security goals occurs(i.e.:CIA triad,confidentiality,integrity and availability mostly). It's not to make your system impregnable to all conceivable attacks. My e…

Physical security and computer security don't really connect usefully by these kinds of analogies. I suggest you look higher up in the thread for where you brought up threat actors.

Ok,better analogy:There's a 0day vulnerability in a specific device driver you happen to be using,crafting a workable exploit requires a significant amount of skill and the exploit can only work under specific configurations. A well organized and talent-resourced attacker performing targeted attacks would exploit the vulnerability. Realistically,you'll have to take into account the likelihood of someone exploiting this vulnerability when prioritizing remediation(grading insecurity).

A simpler example: apache2 has a RCE but known exploits require PIE disabled for an exploit to work. You have one apache server in a segregated vlan that is facing your admin vlan with PIE enabled. In contrast you have an IIS server with DOS vuln facing the internet. The IIS server is more insecure because there is a significantly higher likelihood of a security compromise(availability) against it and the org will face reputational and revenue(?) Impact.

The whole point I want youbto get is that real (in)security is context aware.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#114

Post by plemer »

TimTheTinker wrote: post #26
plemer wrote: post #20

Earlier quoted context omitted.

What do you use instead of a password manager?

I think you misunderstood the sentence. OP is saying TA's password advice (except for "use a password manager") is antiquated.

You're correct, I misread. Thank you.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#115

Post by mcny »

perplamps wrote: post #88
hannob wrote: post #28

More than half of that I wouldn't advice or would have serious caveats about the advice given... This is really a strange document... Just a few examples: "Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" "Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks. "Even better, get a VPN (virtual p…

I ended up writing my own take on bare minimum security practices for less-technical people as a sort of response to the Mozilla article: https://medium.com/@perplamps/super-basic-security-advice-f9... If anyone finds any problems or disagrees with any of my suggestions, let me know and I'll update it!

I don't see any problem with the article but almost all the points you raised show there are things hardware vendors, operating system vendors, application developers, and essentially our world should fix on our end and not burden users with it.

For example, some web browsers (Google Chrome and Apple Safari) offer to create randomized passwords.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#116

Post by TimTheTinker »

stretchwithme wrote: post #41
glitcher wrote: post #11

Earlier quoted context omitted.

I agree. The section on "Use tough passwords and change them frequently", except for the final suggestion to use a password manager, felt like antiquated password advice.

As long as the password manager is trusted. Some are run by a single person nobody's heard of. I met a woman in Vegas who ran one and who couldn't believe that people trusted it so much.

I trust 1Password at present. Everything they’ve done so far (including the structure of their financial incentives) has indicated to me that they are both willing and able to protect my privacy (even from future untrustworthy management) via their software.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#117

Post by tashbarg »

ImprovedSilence wrote: post #79
heinrich5991 wrote: post #52

Earlier quoted context omitted.

Assuming you pull these four words randomly (not-human-random, actually random) out of a dictionary of at least 2048 words, and separate them by a space, you have a password of (at least) 44 bits of entropy. There's no way a "dictionary" attack can reduce the possible password space to less than 2 44 possibilities.

Some quick googling gave me this: https://paul.reviews/passwords-why-using-3-random-words-is-a... (also good stuff here: https://security.stackexchange.com/questions/151165/is-rando... ) It seems the consensus is to use 5-6 words, and following the xkcd trick of 4 may not be enough.

Your first link uses a few assumptions that are very good security practice but may confuse the unexperienced reader:

It assumes that the attacker has complete knowledge of the password generation method. This is good security practice and provides you with a worst case boundary. In reality, though, an attacker seldomly has that advantage. Before an attacker spends x hours/days/weeks to crack pure word-based passwords, they will spend time to crack "passw0rd". If you remove the advantage of password generation method knowledge, all numbers in this article are very different. The reader should know about that!

It assumes that whoever is storing the password may do so badly. It even states "assume the site stores our credentials in the weakest possible way". Which is a dangerous assumption since the weakest possible way would be plaintext and then the whole article would be moot. So, obviously we exclude plaintext. The article goes with simple, single md5 hashes instead. While some kind of worst case, it's pretty unrealistic nowadays that someone makes an effort not to store passwords in plaintext and then fails so miserably in googling how to do so. This worst case is probably chosen to have easier and more impressive cracking numbers. The reader should be aware of this.

It assumes that the attacker obtains the password database. Again, good security practice and a worst case scenario. But still not exactly 100% realistic. If you argue with this assumption, the reader should be aware of that.

In essence, this article proves that the "3 word method" is not secure enough when absolutely everyone uses this exact same method (with knowledge of the exact same words) with a service who incompetently stores passwords and got its password database stolen.

While that is true, the advice it gives "Don't use words in passwords. Ever." is just another example of great oversimplification that is harmful in the end.

Instead of bashing methods for being not secure enough (whatever that means), we should provide users with practical methods to come up with usable passwords that are reasonably secure for the service in question.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#118

Post by octavn »

perplamps wrote: post #88
hannob wrote: post #28

More than half of that I wouldn't advice or would have serious caveats about the advice given... This is really a strange document... Just a few examples: "Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" "Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks. "Even better, get a VPN (virtual p…

I ended up writing my own take on bare minimum security practices for less-technical people as a sort of response to the Mozilla article: https://medium.com/@perplamps/super-basic-security-advice-f9... If anyone finds any problems or disagrees with any of my suggestions, let me know and I'll update it!

Revolut allows you to generate "virtual" credit cards which are just disposable credit card numbers linked to your account. You can spun one for every major online service you use (Netflix, Amazon, etc.) in case it gets hacked or for any transaction you're making on a less trusted site.

Re: The Bare Minimum You Should Do to Protect Your Family's Data

#119

Post by astura »

TimTheTinker wrote: post #55
astura wrote: post #46

Earlier quoted context omitted.

15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.

> Source control was very, very standard 15 years ago. For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`. There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-use…

Sorry, no, this just isn't true.
Post reply on HN