The Personal Security Checklist • Hacker News Board

Re: The Personal Security Checklist

#111

Post by alipitch » Tue, Apr 05, 2022, 10:22 AM UTC

Terretta wrote: post #83

alipitch wrote: post #18

Is there a list issued by eff.org, nist or a similar organization, that is maintained and updated?

> This guide is an overview of digital security considerations specific to journalists covering protests. For EFF’s comprehensive guide to digital security, including advice for activists and protesters, visit ssd.eff.org. Legal advice in this post is specific to the United States. https://www.eff.org/nb/deeplinks/2020/06/digital-security-ad... Also: SURVEILLANCE SELF-DEFENSE: TIPS, TOOLS AND HOW-TOS FOR SAFER ONLINE…

Thank you. I will look at the sites.

Re: The Personal Security Checklist

#112

Post by billdietrich1 » Wed, Apr 06, 2022, 9:05 PM UTC

kube-system wrote: post #99

I don't understand why anyone recommends disabling javascript. If you're making that much of a sacrifice in user experience, you might as well uninstall your web browser.

For most sites I use, JS detracts from the "user experience". I just want to read an article, not deal with accept-cookie popups or ads or menus etc.

Even on interactive sites such as my bank accounts, I'd rather have a plainer page that just worked in all browsers and worked in a simple way, than have some UI-designer's work of art with fancy coding and unique effects etc.

Re: The Personal Security Checklist

#113

Post by billdietrich1 » Wed, Apr 06, 2022, 9:07 PM UTC

gandalfff wrote: post #14

Tip #1 should be: determine your threat model. Who are you, and why should hackers care about hacking you? Who is doing the hacking? Is it a 3-letter organization or other nation-state adversary? Is it a corporate actor trying to commit corporate espionage? Someone trying to steal your identity? I am less valuable to hack than Vitalik Buterin, who in turn is less valuable to hack than President Biden.

I don't have a threat model. I just have typical data (financial, family, hobbies, etc) and want a reasonable level of protection against all threats (snoops, thieves, scammers, police, govt, etc). So I just use standard best practices: encryption, backups, password manager, 2FA, software updating, blockers in the browser, firewalls, VPN, etc. No need to identify specific threats, I don't have any. No need to list out all my data.

Re: The Personal Security Checklist

#114

Post by billdietrich1 » Wed, Apr 06, 2022, 9:12 PM UTC

euphetar wrote: post #74

My beef with all of these checklists: do you expect me to spend my whole managing my security?

You could spend 20 minutes reading the list, and come up with 2 or 3 things you want to do right away.

A lot of security things are one-and-done: install uBlock Origin browser extension, enable VPN, enable software auto-update. Then they just work in the background after that.

Given that my entire net worth is accessible through my internet-accessible bank accounts, yes, I'm willing to spend SOME effort managing my security.

Re: The Personal Security Checklist

#115

Post by mattalex » Wed, Apr 06, 2022, 9:16 PM UTC

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

Does it matter if you have two factors in your vault, but secure the vault itself with two factors?

I secure my vault with 2 factors, therefore any attacker would

1. have to access my vault in the first place 2. find the first factor 3. find the second factor

Technically accessing the vault+password itself would already be a two factor scheme.

Re: The Personal Security Checklist

#116

Post by kingcharles » Mon, Apr 11, 2022, 5:08 PM UTC

astockwell wrote: post #20

schoen wrote: post #4

Earlier quoted context omitted.

More common associated risk: Police detain you and point your phone at your face to unlock it (or unlock your access to some other resource). That is not a very high-tech or high-effort attack and could be relevant if you're concerned about the police. Someone might say that this concern is useless because the police can also coerce you to unlock your phone via a different method, but that depends on the law and cult…

If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.

I know I've posted this a lot of times, so I'm sounding like a broken record, but you won't get a chance to do it. When the government came for me they pointed a loaded gun at my head. There was no way I could have moved my hands to start fannying around with my phone. I refused to cooperate when they threatened me, but they soon realized a new tactic and threatened my wife. You're probably tougher than you think. You might be able to take a spanner to your knee caps, but if the government puts a gun to your spouse or children (or even your dog), what are you going to do then? Certainly in the USA at least, I don't think the police are committing any misconduct by telling you they are going to take your wife outside and shoot her in the face if you don't give up your fifth amendment privilege.