Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Guide to Not Getting Hacked

motherboard.vice.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: A Guide to Not Getting Hacked

#41

Post by tptacek »

Everything that's in this piece that's true is on the Tech Solidarity guide. What isn't, is false.

https://techsolidarity.org/resources/basic_security.htm

In particular:

* Do NOT install antivirus on your computers. Antivirus software is absurdly dangerous. The closest you'll come to benign AV is Microsoft's, but that's an asymptotic kind of safety.

* Do NOT go out of your way to funnel your traffic through a commercial VPN provider. If you need a VPN for your NGO or journalism outlet, let me or someone else trustworthy know, and we'll set up Algo for you. No commercial VPN provider is safe for at-risk users.

* Do NOT EVER use Tor Browser. It's the least safe browser you can use: a lagged fork of Firefox for which whole classes of security bugs are potentially WONTFIX'd, and also the only browser that goes out of it's way to collect high-value targets.

* Do NOT install Adium or Pidgin to speak to people over OTR. It's difficult to find exploitable bugs in libotr, but it is not difficult to find them in libpurple. Use Signal, WhatsApp, or Wire.

* You would have to be out of your fucking mind to install mobile AV.

Re: A Guide to Not Getting Hacked

#42

Post by aulani »

brudgers wrote: post #39
davidscolgan wrote: post #18

I've lately only been using Linux on my laptop and desktop, but my grandparents recently asked me about advice on a new computer. Is the current best practice to avoid all antivirus software and assume Windows 10 is secure with whatever is built in? Grandpa thinks Avast makes his computer secure and is using their custom browser for his banking. Is my great distrust in all antivirus systems as worse than the viruses…

I share your intuition. Absent credible evidence to the contrary, I would not use anything on Windows other than the default from Microsoft. On the other hand, I probably wouldn't expend a lot of energy arguing with Grandpa when Grandpa has decided Grandpa knows better. However, my first level advice would be not to do banking online, but that's another story.

> However, my first level advice would be not to do banking online, but that's another story.

Yeah just don't use one of the greatest conveniences of the Internet — that solves it.

Re: A Guide to Not Getting Hacked

#43

Post by proee »

Regarding web extensions like Adblock or others, this seems to be quite risky I'm using because the developers of the plug-in could get hacked and silenly release a version that captures your password fields.

Are we really ok giving full read/write access to our webpages from companies we know nothing about?

I'm considering removal of all web extensions that have read/write access.

Thoughts?

Re: A Guide to Not Getting Hacked

#44

Post by Redoubts »

ryanlol wrote: post #17
paulryanrogers wrote: post #16

Earlier quoted context omitted.

Why else is it terrible?

It also recommends running an antivirus on desktop, using a VPN, using tor browser, pidgin and goes as far as discussing android as a viable option. The “lock up your SIM” part is simply ridiculous too, this has never ever stopped anyone. This article is terrible because it has clearly been written by non-experts who should not be writing any security guides.

I’m out of the loop, what’s wrong with pidgin?

Re: A Guide to Not Getting Hacked

#45

Post by massaman_yams »

brudgers wrote: post #39
davidscolgan wrote: post #18

I've lately only been using Linux on my laptop and desktop, but my grandparents recently asked me about advice on a new computer. Is the current best practice to avoid all antivirus software and assume Windows 10 is secure with whatever is built in? Grandpa thinks Avast makes his computer secure and is using their custom browser for his banking. Is my great distrust in all antivirus systems as worse than the viruses…

I share your intuition. Absent credible evidence to the contrary, I would not use anything on Windows other than the default from Microsoft. On the other hand, I probably wouldn't expend a lot of energy arguing with Grandpa when Grandpa has decided Grandpa knows better. However, my first level advice would be not to do banking online, but that's another story.

Or, only do banking from a Chromebook which is never used for anything else.

Re: A Guide to Not Getting Hacked

#46

Post by jdietrich »

proee wrote: post #43

Regarding web extensions like Adblock or others, this seems to be quite risky I'm using because the developers of the plug-in could get hacked and silenly release a version that captures your password fields. Are we really ok giving full read/write access to our webpages from companies we know nothing about? I'm considering removal of all web extensions that have read/write access. Thoughts?

uBlock Origin is GPL licensed. It collects no analytics. The code base is concise and highly legible. The primary maintainer (Raymond Hill) appears to be a principled man. I don't think that it has been independently audited, but I trust it more than most of the software on my computer.

https://github.com/gorhill/uBlock

Re: A Guide to Not Getting Hacked

#47

Post by ryanlol »

Redoubts wrote: post #44
ryanlol wrote: post #17

Earlier quoted context omitted.

It also recommends running an antivirus on desktop, using a VPN, using tor browser, pidgin and goes as far as discussing android as a viable option. The “lock up your SIM” part is simply ridiculous too, this has never ever stopped anyone. This article is terrible because it has clearly been written by non-experts who should not be writing any security guides.

I’m out of the loop, what’s wrong with pidgin?

libpurple suffers from very poor code quality, leading to tons of exploitable vulnerabilities. Just as you would expect when writing C parsers for lots of complicated protocols.

Re: A Guide to Not Getting Hacked

#48

Post by tptacek »

suyash wrote: post #37
_b8r0 wrote: post #34

Earlier quoted context omitted.

Grandpa should probably use a chromebook. It's cheap, it's not as targeted as windows systems, and doesn't need AV. On the downside he'll be locked into the Google ecosystem, but for his needs that might not be so much of a problem. If it becomes a problem, GalliumOS is actually good enough in most cases to use as a daily driver on a Chromebook.

Grandpa will be better off with an iPad since iPad has way more apps than Chromebook and is more intuitive and user friendly than Android or Chromebook. iPad can can work offline, more portable and convenient to read (pinch and zoom etc) and to write, type with a keyboard that you can connect or touch type on screen. Not to mention Apple will protect his privacy more than Google will.

Chromebooks and iPads are both fine. Both are vastly better than general-purpose computers of any kind.

Re: A Guide to Not Getting Hacked

#49

Post by tptacek »

chippy wrote: post #10
ploggingdev wrote: post #5

> Do use antivirus I think the standard advice from the security community is to not use any antivirus at all and maybe only Windows Defender if you're on windows. The advice to use Tor browser is also terrible. The Tor browser is based on an older version of Firefox ( currently version 52 vs 57 for upstream Firefox ) and so might contain known bugs. On a side note what does the security community think about Qubes O…

Firefox 52 is a special Extended Support Release version and will continue to get security patches.

ESR releases get a subset of security patches. Don't use Tor Browser.

Re: A Guide to Not Getting Hacked

#50

Post by strictnein »

polote wrote: post #20
ploggingdev wrote: post #5

> Do use antivirus I think the standard advice from the security community is to not use any antivirus at all and maybe only Windows Defender if you're on windows. The advice to use Tor browser is also terrible. The Tor browser is based on an older version of Firefox ( currently version 52 vs 57 for upstream Firefox ) and so might contain known bugs. On a side note what does the security community think about Qubes O…

Why not use antivirus ? they are a good protection against downloaded content (email attachements, downloaded file) no ?

Non-tech users should antivirus

If you're highly technical and no one else touches your machines, then you may be fine.

The claim that no one should use it is trendy right now. The idea that your in-laws Windows box should be left with nothing on it is misguided. But all you do need is to make sure Windows Defender is running and up to date.

Post reply on HN