[Copied from my comment on a duplicate post -- there seems to be random tracking junk at the end of the URL that prevents these from being detected as duplicates!]
I appreciate how practical these tips are and I hope people will follow them.
I have two quarrels with this:
> Andy Grove was a Hungarian refugee who escaped communism [... and] encourages us to be paranoid.
I'm pretty sure that Grove was referring to business strategy, not communications security.
> Congratulations — you can now use the internet with peace of mind that it’s virtually impossible for you to be tracked.
Something I've seen over and over again is that Tor users tend to have a poor understanding of what Tor protects and doesn't protect. The original Tor paper said that Tor (or any technology of its kind) can't protect you against someone who can see both sides of the connection -- including just their timing. Sometimes, some adversaries can see both sides of a person's connection. As The Grugq and others have documented, Tor users like Eldo Kim and Jeremy Hammond were caught by law enforcement because someone was monitoring the home and university networks from which they connected to Tor and saw that they used Tor at exactly the same time or times as the suspects did. (In Hammond's case, recurrently, confirming law enforcement's hypothesis about his identity; in Kim's case, only once, but apparently he was the only person at the university who used Tor at that specific time.)
As law enforcement has actually identified Tor users in these cases, I think people need to understand that Tor is not magic and it protects certain things and not other things. In fact, I helped to make a chart about this a few years ago:
This chart was meant to show why using HTTPS is important when you use Tor, but it also points to other possible attacks (including an end-to-end timing correlation attack, represented in the chart by NSA observing the connection at two different places on the network) because many people in the picture know something about what the user is doing.
I've been a fan of Tor for many years, but I think we have to do a lot better at communicating about its limitations.
Isn't 2FA considered dangerous now? We've seen how susceptible it can be to social engineering.
On a related note, I noticed that my Windows Phone displays text message notifications even when it's locked... So adding a PIN doesn't prevent an attacker from doing 2FA if they have access to my phone.
There were also cases of attackers tampering with the phone system to intercept 2FA tokens. Much better is authenticator-app-based or hard-token-based 2FA.
SMS 2FA isn't safe at least, and even NIST is deprecating it. The rest depends on dumb implementations, like Paypal allowing 2FA bypass with a change of the login link, or Google allowing 2FA bypass of all of its other methods by forcing you to use a phone number as "backup", which is to 2FA what secret questions were to passwords (their Achilles's heel).
Secret questions are horrible when they're predefined, and what's worse is when the options are also predefined (e.g. United Airline's website).
However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media).
But I'm digressing and agree TOTOP 2FA is great for the masses. Just be sure to have the backup codes stored in a safe space.
>However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world //
Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't).
Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).
2FA with a hardware token (U2F, Universal Second Factor) is the safest method. It has built in phishing protection, and sites can't track the token (no unique ID). It's really nice and I use it a lot but carrying around a token on your key ring makes it a hard sell for the general public.
SMS 2FA is weak, but either better than no second factor or worse depending on your situation. Use a TOTP app like FreeOTP or Google Authenticator for good 2FA.
> I noticed that my Windows Phone displays text message notifications even when it's locked
On Android you can disable that, even per app. Maybe Windows can do that too.
I tried using Signal but the problem is no one else wants to. So yeah I'd love e2e encryption but it requires both parties to use it, which is a problem.
How is it possible for DuckDuckGo to offer google search results legally? Aren't Bing and Google constantly sniping at each other for implementing each other's results?
Another reason to keep them separate is that it reduces cognitive noise when dealing with spam.
I use separate addresses for banks, brokerage, etc. Because the email address associated with each isn't used elsewhere, I can almost always identify the culprit when it starts getting spammed, so I can cease business with and blacklist anyone who does it[1].
Because of that, any phishing attempts that go to the wrong address, even well done, tricky ones, are so obvious a machine can trash them with certainty.
Yet another reason is that if someone is going to try to guess/steal your password, if they don't know the email address used for that account, that's something else that can slow them down/trip them up.
[1] That is how Wells Fargo lost my business, well before they made a surprisingly strong go at proving Lenin right about capitalists.
I would say it's similar to not using the same password on multiple sites.
If you use the same email, once that one is compromised, than all accounts related to it could be in jeopardy.
By having a separate account just for financial purposes, which isn't used for regular emails with anyone, it just decreases the chances of it being leaked.
I also use Keepass[x]! The issue that I see people facing is that it isn't multi-device (it's an offline password manager).
For me, that is the selling point though.
I like Keepass becuase it is not tied to any ongoing subscriptions or providers. You can use the file sync tool of your choice to distribute your file. The downside/feature is not having tight browser/app integration.
Yeah KeePass is great! I currently use KeePass2 on my Trisquel 7 machine. I use that app in conjunction with Deja Dup to back up my password database to S3. There's even an app on the fdroid store called KeePassDroid but I've yet to make it work. I think the version on the store hasn't been recently updated.
I love 1password. The team behind it seems really dedicated and the various applications for each platform show a level of polish you'd expect from a team like that.
I use pass too and love it, but it is worth noting that the names of the passwords are not encrypted, meta data based on the names can be extracted. The naming scheme is fully up to you though, but if you don't want to expose meta data at all, I'd recommend keepass instead.
I've tried many (1pass, ...), and hated them, now finally I am using Dashlane and it's pretty good. Still needs a little bit of work/love, but it mostly just works. I'm paying for the sync version, I don't mind paying for a usable way to have strong passwords all around.
I really wonder if intelligence services are paid to demoralize user groups when I see posts like this.
If you do all these things, your resistance to even NSA-level incriminating evidence goes WAY down, and your vulnerability to local LEO and hackers goes to near-zero.
This is, at best, a brick wall, through which an adversary would have to bulldoze.
> I really wonder if intelligence services are paid to demoralize user groups when I see posts like this.
Bluntly, if you want to tangle with the pros playing like an amateur and not calculating the risks, you're going to be demoralized in your jail cell or worse.
Understand, in depth, opsec before playing with the pros. Understand, understand, understand. Don't just grab random blog posts and mindless implement them. Understand specific details of what you're giving up and the tradeoffs.
Activists have been doing amateur hour opsec for forty years and most of have been cracked like a crab constantly. Pay attention to history, folks!
At its core its about economics. The NSA wants to do mass survailance, and if masses of people adopt even small amounts of improved security it has an effect. People dont have to understand Signal, just use it, just as https.
If everybody did all the things in this blogpost, we would be better of.
Be careful with 2 factot authentication. A Telegram user was hacked by the police in Russia. The government can receive your SMSes. Use non-SMS 2-factor.
The article is very slightly more nuanced but the conceptss the title purports is DANGEROUSLY INCOMPETENT for any security expert / discussion / context.
1) idea that security is something you check off and be done with is dangerously wrong. Security must be continuous, must be updated, reviewed, etc.
2) idea that you can "encrypt" [secure] your entire life is ludacris and leads to many dangerous security misconceptions. You don't even have control of your entire life, let alone ability to secure it. Most the data on you is owned by others and not even available to you to secure. The world is not private or secure. Everyone needs to know and think about this when they are tweeting, sexting, talking shit about future president and then being surprised when SS comes to investigate.
3) idea that security is either on/off, a binary, that you can be secure or not. Is False and leads to extremely poor security choices, over/under securing. Nothing is secure. There is not such thing as SECURE. Things lie on a gradient of security from easy to break to impractically difficult. Things on the impractical to break technically end are still broken due to social engineering, externalities (power consumption of cpu), poor practices surrounding item, etc. Security is making the effort required to get an item greater than the value of getting the item.
Oversimplifying things like this bugs me too. There are some non-easy choices to make. e.g. do you encrypt your backups? if you encrypt every copy of everything you have and you lose your passphrases, it's gone. This may be obvious to the cypherpunks in the audience, but to the average user out there, they're not necessarily so prepared to deal with that.
The article didn't cover email: Get off of the freebie services like Yahoo! and Gmail and go someplace else because we already know that these companies are in big-time cahoots with the government. Also, Google was working hard to get Clinton crime cabal elected to the point of messing with search results. WE WON'T FORGET.
FastMail is a decent paid service.
Or ProtonMail, Hushmail who market on privacy and security.
They pay a large expert security team to work hard on security all the time (including both mitigating attacks on Google's own infrastructure, and detecting sophisticated phishing attacks against Gmail users).
They pay a large expert legal team to work hard on legal issues all the time.
They're so popular that metadata analysis actually starts to get difficult a lot of the time.
They attract a lot of attention from governments. Governments have put resources into figuring out how to request data from Gmail. Gmail fights many of these requests vigorously, and ends up complying with many of them.
Signal is atrocious for security. You literally log in with your phone number. Anything you send is directly and irrevocably tied with your physical identity. What good is to me that the messages are encrypted? When the police come knocking, either I'll decrypt them, they'll beat me until I decrypt them, or I'll die in prison for not decrypting them. I do want my messages encrypted, but more than that I really want them not tied to ME.
It's an interesting problem! There's a lot of pieces that are equally strong "personal identifiers" to a phone number, including your carrier tying your IP address to your IMSI. Add to that, if both parties of the communication are under surveillance, there's going to be strong time correlations.
You're describing a very different use case than what I use Signal for (discussing things that could be harmful for clients if it got out, not things where I'd want repudiation).
I think my use case is relatively well solved, but I'd be super curious to see how algorithms could be changed to solve yours.
Mine was solved decades ago when I was allowed to just make an account with an e-mail and create any number of pseudonymous accounts. This allows me things like to have a personal and work account, and not leak information between different identities. And, most importantly, it lets me talk to someone without having first to reveal my real-world identity. With Signal, I have to already know that person and trust them with my phone number. It's not really state surveillance, it's the fact that what used to be private information I only shared with close friends now has to be public and told to every random person online I want to chat with. Just.. just let me make an account tied to an e-mail or to my google profile or anything but my phone number. The entire thing creeps me out.
Walk to a Target with $200 cash and no electronic devices on you. Buy a prepaid android smart-phone and a pre-paid airtime card, and activate them using said device.
Too bad meta-data and social graphs will screw you over anyways. Unless you don't use the device for interacting with people you know, in which case, what's the point?
If the threat model includes "the police come knocking" and "die in prison" then it's best to assume the phone can be traced back to the store and approximate time it was sold (potentially even the exact time and cash register), and surveillance videos will be searched.
On top of that, Target has the best video surveillance and most cooperation with police of any large retailer. Their surveillance group even spends a good chunk of its time doing work for various police departments who don't have resources to process the evidence themselves. One should never use a target for anything privacy-related if the police are in the threat model.
Question: Given that gmail can be compromised, even 2 factor auth. Why aren't there any extensions that would make it easier to use a public key while keeping the gmail data encrypted? Yes, I understand that gmail is not eager to encrypt the emails but users would be will to do it if there was a simple extension in chrome or firefox. Using an extension would have saved many from email hacks in the past year. Yes, it would still be available on the user's machine but it would certainly add another level of security.
That was my thought when he suggested using Signal.
Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones.
(Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities)
EDIT: On second thought, don't you have to sign apps with a private key? I assume that raises the bar a bit, as long as the devs can keep those keys private which seems reasonable enough for such an app.
However, when the author suggests using FileVault, it shows that he doesn't consider the implications of installing a proprietary software, or using a proprietary OS.
Better off reading JJ Luna's How to Be Invisible plus espionage non-fiction about Cold War fieldcraft. Then just stop using electronics when you really want privacy. Also, if you do crypto, make it look like HTTPS or something normal to be lost in the crowds over WiFi proxies. Signal and Tor screams "Look at me!"
Truth is, though, you wont be participating with most people online if you have very strong INFOSEC and OPSEC. The baseline is just way too low with insecurity and surveillance everywhere.
69 comments
[ 4.2 ms ] story [ 140 ms ] threadI appreciate how practical these tips are and I hope people will follow them.
I have two quarrels with this:
> Andy Grove was a Hungarian refugee who escaped communism [... and] encourages us to be paranoid.
I'm pretty sure that Grove was referring to business strategy, not communications security.
> Congratulations — you can now use the internet with peace of mind that it’s virtually impossible for you to be tracked.
Something I've seen over and over again is that Tor users tend to have a poor understanding of what Tor protects and doesn't protect. The original Tor paper said that Tor (or any technology of its kind) can't protect you against someone who can see both sides of the connection -- including just their timing. Sometimes, some adversaries can see both sides of a person's connection. As The Grugq and others have documented, Tor users like Eldo Kim and Jeremy Hammond were caught by law enforcement because someone was monitoring the home and university networks from which they connected to Tor and saw that they used Tor at exactly the same time or times as the suspects did. (In Hammond's case, recurrently, confirming law enforcement's hypothesis about his identity; in Kim's case, only once, but apparently he was the only person at the university who used Tor at that specific time.)
As law enforcement has actually identified Tor users in these cases, I think people need to understand that Tor is not magic and it protects certain things and not other things. In fact, I helped to make a chart about this a few years ago:
https://www.eff.org/pages/tor-and-https
This chart was meant to show why using HTTPS is important when you use Tor, but it also points to other possible attacks (including an end-to-end timing correlation attack, represented in the chart by NSA observing the connection at two different places on the network) because many people in the picture know something about what the user is doing.
I've been a fan of Tor for many years, but I think we have to do a lot better at communicating about its limitations.
On a related note, I noticed that my Windows Phone displays text message notifications even when it's locked... So adding a PIN doesn't prevent an attacker from doing 2FA if they have access to my phone.
However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media).
But I'm digressing and agree TOTOP 2FA is great for the masses. Just be sure to have the backup codes stored in a safe space.
Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't).
Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).
SMS 2FA is weak, but either better than no second factor or worse depending on your situation. Use a TOTP app like FreeOTP or Google Authenticator for good 2FA.
> I noticed that my Windows Phone displays text message notifications even when it's locked
On Android you can disable that, even per app. Maybe Windows can do that too.
2FA with, say, a hardware token or even a phone app is generally pretty good.
http://security.stackexchange.com/questions/32367/what-is-th...
Don't use this email for anything else.
(Shops are regularly hacked with leak of email addresses and possibly compromising passwords.)
I use separate addresses for banks, brokerage, etc. Because the email address associated with each isn't used elsewhere, I can almost always identify the culprit when it starts getting spammed, so I can cease business with and blacklist anyone who does it[1].
Because of that, any phishing attempts that go to the wrong address, even well done, tricky ones, are so obvious a machine can trash them with certainty.
Yet another reason is that if someone is going to try to guess/steal your password, if they don't know the email address used for that account, that's something else that can slow them down/trip them up.
[1] That is how Wells Fargo lost my business, well before they made a surprisingly strong go at proving Lenin right about capitalists.
If you use the same email, once that one is compromised, than all accounts related to it could be in jeopardy.
By having a separate account just for financial purposes, which isn't used for regular emails with anyone, it just decreases the chances of it being leaked.
Me too! Though I'm curious as to what you mean by multi-device? I use it on multiple devices just fine, though I have to sync them by hand.
http://keepass.info/plugins.html
https://jmcphers.github.io/security/2016/05/08/passwords.htm...
Categorize your levels of paranoia appropriately.
If you do all these things, your resistance to even NSA-level incriminating evidence goes WAY down, and your vulnerability to local LEO and hackers goes to near-zero.
This is, at best, a brick wall, through which an adversary would have to bulldoze.
Bluntly, if you want to tangle with the pros playing like an amateur and not calculating the risks, you're going to be demoralized in your jail cell or worse.
Understand, in depth, opsec before playing with the pros. Understand, understand, understand. Don't just grab random blog posts and mindless implement them. Understand specific details of what you're giving up and the tradeoffs.
Activists have been doing amateur hour opsec for forty years and most of have been cracked like a crab constantly. Pay attention to history, folks!
If everybody did all the things in this blogpost, we would be better of.
[1]: https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...
[2]: https://freeotp.github.io/
* Trusted friends (like in Facebook)
* Renew your password in the office (like in my university)
* User-side SSL certificate
* Oh, end then Telegram introduced PIN+TFA
1) idea that security is something you check off and be done with is dangerously wrong. Security must be continuous, must be updated, reviewed, etc.
2) idea that you can "encrypt" [secure] your entire life is ludacris and leads to many dangerous security misconceptions. You don't even have control of your entire life, let alone ability to secure it. Most the data on you is owned by others and not even available to you to secure. The world is not private or secure. Everyone needs to know and think about this when they are tweeting, sexting, talking shit about future president and then being surprised when SS comes to investigate.
3) idea that security is either on/off, a binary, that you can be secure or not. Is False and leads to extremely poor security choices, over/under securing. Nothing is secure. There is not such thing as SECURE. Things lie on a gradient of security from easy to break to impractically difficult. Things on the impractical to break technically end are still broken due to social engineering, externalities (power consumption of cpu), poor practices surrounding item, etc. Security is making the effort required to get an item greater than the value of getting the item.
I'm sure you means ludicrous and not https://en.wikipedia.org/wiki/Ludacris
FastMail is a decent paid service. Or ProtonMail, Hushmail who market on privacy and security.
They pay a large expert security team to work hard on security all the time (including both mitigating attacks on Google's own infrastructure, and detecting sophisticated phishing attacks against Gmail users).
They pay a large expert legal team to work hard on legal issues all the time.
They're so popular that metadata analysis actually starts to get difficult a lot of the time.
They attract a lot of attention from governments. Governments have put resources into figuring out how to request data from Gmail. Gmail fights many of these requests vigorously, and ends up complying with many of them.
https://protonmail.com/
You're describing a very different use case than what I use Signal for (discussing things that could be harmful for clients if it got out, not things where I'd want repudiation).
I think my use case is relatively well solved, but I'd be super curious to see how algorithms could be changed to solve yours.
Too bad meta-data and social graphs will screw you over anyways. Unless you don't use the device for interacting with people you know, in which case, what's the point?
There's no such thing as privacy when using proprietary software.
If the goal is to secure your privacy, there no need to argue beyond that.
Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones.
(Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities)
EDIT: On second thought, don't you have to sign apps with a private key? I assume that raises the bar a bit, as long as the devs can keep those keys private which seems reasonable enough for such an app.
However, when the author suggests using FileVault, it shows that he doesn't consider the implications of installing a proprietary software, or using a proprietary OS.
Truth is, though, you wont be participating with most people online if you have very strong INFOSEC and OPSEC. The baseline is just way too low with insecurity and surveillance everywhere.