> 10. Install a password management application that doesn't store your secrets in the cloud.
Great recommendation, but how do you handle syncing passwords between your computer and phone?
> 2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP").
Do you recommend using the TOTP feature of 1Password, or would you consider storing your password / TOTP together a loss of the "2nd Factor"?
Great recommendation, but how do you handle syncing passwords between your
computer and phone?
Your password might be a guessed in a dictionary attack if you have a weak password. Or if at some future date a KeePass specific vulnerability is discovered, someone might be able to use that.
But someone trying to brute-force your password isn't a problem anyone needs to worry about.
To my mind, the real downside to using dropbox to store encrypted stuff is that the existence of the encrypted stuff is not a secret. And recently it seems the spooks look upon encryption with ever increasing suspicion.
If you have a device that's relatively well hardened against attack, why subvert those protections by giving a copy of your secrets to a third party who isn't (and can't be, from a legal standpoint) as well protected?
Why give a copy of your secrets to an adversary that's 10 to 20 years ahead of the rest of the world, crypto-analytically speaking?
In short, make them work for it.
When connecting to a computer or charging, never ever tap on "trust this computer". If I understand it right "trusting this computer" involves some irrevocable certificate exchange, in effect granting the computer elevated permissions.
Can someone correct me? What precisely "trusting" on iphone means except from the ability to decrypt backups?
Also:
Don't use icloud or any other cloud sync.
https://support.apple.com/en-us/HT202778
It's anyway not a great idea to plug anything into strange USB ports.
Solid advice, gentlemen. Goes for all your USB-cabels.
4. a citation why chrome would be "safer" than firefox (or edge) would be appreciated. in terms of privacy, i wouldn't trust chrome as much as i'd trust firefox.
7 and 10: as others have noted, where is the security risk in storing the encrypted vault in the cloud? actually, choosing user-friendly solutions has a security benefit in itself because it doesn't make you switch to less secure alternatives ("i'll just use my standard password for this one thing) out of laziness
9. should mention PGP, although that's certianly not convenient and might not work for less tech-savvy people.
The iOS and Chrome recommendations are the things I'm saying that I believe to be somewhat unpopular here. But in the software security community, they've been commonly accepted for several years now.
I try not to recommend PGP anymore, not because it's unsafe but because it's difficult to use and discouraging for unsophisticated users.
Having said that: I actively warn against trying to use PGP for secure email. Email has inferior security even with PGP layered on top of it. Signal was designed for long-term asynchronous conversations; if you can use PGP, you can use Signal. Use Signal instead.
Second, how much security does this provide and against what? For example, Moxie said once that Signal was designed to be usable and prevent mass surveillance, but not necessarily to prevent targeted attacks (my paraphrasing);[0] civil rights activists can expect targeted attacks.
Finally, the public needs real security professionals to do the work and provide a reliable, authoritative, updated guide - including pointing out where in the technology/solution stack we need better solutions. There are many guides out there, some cited below; like all the other unreliable information on the Internet, some are obviously flawed, some are flawed in ways that few will notice. There is no alternative to real security expertise. Also, it will need names on it that people know and trust. Crowdfund it; I will happily contribute.
The level of protection you're getting here is from targeted non-state attackers, ambient opportunistic state-level actors, and non-specialist law enforcement. Some of this stuff would have helped Ross Ulbricht (I mean that non-normatively), for instance.
Google "you're gonna get Mossaded" for fuller picture of what we can expect for current state of the art against targeted state-level attackers.
Edit: I presume this is the intended article: https://www.usenix.org/system/files/1401_08-12_mickens.pdf
> 4. Switch to Google Chrome.
Can one configure Chrome to not be a data-sucking kraken?
> 7. Disable cloud-based keychain backups.
That backup is encrypted, I'd hope? So, is the problem that getting hold of a cloud-backup facilitates off-line attacks on the encryption key?
I remember Filippo (FiloSottile here) publishing his encrypted private PGP key [1] (back when he was still positive on PGP). If that's safe, how is this problematic?
> 10. Install a password management application that doesn't store your secrets in the cloud.
Same question as 7. My understanding was that most password manager vulnerabilities have been related to browser integration, so that is the first thing I'd switch off.
[1] https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv...
https://noncombatant.org/2014/03/11/privacy-and-security-set...
There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium, no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle.
I use the browser integration for 1Password on OS X (I might not if I was on Windows). I'm generally not that worried about localhost privilege escalation. I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser.
KISS: keep your secrets out of cloud systems and your backups offline.
If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.
I think you're overstating this a bit. You have to be comfortable at a UNIX command line. Surely that alone doesn't qualify someone as "very sophisticated"?
Since Chromium does not upgrade itself, do you happen to have a suggestion on how to be arrange to be notified when a new patch is released?
In that case, why 1password over keepassx?
Or to put it another way, an organization that relies on technical means to maintain secrets is still subject to infiltration. Wikileaks shows how readily organizations with dedicated and expert security staff and meaningful budgets are compromised by lack of or weak compartmentalization. A Snowden knockoff just walks out the door with a thumb drive of documents and hands it over to people who aren't supposed to have access bypassing NSA level security. And that's in an environment where people are rigorously vetted, not one looking for volunteers to the cause.
If I have an issue with the answer, it's that it conceives of an adversary who is 'just like us'. But plant a bug. Tape a cell phone to a car. Hire a honeypot. All will bypass an iPhone and disk-encryption and the local police can do any of them legally with a little effort and just about anyone with a will and a few hundred dollars can do them illegally with even less effort. And in the political realm there are lots of people with lots of will and more than a few hundred dollars at risk.
I assume Android is a bad idea because of the ease of picking up spyware and the privileges that such software can have once downloaded?
What's the best way to secure your web browsing & search history? Being an ex-Googler, I can think of a couple things to do - don't sign in to Chrome, turn off your Web & App activity, turn off location history and don't grant permissions to use the location service - but I'm curious what the non-Google threats would look like (honestly, I don't believe Google is your biggest threat for a freedom activist).
What would you recommend for sharing documents, source code, or other permanent work/organizing products?
[0] https://arstechnica.com/security/2016/07/androids-full-disk-...
You can learn more about it at https://www.secfirst.org or download it from Google Play:
https://play.google.com/store/apps/details?id=org.secfirst.u...
You can also reuse our Creative Commons content and check out our code at https://www.github.com/securityfirst
Color me surprised, but wasn't Apple involved with PRISM. Gives me reason enough to believe they maybe in on similar programs given there have been no drastic changes to their policy and whatnot
Apple was (and is) compliant in the "release customer details with a court order" thing, which it seems is part of the PRISM data.
However, there was a second part, where the NSA got bulk access to communications without a court order. It is unclear which companies were complicit in this part. We know Google wasn't (because the NSA slide decks show how they had to intercept Google's inter and intra-data center links which were unencrypted at the time - and Google undertook a crash program to fix that).
Apple's statements are pretty clear: they say they only release information with a court order. That means they weren't complicit in bulk collection - but they may have been hacked at the time like Google was.
The press cycle around the Snowden declarations made it seem like the big tech companies were in bed with the government, but honestly they hated it as much as you did, and in many cases the programs had different names within the NSA from when they interfaced with the companies involved, or were done entirely without knowledge of those companies.
I suspect they weren't complicit in being involved in PRISM, but maybe that's just me hoping.
That's far from a random mistake..
I'll see if I can dig it up.
https://www.engadget.com/2014/10/31/court-rules-touch-id-is-...
Can you elaborate a bit? You mean "don't use any file sharing program" like SpiderOak and the like, or specifically Dropbox?
You want to be using a messenger based on Signal Protocol, no matter what. Nobody has thought more carefully about cryptographic messaging protocols than Trevor Perrin and Moxie.
It's good to have two secure messengers, one that favors usability and has a large user base, and one that can function as a laboratory for strictly secure UX.
The very secure messenger you should have should be Signal; as Trevor and Moxie and their team devise new cryptographic protections for things like contact lists and file transfers, you'll get them through Signal.
The more usable messenger should be WhatsApp or Wire. I don't have strong opinions about which; mostly, I'm just saying there's no other Signal-based messenger I trust at all.
Whatever you do, don't use Telegram.
Citation needed.
OP used to own/manage a world-class security consulting firm in Chicago, and now runs the entire security team for several decent-sized startups. His expertise is the citation.
We should instead ask for evidence that IOS provides better security than any other alternative for activists.
1. IPhone is closed source and any kind of rootkit can be installed by Apple/NSA secret court system. I suggest not using a smartphone if you are serious about security.
2. Good but difficult to anonymize
3. Good
4. Google Chrome is a botnet effectively and users lose their expectation of privacy there. Should switch to Firefox and use Chromium (Not Chrome) as a backup. Ideally Tor browser though.
5. Why? It's great for sharing encrypted files. Certainly if you trust Apple, why not trust Dropbox?
8. Signal transmits metadata that Google/Apple and by extension NSA/FBI/CIA/DEA know about now. Use something else that protects your anonymity and is secure. Something like cryptocat/Pidgin OTR is better.
9. You can use email to send encrypted information.
10. Unnecessary. Good strong password is good enough and you don't have a centralized password storage app. Another benefit is avoiding all the frustration that comes with using it when you are on someone else's computer.
11. Commercial AVs are better than Microsoft's native solution as repeatedly shown on independent tests. If you are tech literate, you're probably fine with the native solution or no solution at all.
12. Good idea. Best not to have a smartphone at all.
13. That's crazy. Just know your email app. Attachments should be read only and if your software is updated, it's very very unlikely you'll be compromised. If the email isn't signed and you are worried, use an alternative app to open common document formats. PDF.js for PDF, Libre Office for documents.
IPhone is closed source and any kind of rootkit can be installed by
Apple/NSA secret court system. I suggest not using a smartphone if you are
serious about security.
Comments like these are why I have a deep frustration with the "security community". It's letting the perfect be the enemy of the good.
We are talking activists facing state-sponsored attackers, where "good" security is not enough.
Meanwhile, as mentioned elsewhere, Android is vulnerable to several key-extraction techniques and the speed of security updates depends on which model you have.
This is why Snowden wanted people to put their phones in the freezer to avoid eavesdropping: https://thelede.blogs.nytimes.com/2013/06/25/why-snowdens-vi...
1. Get an iPhone and use it in preference to your computer.
2. Enable "code-generating" or "authenticator app" 2FA on all your accounts, particularly email (this is called "TOTP").
3. Disable SMS 2FA on any account wherever you're using real 2FA.
4. Switch to Google Chrome, which is significantly more resilient against vulnerabilities than either Safari, Firefox, or IE.
5. Don't use Dropbox.
6. Enable your OS's built-in full-disk encryption (this is FileVault on a Mac, BitLocker on Windows).
7. Disable cloud-based keychain backups (OS X will ask you to opt-in when you configure your phone or laptop the first time; Windows will make you go out of your way to do it).
8. Install Signal and either WhatsApp or Wire on your iPhone. Use Signal when you can, and fall back to the less strict alternative app when you can't.
9. Don't use email to send sensitive information, full stop.
10. Install a password management application that doesn't store your secrets in the cloud. I recommend 1Password. Better though to rely on 2FA than on a password manager.
11. Do not use antivirus software, other than Microsoft's own antivirus software on Windows.
12. Turn off cloud photo backups and location sharing for your camera.
13. Don't accept or click on email attachments, or allow your peers to send email attachments.