News for hackers. Stuff that matters.
Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Sunday February 12, 2017 @08:57AM (#13628313)
Hey everyone. Apologies for the blatant plug but seeing as we are talking about security precautions for non-profits and journalists, it's probably relevant...

We build a tool specifically to help non-profits and journalists learn about and manage their digital and physical security on the move. It's called Umbrella App. It's free, open source, on Android and contains tons of lessons on privacy related issues like digital and physical security. Umbrella has everything from how to do basic stuff like communicate with basic tools like Signal to sending a secure email with PGP. However, the unique bit is we also have stuff on the physical side, like how to plan travel, cross borders, set-up a secure physical meeting, deal with detecting surveillance, covering a protest, respond to a kidnapping etc. Basically we have tried to make it a bit of a one-stop-shop for security for regular people, activists, refugees and journalists. We also pull security feeds from places like the UN, Centres for Disease Control etc - which is obviously very important to folks in places like Syria or affected by Zika/Ebola.

There’s tons of really relevant stuff in it, especially for those now mobilising for the first time on some issues. Loads of people are writing guides that solve small parts of the puzzle but we have tried to provide the whole picture in the one place.

Google Play Store: https://play.google.com/store/apps/details?id=org.secfirst.u...

Amazon App Store: https://www.amazon.com/Security-First-Umbrella-made-easy/dp/...

F-Droid Repo: https://secfirst.org/fdroid/repo

Github Repo: https://github.com/securityfirst

Code Audit: https://secfirst.org/blog.html

Hope some folks here find it useful/interesting!

Ends blatant plug

Re:Basic Security Precautions for Non-Profits and Journalists by idlewords on Sunday February 12, 2017 @12:11PM (#13629262)
Please get this vetted by real security people. The fact that you mention PGP suggests to me you haven't.
Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Sunday February 12, 2017 @02:48PM (#13630237)
How can a standard guide to installing and using PGP through various different methods be a security issue?
Re:Basic Security Precautions for Non-Profits and Journalists by idlewords on Sunday February 12, 2017 @05:38PM (#13631481)
Because people should not be using PGP for secure messaging.
Re:Basic Security Precautions for Non-Profits and Journalists by codelitt on Sunday February 12, 2017 @07:36PM (#13632166)
PGP isn't user friendly, but from the Snowden leaks we learned it is one of the few encryption standards the NSA hasn't been able to break. TLS and most configs of VPN protocols were shown to be easily compromised. PGP was basically shown to be a show stopper.

1. http://m.spiegel.de/international/germany/a-1010361.html

Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Sunday February 12, 2017 @07:58PM (#13632278)
Agreed. It has many problems but it's still one of the only games in town.
Re:Basic Security Precautions for Non-Profits and Journalists by willstrafach on Monday February 13, 2017 @03:27PM (#13638450)
> TLS and most configs of VPN protocols were shown to be easily compromised.

This is a major claim to be making, and it is false. It is not helpful to spread misinformation like this.

Re:Basic Security Precautions for Non-Profits and Journalists by codelitt on Monday February 13, 2017 @03:57PM (#13638696)
Easily was, perhaps, not the correct adverb, but the linked article above as well as this one below go into it more. It does not appear to be false.

http://www.theverge.com/2014/12/28/7458159/encryption-standa...

Bruce Schneier has said while large government actors may be able to exploit it, it's still recommended: https://www.theguardian.com/world/2013/sep/05/nsa-how-to-rem...

Re:Basic Security Precautions for Non-Profits and Journalists by willstrafach on Monday February 13, 2017 @05:22PM (#13639348)
Perhaps older versions of SSL, but there is no evidence that anyone has compromised TLS.

There is evidence that encrypted traffic was stored and research was done on the metadata of these connections but that is no surprise. That may be what they were referring to.

Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Monday February 13, 2017 @06:26PM (#13639839)
Also, threat models are important here...not everyone includes needs to include the five eyes as your threat model.
Re:Basic Security Precautions for Non-Profits and Journalists by codelitt on Tuesday February 14, 2017 @07:45AM (#13643118)
Of course. I am just using it as a yardstick for security strength.
Re:Basic Security Precautions for Non-Profits and Journalists by TillE on Sunday February 12, 2017 @08:24PM (#13632409)
I really think you're vastly exaggerating the difficulty of using PGP properly. With Enigmail and a small sheet of instructions, anyone slightly computer literate should do fine.

And there simply aren't any better alternatives for encrypting emails or files for transmission. I'd love to be wrong about that, but I haven't seen anything.

Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Monday February 13, 2017 @07:45AM (#13634828)
Agree, that's why we have it in. Even things like Mailvelope, can make it easier for a semi-technical user.
Re:Basic Security Precautions for Non-Profits and Journalists by secfirstmd on Sunday February 12, 2017 @07:17PM (#13632070)
On what grounds? on what threat models? on what attacks? what alternatives?