Security

Security is a broad term covering everything from stopping your mother from finding your porn folder to stopping the NSA from breaking into your nuclear power plant.

In our post Snowden world it's easy to fall into security nihilism (i.e. "'they' know everything so why bother?") or to think you have nothing to hide.

The worst thing you can have is a false sense of security.

This page cannot possibly define every attack and mitigation strategy available. Instead it aims to provide a decent overview of basic security principles and techniques.

Define Your Adversary

Who/What do you want to have security from? Who/What is a threat to you? Who/What do you want to keep things private from?

• You mother?
• Thieves?
• Hackers, Viruses, Malware and Phishing?
• Advertisers/Marketing companies who build profiles on you to sell you garbage?
• Rivals and rival businesses?
• Government policies you don't agree with and wish to legally avoid?
• Foreign government policies you don't agree with?
• Copyright trolls?
• Local Law Enforcement Agencies (LEA)?
• National Law Enforcement Agencies?

or perhaps you wish to:

• Publish anonymously?
• Keep journalistic sources safe?
• Participate in whistleblowing?

or are you under attack from:

• Psycho ex-partners/family members?
• Internet trolls/doxxers?

or maybe you just want to:

• Be as secure as possible as a fun experiment?

Knowing your "enemy" is important. Thinking in terms of NSA technology is depressing, but narrowing your threat down to advertising trackers makes the battle seem much more practical and winnable.

Security Tools and Practices

Against Your Mother

Your mother can:

• Physically access your computer.
• Physically access your computer when you're not there.
• Spy over your shoulder.

These can be serious security implications, however your mother is unlinkely to either:

• Have the technical knowledge to perform an attack.
• Have the motivation to perform an attack.

All your mother is likely to do is walk past when you're masturbating, or perform a Windows Search for her cat photos and accidentally turn up your hentai.

In response, you can:

• Lock the door to your basement.
• Zip/rar/7z your porn with a password.
• Encrypt your home directory.
• Put a password on your bios and deny her booting your computer.

Against Thieves

Thieves can:

• Physically steal your computer and deny you access to your data.
• Remove the storage drive from your computer and recover data.

While common burglars are unlikely to have the technical knowledge to remove your storage devices and run tools against them, they are likely to give your hardware to their "nerd" friend, or ebay/pawn your hardware off. Where it ends up from there is anyone's guess and whatever nudes you've taken will likely end up on a chan.

In reponse you can:

• Encrypt your home directory.
• Use Full Disk Encryption.
• Backup your data and phsyically hide it.

Against Hackers, Viruses, Malware and Phishing

Assuming hackers here are your run of the mill script kiddies and not nation states, hackers can:

• Use Remote Exploits to access your computer (hacking your computer).
• Trick you into running exploits on your computer (viruses, malware).
• Trick you into disclosing the credentials to your computer or web services (phishing).
• Guess the credentials to your computer or web services (cracking).
• Break into web services and determine your credentials (hacking web services).

While hackers will always know about security problems before everyone else, they are less likely to use their brand new exploits against random people. High value targets (whether they be financial (paypal?), political (fbi website?) or lulzy (the fappening)) are much more likely to be their focus.

Day to day attacks will be from relatively unskilled hackers (script kiddies) and deployed against ip address on the internet.

Occasionally a large internet service will lose it's password database to hackers e.g. twitch.tv. Sooner or later one of these headline hacks will affect you.

In response you can:

• Keep your operating system and software up to date to cut down on remote exploits.
• Use anti-virus and anti-malware scanning software.
• Be wary about running unknown software or logging into untrusted sites (common sense 2015).
• Run a restrictive firewall to allow only certain applications access to the network.
• Use a password manager to generate random, secure passwords for your local computer accounts and web services.
• Use a password manager to have different passwords on every web service you use.
• Only use trusted web services, and give them as little sensitive data as possible.
• Use Two Factor Authentication (2FA) for higher value web services (banking, email).

Advertisers/Marketing Companies

Advertisers can:

• Collect information when you login to them.
• Track you across different websites you visit without logging into them.
• Track you via GPS on your phone.
• Track you online via WiFi on your phone.
• Track you offline via WiFi on your phone.
• Track you offline via credit/debit cards.
• Track you offline via reward/membership cards.

Some of the security (or privacy) threats with advertisers are opt-in (i.e. you accepted it) and generally advertiser tracking isn't going to mess up your day. Problems arise when advertisers sell your information on to third parties (who in turn sell it to other third parties), go broke and auction off your data, get hacked or are victims of mass surveillance.

It's worth noting that their revenue models would be colosally damaged if everyone ran adblocking software.

In response you can:

• Not create social media accounts, or create accounts with false information (although you'll still have the same friends, so are still opting in big time).
• Disable third party cookies in your browsers.
• Turn off GPS on your phone, or use a custom rom to limit which apps have access to your GPS.
• Turn off WiFi on your phone, or use a custom rom to limit which apps have access to WiFi.
• Turn off WiFi when you're out and about, especially in malls/shopping centres.
• Use cash.
  • Debit cards tell your bank what you're buying and who from and where, and they sell that.
  • Credit cards tell VISA/Mastercard/etc what you're buying and who from and where.
• Don't use reward cards. Most people never use the "rewards" and your privacy is worth more.

But I've Already Given Them Everything!

So you've already given Facebook your phone number and address and date of birth? They already know your schools and job and hobbies? Why close the gate when the horse has bolted?

• You'll change jobs.
• You'll move house.
• Your interests will change.
• Your friends will change.
• You'll get married/divorced/have children.
• You could even change your name or get married and change your surname.

Sure, the data they have today will still be valid in a week. But in six months? A year? Five years? The sooner you cut off advertisers from up to date information, the sooner it'll be out of date. Their databases will say you still like Linkin Park and Jackass unless you tell them otherwise. They'll also miss out on your patterns over time, not knowing the path of your history and making their future predictions inaccurate.

Government Policies to Legally Avoid

Governments can:

• Collect metadata or "full take" internet data.
• Force ISPs to block websites or internet services.

In response you can:

• Use a Virtual Private Network (VPN)
  • These can be paid or free services. Don't trust free services to anything other than light trolling.
  • These can be based in a variety of countries and be bound by that country's laws, even though they have exits in multiple countries.
  • Some take your privacy more seriously than others. Ultimately it's down to you trusting their word, but do your homework and make an informed choice.
• Use an anonymity network such as Tor (free, trustable).
• Use a proxy for web browsing (free, perhaps trustable, perhaps not).
• Use encrypted messaging when communicating with others.