10 ms·

Distilling tips down for regular users who don't use SSH or are intimidated by compiling KeePassX for Linux themselves, my tips would be: 1. Use a user-friendl

by nikcub 10y ago

Distilling tips down for regular users who don't use SSH or are intimidated by compiling KeePassX for Linux themselves, my tips would be: 1. Use a user-friendly password manager like Dashlane or 1password with a long unique password and a second factor (that isn't SMS based). Password re-use is the #1 way accounts are being compromised at the moment and there are now good password managers that are easy to use with a low barrier to entry 2. Use an extensive ad blocker like uBlock Origin and use multiple profiles in your browser to separate your serious accounts like webmail and banking from general web browsing. The other common way of being exploited is drive-by malware and web-based exploits. A combination of blocking third-party content and separating your browsing profiles will prevent a lot of it. Don't feel guilty about blocking ads - most publishers are extremely negligent with what they allow on their sites via ad networks. Bonus: switch to Chromium[0] (firefox isn't sandboxed and exploits are too common) (but alert yourself to Chromium updates with an IFTTT of the release blog to <pick your notification method>) or alternatively remove Google, Flash, Java etc. 3. Get a VPN subscription and set it up on your laptop & mobile devices. Seriously, don't use open WiFi networks or shared networks without wrapping your connections in encryption. sslstrip is extremely effective and many apps either don't verify/authenticate SSL connections or don't pin certificates. IVPN, PIA, the Sophos VPN product - take a pick. 4. Most home routers are super shit and full of holes. Upgrade to a router that supports open firmware and pick one of openwrt, dd-wrt, monowall, pfsense etc. bonus: run an UTM like Untangled (commercial) or Sophos (free up to 50 CALs iirc) 5. Encrypt your stuff - VeraCrypt is a decent TrueCrypt fork but most operating systems now have support for volume encryption - your local disk, USB sticks[1], or a file-based volume. Backups should be to encrypted media 6. Be anonymous - create a disposable email with a fake name to signup to services with. even better sinkhole a random domain name you register. No service outside of banking, insurance, health, etc. really need to know your actual identity details. [0] https://download-chromium.appspot.com/ https://download-chromium.appspot.com/ [1] http://www.theinstructional.com/guides/encrypt-an-external-disk-or-usb-stick-with-a-password http://www.theinstructional.com/guides/encrypt-an-external-d...

akandiah 10y ago
Instead of a VPN subscription, I'd recommend a self-managed VPN solution. One can easily fire one up thanks to Streisand (https://github.com/jlund/streisand https://github.com/jlund/streisand)
- msh 10y ago
  Well, then you depend on your VPS company. Its important that you dont host any domains on the VPS you run the VPN on. Security might not be top priority at the VPS provider. All your requests come from the same IP address (and the VPN provider might very easily give out your private info). I think a VPN from a reputable provider (like f-secure) is better for most users.
  - tiatia 10y ago
    "Its important that you dont host any domains on the VPS you run the VPN on." Why is that is I may ask? I have the impression that the great firewall blacks a lot of domains by default and they are allowed/blocked after a review after somebody tries to access them the first time. I may be paranoid but often I try to open an obscure site. It is blocked. I have to use a VPN. A few days later the site can be accessed. Why not use a VPN sever with a nice website that makes it look harmless?
    - msh 10y ago
      I see three issues: - You might forget private whois and expose your identity. - There might be issues with the private whois that exposes your identity. - The contents of the website might expose you.
  - pavel_lishin 10y ago
    You could set up a box at home to route through.
    - msh 10y ago
      Not if its your home connection you want to protect.
tombrossman 10y ago
Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos? I haven't checked Arch or other distros but KeePassX is a widely used and active project, and I suspect it is available in many package managers. I wasn't aware that people were having to compile it from source (and I agree this would be more intimidating to new users).
- nikcub 10y ago
  > Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos? It's in the OP: "I highly recommend using KeepassX as a password manager, secured using a key file and not a password. Also, you should download the source code, compile it (using a Linux machine) and always look over the source code for rogue functions, you CANNOT afford a vulnerability inside the password manager."
  - tombrossman 10y ago
    Thanks, I saw that but was hoping people would not actually bother - that's deep into 'tinfoil-hat' territory. If you are already running a Linux distro and trusting the repos for OS updates, it isn't a big stretch to assume their build of the password manager is exactly as safe as the OS updates, and trusting one but not the other is pure folly.
    - wallace_f 10y ago
      This is also exactly my intuition here, but I'm hoping for others to comment here as well.
    - slavik81 10y ago
      KeypassX 2.0 was in alpha for years (though I never noticed a bug). I don't think it was available in distribution packages until quite recently. That being said, I'm decent with C++, and yet auditing its code is a little daunting.
  - fauigerzigerk 10y ago
tiatia 10y ago
1. Honestly I made bad experiences with PW managers. After having a corrupted PW database a couple of times I stopped using them. 2. I do that. In addition I use this: http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm I have a python script that builds a host file from several sources. 4. Most readers here should be able to build their own router with a banana pi and IPfire
- nikcub 10y ago
  I completely agree re: password managers. Lots of options and competition but nobody has yet really, really nailed it. I eventually got many not-so-technical family members and friends to adopt Dashlane - which is easy to use and provides great support. > 2. I do that. In addition I use this: http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm That's a good idea - you can also configure a local bind/dnsmasq/unbound server to block based on these lists with ACL's (sure if you google each you'll find tutorials, like this one: https://github.com/jodrell/unbound-block-hosts https://github.com/jodrell/unbound-block-hosts) Some of the better home router distros will also do this at the local network level
  - robinhood 10y ago
    > nobody has yet really, really nailed it. I don't see how you could do better than something like 1Password. What is missing in your opinion?
    - watersb 10y ago
      1Password relies upon a single, strong password for your "vault", which is vulnerable to sniffers and intermittent surveillance. I don't understand why they don't offer (at least) 2-factor key for the vault. Also, they support TouchID on iOS devices, very useful. But in the US, at least one case of someone being legally required to unlock via TouchID, whereas offering up a passcode is still debatable. So at least offer a short PIN-and-TouchID, and support some 2-factor like Googly Authenticator. They must have at least considered these things. I don't understand any security issues with this. Implementation is work, and perhaps a support hassle for them. What are the technical reasons?
ryanlol 10y ago
>Password re-use is the #1 way accounts are being compromised at the moment and there are now good password managers that are easy to use with a low barrier to entry What accounts? At least for financial fraud this is certainly not true, phishing remains #1 by far. I'd also hazard to guess that botnet logs result in far more hijackings than password reuse.
- nikcub 10y ago
  Actually you're right - it's malware #1 and then password resuse somewhere down the line. The reuse issue was just fresh on my mind because i've been dealing with it the past few days with the MySpace and LinkedIn dumps.
minionslave 10y ago
What about smartphones? Should I use my real identity or is that safe?
- Idontagree 10y ago
  Safe from who? I think smartphones are some of the least safe things when trying to avoid law enforcement/3 letter organizations. I don't feel they're particularly safe at all really, but I'm sure someone can elaborate more.
TheLML 10y ago
Adding the URL (or application name), or rather part of it, to a secure password also makes for a good way to not use the same password everywhere, imo. In case of not wanting to use a password manager. https://support.mozilla.org/en-US/kb/create-secure-passwords-keep-your-identity-safe https://support.mozilla.org/en-US/kb/create-secure-passwords...
- majewsky 10y ago
  But it's still easily derivable. If someone buys the LinkedIn dataset and finds that your password is "123456linkedin", the next thing he will try is "123456facebook", "123456googlemail" and "123456bankofamerica". It might help against highly automated attacks that don't look at the actual password string, but anything involving a human hacker will be as bad as the same password reused.
  - TheLML 10y ago
    Is it likely that someone is actually going to look at your password in a breach that may contain several million accounts? On top of that, if it even gets cracked (if it was stored and encrypted properly in the first place). If you're really personally targeted, then I agree with you. But for a casual person it's probably an easier thing to convince them of doing this instead of installing a password manager.
iki23 10y ago
regarding a secure router, the .cz tld operator cznic (authors of knot dns) are building high-security high-performance opensource hw/sw router (coming in October) https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router https://www.indiegogo.com/projects/turris-omnia-hi-performan... https://www.turris.cz/en/ https://www.turris.cz/en/
CJKinni 10y ago
> even better sinkhole a random domain name you register What does this mean? I've tried to figure it out from context, the article, and a quick google search, but It's not clear how dns sinkholing is going to help me stay secure.
- Idontagree 10y ago
  Pretty sure he means take a domain you've registered and use it for anonymous e-mail thus making it so you can't use it for anything personal in the future since it can be connected back to your anonymous email.
kobayashi 10y ago
Your comment is the first time I've ever read someone recommending a browser over Firefox (when discussing security and privacy). I find it even more surprising because you're recommending possibly highly unstable Chrome/Chromium releases. I'd like to hear more from you and the HN community on this topic. Firefox seems to be the only browser in which one can maintain privacy and security (e.g. all the privacy tweaks from privacytools.io). Chrome doesn't allow for most of the tweaks, for example WebRTC can't be disabled.
- redwards510 10y ago
  not to mention, many Chrome extensions are completely compromised by adware/malware and sniff your traffic. The only one I trust is uBlock Origin. Firefox addons have somehow managed to avoid this fate. Also, Firefox has the best security addon, NoScript.
  - Spivak 10y ago
    Don't forget Policeman and uMatrix for alternative content and script blockers.
    - kobayashi 10y ago
      Might I also add, Random Agent Spoofer, Decentraleyes, and Web of Trust
      - corndoge 10y ago
        FWIW, uMatrix includes randomized user agent spoofing.
        kobayashi 10y ago
        It doesn't appear to work properly. I read a thread on Gorhill's Github page and the whole thing seemed really convoluted. I activated the function but when I tested it my UA wasn't spoofed. Also, the list from which to choose/randomly assign is pretty short, though I think Gorhill made it so by design.

by nikcub 10y ago

akandiah 10y ago

Instead of a VPN subscription, I'd recommend a self-managed VPN solution. One can easily fire one up thanks to Streisand (https://github.com/jlund/streisand https://github.com/jlund/streisand)

msh 10y ago
Well, then you depend on your VPS company. Its important that you dont host any domains on the VPS you run the VPN on. Security might not be top priority at the VPS provider. All your requests come from the same IP address (and the VPN provider might very easily give out your private info). I think a VPN from a reputable provider (like f-secure) is better for most users.
- tiatia 10y ago
  "Its important that you dont host any domains on the VPS you run the VPN on." Why is that is I may ask? I have the impression that the great firewall blacks a lot of domains by default and they are allowed/blocked after a review after somebody tries to access them the first time. I may be paranoid but often I try to open an obscure site. It is blocked. I have to use a VPN. A few days later the site can be accessed. Why not use a VPN sever with a nice website that makes it look harmless?
  - msh 10y ago
    I see three issues: - You might forget private whois and expose your identity. - There might be issues with the private whois that exposes your identity. - The contents of the website might expose you.
- pavel_lishin 10y ago
  You could set up a box at home to route through.
  - msh 10y ago
    Not if its your home connection you want to protect.

tombrossman 10y ago

Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos? I haven't checked Arch or other distros but KeePassX is a widely used and active project, and I suspect it is available in many package managers. I wasn't aware that people were having to compile it from source (and I agree this would be more intimidating to new users).

nikcub 10y ago
> Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos? It's in the OP: "I highly recommend using KeepassX as a password manager, secured using a key file and not a password. Also, you should download the source code, compile it (using a Linux machine) and always look over the source code for rogue functions, you CANNOT afford a vulnerability inside the password manager."
- tombrossman 10y ago
  Thanks, I saw that but was hoping people would not actually bother - that's deep into 'tinfoil-hat' territory. If you are already running a Linux distro and trusting the repos for OS updates, it isn't a big stretch to assume their build of the password manager is exactly as safe as the OS updates, and trusting one but not the other is pure folly.
  - wallace_f 10y ago
    This is also exactly my intuition here, but I'm hoping for others to comment here as well.
  - slavik81 10y ago
    KeypassX 2.0 was in alpha for years (though I never noticed a bug). I don't think it was available in distribution packages until quite recently. That being said, I'm decent with C++, and yet auditing its code is a little daunting.
- fauigerzigerk 10y ago

tiatia 10y ago

1. Honestly I made bad experiences with PW managers. After having a corrupted PW database a couple of times I stopped using them. 2. I do that. In addition I use this: http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm I have a python script that builds a host file from several sources. 4. Most readers here should be able to build their own router with a banana pi and IPfire

nikcub 10y ago
I completely agree re: password managers. Lots of options and competition but nobody has yet really, really nailed it. I eventually got many not-so-technical family members and friends to adopt Dashlane - which is easy to use and provides great support. > 2. I do that. In addition I use this: http://winhelp2002.mvps.org/hosts.htm http://winhelp2002.mvps.org/hosts.htm That's a good idea - you can also configure a local bind/dnsmasq/unbound server to block based on these lists with ACL's (sure if you google each you'll find tutorials, like this one: https://github.com/jodrell/unbound-block-hosts https://github.com/jodrell/unbound-block-hosts) Some of the better home router distros will also do this at the local network level
- robinhood 10y ago
  > nobody has yet really, really nailed it. I don't see how you could do better than something like 1Password. What is missing in your opinion?
  - watersb 10y ago
    1Password relies upon a single, strong password for your "vault", which is vulnerable to sniffers and intermittent surveillance. I don't understand why they don't offer (at least) 2-factor key for the vault. Also, they support TouchID on iOS devices, very useful. But in the US, at least one case of someone being legally required to unlock via TouchID, whereas offering up a passcode is still debatable. So at least offer a short PIN-and-TouchID, and support some 2-factor like Googly Authenticator. They must have at least considered these things. I don't understand any security issues with this. Implementation is work, and perhaps a support hassle for them. What are the technical reasons?

ryanlol 10y ago

>Password re-use is the #1 way accounts are being compromised at the moment and there are now good password managers that are easy to use with a low barrier to entry What accounts? At least for financial fraud this is certainly not true, phishing remains #1 by far. I'd also hazard to guess that botnet logs result in far more hijackings than password reuse.

nikcub 10y ago
Actually you're right - it's malware #1 and then password resuse somewhere down the line. The reuse issue was just fresh on my mind because i've been dealing with it the past few days with the MySpace and LinkedIn dumps.

minionslave 10y ago

What about smartphones? Should I use my real identity or is that safe?

Idontagree 10y ago
Safe from who? I think smartphones are some of the least safe things when trying to avoid law enforcement/3 letter organizations. I don't feel they're particularly safe at all really, but I'm sure someone can elaborate more.

TheLML 10y ago

Adding the URL (or application name), or rather part of it, to a secure password also makes for a good way to not use the same password everywhere, imo. In case of not wanting to use a password manager. https://support.mozilla.org/en-US/kb/create-secure-passwords-keep-your-identity-safe https://support.mozilla.org/en-US/kb/create-secure-passwords...

majewsky 10y ago
But it's still easily derivable. If someone buys the LinkedIn dataset and finds that your password is "123456linkedin", the next thing he will try is "123456facebook", "123456googlemail" and "123456bankofamerica". It might help against highly automated attacks that don't look at the actual password string, but anything involving a human hacker will be as bad as the same password reused.
- TheLML 10y ago
  Is it likely that someone is actually going to look at your password in a breach that may contain several million accounts? On top of that, if it even gets cracked (if it was stored and encrypted properly in the first place). If you're really personally targeted, then I agree with you. But for a casual person it's probably an easier thing to convince them of doing this instead of installing a password manager.

iki23 10y ago

regarding a secure router, the .cz tld operator cznic (authors of knot dns) are building high-security high-performance opensource hw/sw router (coming in October) https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router https://www.indiegogo.com/projects/turris-omnia-hi-performan... https://www.turris.cz/en/ https://www.turris.cz/en/

CJKinni 10y ago

> even better sinkhole a random domain name you register What does this mean? I've tried to figure it out from context, the article, and a quick google search, but It's not clear how dns sinkholing is going to help me stay secure.

Idontagree 10y ago
Pretty sure he means take a domain you've registered and use it for anonymous e-mail thus making it so you can't use it for anything personal in the future since it can be connected back to your anonymous email.

kobayashi 10y ago

Your comment is the first time I've ever read someone recommending a browser over Firefox (when discussing security and privacy). I find it even more surprising because you're recommending possibly highly unstable Chrome/Chromium releases. I'd like to hear more from you and the HN community on this topic. Firefox seems to be the only browser in which one can maintain privacy and security (e.g. all the privacy tweaks from privacytools.io). Chrome doesn't allow for most of the tweaks, for example WebRTC can't be disabled.

redwards510 10y ago
not to mention, many Chrome extensions are completely compromised by adware/malware and sniff your traffic. The only one I trust is uBlock Origin. Firefox addons have somehow managed to avoid this fate. Also, Firefox has the best security addon, NoScript.
- Spivak 10y ago
  Don't forget Policeman and uMatrix for alternative content and script blockers.
  - kobayashi 10y ago
    Might I also add, Random Agent Spoofer, Decentraleyes, and Web of Trust
    - corndoge 10y ago
      FWIW, uMatrix includes randomized user agent spoofing.
      - kobayashi 10y ago
        It doesn't appear to work properly. I read a thread on Gorhill's Github page and the whole thing seemed really convoluted. I activated the function but when I tested it my UA wasn't spoofed. Also, the list from which to choose/randomly assign is pretty short, though I think Gorhill made it so by design.