17 ms·

Basic Security Precautions for Non-Profits and Journalists

195 points by idlewords 10y ago

RRRA 10y ago
So, no Android phones is not very pragmatic... Any justifications? (Especially without saying to use only FOSS OS)
- eropple 10y ago
  The security situation on Android is, full-stop, a tire fire. Be it the existence (at all) of external storage that badly-considered applications happily write sensitive stuff to (and for a journalist, your photos are sensitive) to the general mess that is Android application permissions (even in newer versions) to the slapdash, inconsistent way that updates get pushed to devices. It's all bad, and if you care about security, you should not use Android, no exceptions. As it happens, I use an Android phone as a daily driver. But I'm not a journalist and I'm not handling data that isn't sensitive to anyone but myself. I'm willing to take that risk (edit: and I'm able to, to a level I'm comfortable with, mitigate those risks, which a non-technical person probably can't evaluate safely, to say nothing of implement). But I'm not a journalist whose sources may depend on me.
- jsjohnst 10y ago
  I agree it's overly broad statement without justification, but it's not entirely unfounded either. iOS's extreme walled garden does protect you from many things that Android doesn't. As another commenter mentioned, security permissions are a mess, malware is a real thing, and the power and versatility of Android leaves you very vulnerable if you're in a high risk profession who must keep secrets safe.
  - 0000anonymous 10y ago
    again copperheados... this guide has many bad directions
  - tptacek 10y ago
    Very few of the items in here have justifications listed, because that's not productive for the intended audience. They don't want to know "why" any more than most patients want to know "why" their doctor prescribes one antibiotic versus another.
    - projektir 10y ago
      Even if your intended audience doesn't care about the why, you must necessarily provide justification so that another audience, which would want to make sure that you're not selling snake oil, could verify your why. Knowledge sharing only really works when there's a vetting process on some level.
      - tptacek 10y ago
        No, that's not how it works. The guide itself doesn't need to be bulletproofed against zany accusations that the authors are selling snake oil; there are other ways to accomplish that without crudding the recommendations themselves up with verbiage to placate angry nerds.
        projektir 10y ago
        I didn't say anything about bulletproofed, just explained. Right now, there's no explanation, and I'm asking for some justification, how are you getting "bulletproofing" from that? I didn't say the authors are selling snake oil. But if a person doesn't know much about a subject, they may not be able to tell, and they should be suspicious. They might want to see a review or criticism of it. They might want to verify that it's well intentioned, especially on a sensitive subject such as this. There's nothing zany about that, it's common sense. If I find some information source that presents itself as an arbiter of truth, but has no justification for its points, I cannot in good faith recommend it to anyone. The only angry one here seems to be you, with many unnecessarily rude responses that do not at all inspire confidence.
        tptacek 10y ago
0000anonymous 10y ago
dont use android?? copperheados?? hello? sure sounds bias to me. and no u wouldnt use gmail, u would use something non fourteen eyes. like protonmail or ur own pgp enigmal with riseup. u wouldnt even use social media. this is ridicules. whatsapp? really? after all the extreme crap they got caught with? how about u advise signal, silence, or xmpp options out there. chromebook?...tails...whonix....librem 15.... qubesos... lets get real here...
- eropple 10y ago
  As far as Android goes: who's auditing CopperheadOS? What white hats are looking at it and trying to compromise it so that it can be improved? What's their rep, what's their record, and how do they stack up against iOS's internal and external security tests? As far as "ur own pgp enigmal with riseup" goes: how are you going to get people to email you? Are you, a journalist, going to manage SPF/DKIM and make sure you're doing it right? How are you going to manage antispam? Gmail is not perfect--but unless the totality of your threat model includes getting black-bagged because an NSL found encrypted emails in your inbox, it is probably the best option. (Protonmail is fine too, but increases friction--and increased friction increases the likelihood that you're not going to use it, falling back to easier tools.) WhatsApp: either that or Signal are fine (and, indeed, run the same protocol!). XMPP relies largely on federation, which relies on federated servers not being compromised, so no, that's out. (I haven't looked at Silence, can't speak to it.) Chromebooks are a decent option for some use cases, unless (as more and more journalists tend to do) you need something that can easily and effectively edit audio and video. Tails/Whonix/especially-Qubes are not because people need their stuff to actually work and to not spend more of their time fighting their computer than doing their jobs; to that end, a properly patched OS X is a pretty reasonable call. "Getting real here" means finding a workable place on the do-your-job/security curve, and most of what you're saying is not. For example, of course you would "use social media", because that's a large part of the job of a journalist in 2017. Your recommendations, while (I assume) in good faith, indicate a willingness to invest more time in fighting your stuff than doing your job. Nobody else cares. Recommend what's easy and what gets 95% of the way there (and not, as with something like CopperheadOS, actually detracts).
  - 10y ago
ploggingdev 10y ago
Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the persons devices always be in visibility or do the CBP officers handle them in separate rooms? Assuming I have to carry my laptop and phone across the border, what precautions can I take to minimize the potential privacy violations? After crossing the border, do I just reinstall my OS of choice (Ubuntu) from scratch and reset all passwords? Regarding the browser recommendation, why is Firefox not recommended? It's used in the Tor browser and I have not heard of any major security incident recently with Firefox.
- eropple 10y ago
  Border patrol cannot force you to divulge a PIN or password. They can force you to apply your fingerprint. Look elsewhere in this thread for "why not use an Android device." Don't carry your work devices across the US border because they may be taken, can be taken out of your view, and may be duplicated (and yeah, you should have FDE on your computers etc., but don't take the chance).
  - Buge 10y ago
    The US border patrol cannot force you to give up your password. But other countries (including Canada) can. http://news.nationalpost.com/news/canada/guilty-plea-ends-case-that-pitted-cellphone-privacy-rights-against-border-security-powers http://news.nationalpost.com/news/canada/guilty-plea-ends-ca...
    - tptacek 10y ago
      They might not be able to force that on US citizens, who have an absolute right both to habeas and to enter the country. They can force it on nonresident aliens.
- ENOTTY 10y ago
tptacek 10y ago
Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine, but not workable for the audience these instructions are intended for. We're simultaneously working with the airport lawyer groups (there's a huge one at ORD). It's been jarring to realize how many compromises are required to make things workable for groups of non-experts to use. Just getting software installed is a major hassle, so anything you install or customize needs to be really worth the effort.
- WhitneyLand 10y ago
  What about not using public wifi hotspots?
  - tptacek 10y ago
    I wouldn't, but the instructions here assume the network itself is compromised, so I'm not sure we gain much security by adding another scary-sounding technical requirement.
- fictioncircle 10y ago
  Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.
  - hackuser 10y ago
    What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.
    - fictioncircle 10y ago
lsh123 10y ago
"Use a bluetooth keyboard for easier typing..." Not a good advice for any public place (airports, cafes, etc). Very easy to listen to BT and intercept passwords as user types them in.
- codemac 10y ago
  There are keyboards that force AES-128 and don't fall back IIRC microsoft makes some. A USB keyboard is almost certainly easier to secure though.
- maxerickson 10y ago
  Is there a documented attack on say, Apple's Magic Keyboard? (if it is true that some (relatively modern) bluetooth keyboards are sniffable and some aren't, I'm sure you can convince them to amend the article with specific models that are believed to be better)
  - ENOTTY 10y ago
    I'd second adding recommendations for specific models. There are a lot of BT keyboards on the market of varying quality.
    - tptacek 10y ago
      (I don't in any way own this document). I acknowledge that the situation with Bluetooth peripherals is complicated† and accept that there are probably a bunch of vendors that are unsafe to use. It might be reasonable to simply require Apple peripherals --- not because they're the best, but because Apple is more accountable to peripherals security than most other vendors are. On the other hand, what we can't reasonably do is create a Bluetooth Keyboard Product Guide in a simple set of security recommendations. Not only will it not be effective, but it will discourage the audience, who will fall back to their previous insecure configurations. So I'd ask to what extent we think Bluetooth sniffing attacks on journalists are a spy movie threat. No matter what device they use, simply by using a wireless device as an input, they're exposing those inputs to timing as well. But then, as well, Apple's software update could be targeted too. The basic idea behind the "use a Bluetooth keyboard recommendation" is, I presume, to convince people who would otherwise use computers to do sensitive work to instead use an iDevice. That's a very sound security principle; those iDevices are far more secure than the median fully-functional computer. If I had to pick between telling a journalist to use a random Bluetooth keyboard with an iPad, or use a Macbook or Thinkpad, I would have a hard time deciding, but I think I'd ultimately go with the random Bluetooth keyboard --- there are too many different ways the computer can be undetectably (to a typical user) owned up, and only one fairly elaborate scenario where the BT keyboard will screw them. What I'm learning from working with at-risk normal users is that a lot of security steps we all take for granted are simply not on the table for the people who need security the most. † Way more complicated than the people claiming "Bluetooth keyboards are trivially sniffable" are letting on
pdog 10y ago
> Avoid installing spurious, unknown or unnecessary extensions. This is wrong. You absolutely must use an ad blocker or noscript extension if you intend to browse the web securely.
- tptacek 10y ago
  The guide doesn't say not to install an ad blocker, but I dispute that claim nonetheless. Ad blockers are fine, and probably add marginally to security, but I don't think they a necessity --- if you're using Chrome/Chromium. If I was using Firefox or IE, I would agree with you. But step one here is not to be using un-hardened browsers.
  - dguido 10y ago
    I generally make an exception for HTTPS Everywhere and Google Password Alert when I wrote things like this, but I agree that maybe it's worth it to cut them and simplify the guide. https://chrome.google.com/webstore/detail/password-alert/noondiphcddnnabmjcihcjfbhfklnnep?hl=en https://chrome.google.com/webstore/detail/password-alert/noo... https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp https://chrome.google.com/webstore/detail/https-everywhere/g...
    - tptacek 10y ago
      HTTPS Everywhere would be a win (I'd have to think about whether it's enough of one to earn its place on the list, but if you added it, you could also suggest an ad-blocker --- another issue there though is suggesting ad blockers to journalists gets to a tricky place). GPA is great, but the premise behind this guide is that if you're relying on passwords for Google you're already boned. It's a security win even with TOTP enabled, but I don't think it's enough to earn a spot. These guidelines are being distributed to activists and journalists along with free U2F keys, for whatever that's worth.
      - hackuser 10y ago
        > HTTPS Everywhere would be a win IME, it breaks too many sites to give to all end-users; if the default configuration omitted sites listed as 'Partial'; maybe it would be passable. Maybe have a subcategory for intermediate users and put it there. Novice-level users (for lack of a better term) have no idea why the website is not working, and thus don't even know to consider disabling HTTPS Everywhere. Also, it makes the user easier to identify.
cgb223 10y ago
While iOS devices are generally more secure, its been proven that Apple has been a part of the various NSA programs (X-Keyscore, PRISM, etc). Chromebooks are made by Google, who is also a known partner ni these programs. It all comes down to who you trust, and recommending that Journalists use iOS Devices and Chromebooks made by Apple and Google who are known snoopers is a bad bet if the thing you're trying to avoid is the US Government. Also, bluetooth keyboards are trivial to listen in on. Not a great recommendation. This article is short but bogus.
- tptacek 10y ago
  The people these notes are targeted at are not going to use whatever the vanity "secure" non-Google-infected non-Apple-infected non-Microsoft-infected options you'll have in mind. It's not going to happen. If you want to write a separate set of recommendations for people who spend their lives on Tor, that's fine. These recommendations have to work for people who are barely willing to install software, let along switch to idiosyncratic hardware.
lordofmoria 10y ago
Just a bit of feedback: might be nice to repeat the "Don't" in front of each sentence, even if it's grouped under the heading and therefore repetitive: I found myself being like "wait, it's telling me to backup my messages to google drive? Are they client-side encrypted?"
- amk_ 10y ago
  Yes, I read the article through Readability and it actually stripped out the Do and Don't headers
  - idlewords 10y ago
    Thank you both! I'll fix this.
sachinag 10y ago
It would probably behoove someone to sell these laptops, iPads, and iPhones to journalists, lawyers, and other folks with these configurations. It's a lot easier to give them a pre-configured locked down device that they can't mess with than it is to ask them to actually buy a Yubikey. It won't work for everyone - Slate's CMS is notorious for only working in Firefox, for example - but if Pro Publica is going to hire 30 journalists, then be their vendor.
- tptacek 10y ago
  That's a smart idea. But these instructions are also being given to immigration lawyers and to Muslim rights activists, both of whom have very limited budgets, so vendor isn't a great place to start.
- CM30 10y ago
  Wouldn't this provide a great targt for spies and security services? I mean, maybe I'm being stupid here, but if I was in charge of the NSA and knew that people with sensitive information were buying this gear from a certain vendor, said vendor would be right at the top of the target list. I don't think I'd be able to trust any individual or company selling 'secure devices' for journalists and activists.
  - deleted 10y ago
    [deleted]
projektir 10y ago
Would be helpful to provide alternative to some of the Don'ts. How does one transfer information if they can't transfer anything across the border? Where should one store sensitive information? An encrypted drive you're not supposed to transfer across the border? I'm not really sure what a person is supposed to do with either of those two recommendations, especially if we're saying that person is not tech-savvy. I think these will just be ignored because they don't seem very viable and require a lot of background knowledge and planning. Also, why is Chrome preferred to Firefox? I generally assume Chrome is listened to by Google across the board, and it still lacks something like NoScript. Chrome doesn't seem to do block XSS well, either. Similarly, why Gmail as opposed to, I don't know, something like Protonmail or the like? Safety behind big company, reliability, viability? Why Chromebook and not just a normal Linux? The inherent trust in Google in this list confuses me. And 1password over KeyPass. It seems every cloud-based password manager has been hacked in a round robin fashion, but I guess this solves the other cloud based problem.
- chmars 10y ago
  I also have my doubts about 1Password – although I am still a 1Password users, at least of the old approach (pay once, cloud sync but no web-accessible storage with 1Password). I guess I will have to look for an alternative sooner or later! :(
  - newman314 10y ago
    I use 1Password + Resilio (formerly BTSync) in local sync only mode. It's kind of a pain in the ass sometimes (I can only sync at home) but the upside is no cloud component and it syncs nicely and automatically between multiple machines. For mobile devices, I use the Wifi sync mode.
- tptacek 10y ago
  1. To transfer information across the border, create an encrypted volume, store it on a cloud provider, and download it when you return. Unfortunately, it's more complicated to do this than it should be, so people hoping to do it need individualized instruction. Also, particularly for refugees, there are legal implications to doing this. Ultimately, the simplest recommendation is: don't bring information across the border at all. Go without. 2. Because Chrome is significantly more secure than Firefox. See: rest of thread. 3. Because no email provider is truly safe, and Google's mail service is better defended than virtually any other mail provider. Things like Protonmail are security gimmicks. If you're concerned enough about messaging safety to use some idiosyncratic email provider, you're concerned enough to stop using email for secrets altogether: use Signal, WhatsApp, or Wire. 4. Because a Chromebook is safer for a typical user than Linux, and also because there's a (remote) chance that people might actually use a Chromebook. The security challenges of 2017 are not an opportunity to finally achieve Linux On The Desktop. 5. The list's most contentious recommendation is a rebuke to Google. 6. Standalone 1Password isn't a cloud-based password manager. People should avoid cloud-based password managers.
Accacin 10y ago
I pretty much follow most of these guidelines already, however I do use the Firefox browser and I wasn't aware it was so inseucre compared to Chrome. Is there a nice guide on hardening Firefox security or am I out of luck because of the sandbox situation?
- hackermailman 10y ago
  FF does have a sandbox w/some versions https://wiki.mozilla.org/Security/Sandbox#Current_Status https://wiki.mozilla.org/Security/Sandbox#Current_Status Or try Firejail https://firejail.wordpress.com/ https://firejail.wordpress.com/ (Linux) or possibly Sandboxie on Windows https://www.sandboxie.com/ https://www.sandboxie.com/
snowwrestler 10y ago
It's unfortunate that this guide is not presented in two columns, at least partially. It's hard to line up the Don't's with Do's. For example in the Don't section it says "[Don't] Store sensitive information in cloud services like Evernote or Dropbox." Ok, but where is the corresponding entry in the "Do" section, which tells folks how to store sensitive information? Especially in a way that permits more than one person to access and use the information, which is key to how both journalists and activists work? There might not be a "good" answer. But recognizing that people have to work, there is probably a sense of "better" or "best for now". Maybe that's the format: Don't | Better Don't use your fingerprint | Use a long passphrase to lock/unlock devices | to lock your devices. EDIT: This guide is very helpful and kudos to the folks to made it. I offer my thoughts solely in the spirit of "maybe this feedback will be helpful." My intention is not to sit on the sidelines throwing rocks at people who are actually doing things.
- idlewords 10y ago
  Thanks for the helpful suggestion! I'll try formatting it this way, too.
kayone 10y ago
I'm a bit confused about the don't backup to Google Drive but use Gmail. are you trusting google or not?
- tptacek 10y ago
  There's virtually nothing in security that works this way. It's not the NFL. We don't pick teams and root for them. There are things that Google does that are superior to the alternatives, and there are things Apple does that are superior to the alternatives.
  - kayone 10y ago
    I understand and I agree with your point, however to me Gmail and google drive both fall into one bucket, Google's cloud offering. If any thing I would assume Drive is safer since it isnt forced to interact with an old unsecure protocol. They have full control of how it's implemented.
- snowwrestler 10y ago
  Mobile messaging, using an end-to-end encrypted system like WhatsApp or Signal, is the most secure way to communicate. Even the service provider cannot access the plaintext content of delivered messages. They exist in plaintext only at the end points (individual phones). But if you store the content of those messages with a cloud provider--regardless of which company--you have killed a lot of security value. The plaintext will sit there, just waiting for someone to go get it, and you'll never know if they do. Email does not work that way. Even if it is encrypted in transit, it is always stored in plaintext in servers at either end. So, taking that into account, which email service provider has the best security team to defend that plaintext. This guide argues it is Google.
- deleted 10y ago
  [deleted]
loteck 10y ago
Great list, I'm glad the crew in the comment threads put it together. 2 observations: * These lists are often made but are never kept up to date as recommendations change. Will this list be any different? * Use Gmail? We can't pick some other web based, 2FA capable non-US hosted service that doesn't specifically use machines to scan your content for ad serves? This recommendation was the only one that furrowed my brow.
- arkem 10y ago
  My guess is it's because Google's security team is top notch and happy to share their threat intel with their users and that's much more relevant to journalists than using a non-US based service or one that avoids content based ad serving.
  - hackermailman 10y ago
    Except support is nonexistent, so if anything happens to your gmail access you're screwed there's nobody to contact. I would think any non profit who relies on emails for fundraising/networking would want a paid service like FastMail or other paid service with 2FA
    - tptacek 10y ago
      Only in the alternate timeline where customer support and nerd optics are more important than platform security, which nobody other than Google does better.
      - hackermailman 10y ago
        Until you get locked out of your account of course, for a number of reasons such as heavy use that triggers an arbitrary lockout and there's nobody to contact. Somebody might also wish to purposely DoS your account with incorrect logins for a number of reasons too, like hiding a money transfer notification or just to screw with you.
    - mikecb 10y ago
dredmorbius 10y ago
Questions and suggestions: 1. For "Do as much of your work as possible on an iPhone or iPad." -- as opposed to what? Android and Windows? Would listing device options be a possibility? 2. Possibly: add a set of suggestions for transporting device(s) across borders or acquiring them. I suspect mail or package delivery might be an option -- or if it's not, then clarifying the risks would be of interest. 3. Operating systems: A list of most to least secure might also be handy. E.g., WinCE, Windows, MacOS, iOS, Linux, TAILS, etc. Some indication of where "good enough" starts to apply. 4. Out-of-scope for document to include a full set of terms and definitions, but a glossary with links to additional reading might be of interest. 5. Providing "why" links might also be useful. E.g., Fingerprints (can be forced to divulge, fewer legal protections than passwords). 6. Formatting: A bulleted list would be slightly easier to read. A numbered list can be specifically referenced (e.g., "'Don't' #4 ..."). 7. Define terms. E.g., "Long password" "At least 20 characters, 200 if possible", say. Tips on passphrase generation (e.g., xkcd passphrases, "correct battery horse staple". Finally: thank you for setting this up.
- idlewords 10y ago
  1. As opposed to a laptop. 2. Any concrete advice about crossing borders is hard to give right now. The goal in this document is just to alert people that it is not OK to travel with your work device. 3. For the audience here (think someone providing legal aid at an airport) this is too technical. 4,5,6 Great idea, thank you! 7. It's funny but the XKCD really seems to be the best thing to link.
  - dredmorbius 10y ago
    Thanks. 1. Windows laptop, I take it? Or any laptop? 2. Even if specifics are hard to provide, a pointer to best information, a clear statement that "Any concrete advice about crossing borders is hard to give right now" (in fact that exact phrase strikes me as excellent), and perhaps a pointer to a larger document with laws pertaining to specific countries. Ranked, say, by interest and/or travel volume. World Bank has listings: http://data.worldbank.org/indicator/ST.INT.ARVL?year_high_desc=true http://data.worldbank.org/indicator/ST.INT.ARVL?year_high_de... 3. Even people providing legal aid may have support teams who could assimilate the information. Out-of-document link here. Think staged information delivery. 7. It's an effective format for communciation. There are several generators (caveat emptor) as well. For MacOS, it would be easy to create a local generator using wordlists (I've done same on Linux). The problem is actually that the system dictionaries are generally too comprehensive and have really obscure words in them. A GUI wrapper around a Very Simple Shell Script would tend to give good outputs.
krick 10y ago
Is iPhone actually fine replacement for Android in terms of security? I never owned an iPhone, but I was guessing that it is closed-source proprietary piece of hardware with closed-source proprietary piece of software running, which is perfectly able to be transferring all your data to the vendor and most likely does exactly that.
- projektir 10y ago
  Android is so bad that iPhone is probably better, despite all those issues. The real glaring issue here is that we don't really have good, safe services or devices available to us, especially if you want to stay plugged in (have access to the internet, social media, and necessary tools). Pretty much everything is owned by a corporation or compromised or both. I'm not really convinced that much is gained by using one browser or phone over another at the end of the day. If someone really wants your information, and you're connected to the world, they'll figure out how to get it.
  - krick 10y ago
    That's my point. I don't understand how is this recommendation any useful, if I'm not missing anything. Maybe there is a better security guide for a bit more technical people? With why's and how's, explaining what are the real issues and causes of some practice being bad, and what are the possible solutions to it. Why is Android bad? Is it solved by stripping out google services? How do you do it properly? Is it solved by replacing an Android phone with iPhone? Etc. Without any of "jumping into the snake-pit is so bad, that jumping straight into the fire is probably better". Probably better, huh.
- jfoutz 10y ago
  One thing to think about is the cost of exploits. [1] It could be the case that iPhone users are more high value targets. IMHO It's more likely iPhone exploits are just harder to come by. (not impossible, just tougher) [1] https://arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ https://arstechnica.com/security/2016/09/1-5-million-bounty-...
- 10y ago
krick 10y ago
Also, why using fingerprint to unlock devices is not recommended?
- mattybrennan 10y ago
  US law enforcement is allowed to take fingerprints, which can then be used to unlock the device. Somewhere less friendly may just compel you to put your finger on the device
  - krick 10y ago
    Is it that different from making you enter your password? I don't see any real issue here if it's the only problem.
    - kevinr 10y ago
      Your password is, in a weird US Constitutional sense, speech, and your 5th Amendment right not to be forced to self-incriminate protects you. Your fingerprint is not speech, and not protected in the same fashion. (Once more for the folks in the back: fingerprints are usernames. Passwords are things you can rotate.)
      - krick 10y ago
        I see. Thanks. The first one seems relevant only for people in the USA, but inability to change fingerprints is something, I guess.
        zie 10y ago
        Most other countries probably feel similarly, or they don't have anything like the 5th amendment. In places without something like the 5th amendment, you can choose to lie about your password, do it enough times, the device will reset and erase everything(assuming you set that up). One can not lie about their fingerprints. Of course in places without something like the 5th, and you lie a few times, your death may find you quite quickly, there is at the very least an option... With a fingerprint, no options. Have a picture of your finger and game over.
smacktoward 10y ago
> Use Chrome as your browser This one breaks my heart a little. I mean, I get it, I understand why it's there. But it still breaks my heart.
- zie 10y ago
  Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.
  - tptacek 10y ago
    An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.
    - Locke1689 10y ago
      Is Edge + the new Windows Application Guard similar in protection?
    - zie 10y ago
      Agreed for the most part. There is Servo[0] which is Mozilla's playground for a Rust Browser. It's not really usable for day-to-day browsing, but it's a neat proof of concept. They are actively moving stuff from it into FF, and FF now requires rust to build. Google definitely cares a lot about security. It's great to see them embrace U2F so heavily, that even Chrome supports it out of the box. I'm not sure FF will ever become Rust-only, but if it did, it would take quite a while I think. [0] https://servo.org/ https://servo.org/
w8rbt 10y ago
Step 1: Wear a wig and dark sunglasses and buy a laptop (with cash while you still can) from a Walmart as far away from where you live as possible and never, never connect it to a network. Step 2: The rest is easy. Edit: You guys need to get a sense of humor
jgalt212 10y ago
> If you are going to use email, use Gmail, with a physical security key on your laptop and Google Authenticator on your phone. I understand Google runs a tight ship security-wise, but what about the unintentional information leakage that occurs because they read all your mail to serve you ads?
- shawn-furyan 10y ago
  If you're using email to communicate with humans, you are using Gmail since your counterparty is almost always using Gmail. Gmail and their ad scanning is unavoidable in practice when using email so your only real recourse is to use a different communication protocol. Gmail is reasonably secure in situations that actually occur frequently. No other providers are. But even Gmail is optimized for adoption and monitization over security, so it's security efforts only go so far, particularly when interacting with other email providers.
zie 10y ago
It's sort of sad and wonderful that the best we can do is an iPad when it comes to secure computing. It's awesome that something you can buy most anywhere for < $500 USD is pretty secure. It's also sad that it's the best we can do, and there is only 1 manufacturer of such a device. We desperately need better privacy and security, both from a legal and a technical point of view.
Buge 10y ago
This should be updated to not just specify the US border. It should say any international border with border control. In Canada you can be put in prison for 1 year if you don't give up your password at the border.
- angry_octet 10y ago
  While I'm sure you are referring to the Alain Philippon case, your facts are wrong. Firstly, the CBSA action was never tested in court. Failure to divulge information hasn't been defined as 'hindering' before. The case would probably have to go to the Supreme Court of Canada for it to be decided. Secondly, even at the border you can choose to remain silent. See linked page for advice from actual lawyers. The most likely worst outcome is you get refused entry if you are not Canadian. https://bccla.org/2016/08/what-happens-if-you-dont-provide-your-cellphone-password-to-border-agents/ https://bccla.org/2016/08/what-happens-if-you-dont-provide-y...
qrbLPHiKpiux 10y ago
I prefer to use a live version of ubuntu on a flash drive on a laptop with no hard drive in it. A separate sd card, or thumb drive with an entire encrypted file partition. Writing in plain text only.
biafra 10y ago
> If you are going to use email, use Gmail, with ... Is Gmail really the most secure email provider? I am sure it is not for non US citizens. But is it for US citizens. Don't you have better?
biafra 10y ago
> Use a password manager and have it generate random passwords for every site you use. A good password manager is 1password. Be aware, that on Google's Android every app in the background has access to the clipboard. And Google refuses to fix that. It is fixed in CopperheadOS afaik.
teekert 10y ago
So... Use Google services on a modern iDevice and don't use the fingerprint scanner and you're good? The contrast with Snowdens recommendations is quite stark: https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-reclaim-your-privacy/ https://theintercept.com/2015/11/12/edward-snowden-explains-...
secfirstmd 10y ago
Hey everyone. Apologies for the blatant plug but seeing as we are talking about security precautions for non-profits and journalists, it's probably relevant... We build a tool specifically to help non-profits and journalists learn about and manage their digital and physical security on the move. It's called Umbrella App. It's free, open source, on Android and contains tons of lessons on privacy related issues like digital and physical security. Umbrella has everything from how to do basic stuff like communicate with basic tools like Signal to sending a secure email with PGP. However, the unique bit is we also have stuff on the physical side, like how to plan travel, cross borders, set-up a secure physical meeting, deal with detecting surveillance, covering a protest, respond to a kidnapping etc. Basically we have tried to make it a bit of a one-stop-shop for security for regular people, activists, refugees and journalists. We also pull security feeds from places like the UN, Centres for Disease Control etc - which is obviously very important to folks in places like Syria or affected by Zika/Ebola. There’s tons of really relevant stuff in it, especially for those now mobilising for the first time on some issues. Loads of people are writing guides that solve small parts of the puzzle but we have tried to provide the whole picture in the one place. Google Play Store: https://play.google.com/store/apps/details?id=org.secfirst.umbrella https://play.google.com/store/apps/details?id=org.secfirst.u... Amazon App Store: https://www.amazon.com/Security-First-Umbrella-made-easy/dp/B01AKN9M1Y https://www.amazon.com/Security-First-Umbrella-made-easy/dp/... F-Droid Repo: https://secfirst.org/fdroid/repo https://secfirst.org/fdroid/repo Github Repo: https://github.com/securityfirst https://github.com/securityfirst Code Audit: https://secfirst.org/blog.html https://secfirst.org/blog.html Hope some folks here find it useful/interesting! Ends blatant plug
- idlewords 10y ago
  Please get this vetted by real security people. The fact that you mention PGP suggests to me you haven't.
  - secfirstmd 10y ago
    How can a standard guide to installing and using PGP through various different methods be a security issue?
caivvoacmh 10y ago
Great initiative. >1. Don't send any sensitive information by email. >2. Don't store sensitive information in cloud services like Evernote or Dropbox. Both of these are good advice. However, what I don't see is "how to share information securely". The intended audience surely needs a way to exchange information, e.g. documents but what are the recommendations on how they should do this? >Carry a “USB data blocker” (either the whole cable or an adapter that plugs into your cable like this) to charge at airport or hotel chargers. I would suggest that SyncStop[1][2] is recommended instead of the current device on the basis that SyncStop is created and sold by a security company that specialises in hardware security. It is also recommended by Mikko[3] from fsecure. [1] http://syncstop.com/ http://syncstop.com/ [2] https://www.amazon.com/Syncstop-Syncstop/dp/B00ZQAY23U https://www.amazon.com/Syncstop-Syncstop/dp/B00ZQAY23U [3] https://twitter.com/mikko/status/792980858340769792 https://twitter.com/mikko/status/792980858340769792

195 points by idlewords 10y ago

RRRA 10y ago

So, no Android phones is not very pragmatic... Any justifications? (Especially without saying to use only FOSS OS)

eropple 10y ago
The security situation on Android is, full-stop, a tire fire. Be it the existence (at all) of external storage that badly-considered applications happily write sensitive stuff to (and for a journalist, your photos are sensitive) to the general mess that is Android application permissions (even in newer versions) to the slapdash, inconsistent way that updates get pushed to devices. It's all bad, and if you care about security, you should not use Android, no exceptions. As it happens, I use an Android phone as a daily driver. But I'm not a journalist and I'm not handling data that isn't sensitive to anyone but myself. I'm willing to take that risk (edit: and I'm able to, to a level I'm comfortable with, mitigate those risks, which a non-technical person probably can't evaluate safely, to say nothing of implement). But I'm not a journalist whose sources may depend on me.
jsjohnst 10y ago
I agree it's overly broad statement without justification, but it's not entirely unfounded either. iOS's extreme walled garden does protect you from many things that Android doesn't. As another commenter mentioned, security permissions are a mess, malware is a real thing, and the power and versatility of Android leaves you very vulnerable if you're in a high risk profession who must keep secrets safe.
- 0000anonymous 10y ago
  again copperheados... this guide has many bad directions
- tptacek 10y ago
  Very few of the items in here have justifications listed, because that's not productive for the intended audience. They don't want to know "why" any more than most patients want to know "why" their doctor prescribes one antibiotic versus another.
  - projektir 10y ago
    Even if your intended audience doesn't care about the why, you must necessarily provide justification so that another audience, which would want to make sure that you're not selling snake oil, could verify your why. Knowledge sharing only really works when there's a vetting process on some level.
    - tptacek 10y ago
      No, that's not how it works. The guide itself doesn't need to be bulletproofed against zany accusations that the authors are selling snake oil; there are other ways to accomplish that without crudding the recommendations themselves up with verbiage to placate angry nerds.
      - projektir 10y ago
        I didn't say anything about bulletproofed, just explained. Right now, there's no explanation, and I'm asking for some justification, how are you getting "bulletproofing" from that? I didn't say the authors are selling snake oil. But if a person doesn't know much about a subject, they may not be able to tell, and they should be suspicious. They might want to see a review or criticism of it. They might want to verify that it's well intentioned, especially on a sensitive subject such as this. There's nothing zany about that, it's common sense. If I find some information source that presents itself as an arbiter of truth, but has no justification for its points, I cannot in good faith recommend it to anyone. The only angry one here seems to be you, with many unnecessarily rude responses that do not at all inspire confidence.
        tptacek 10y ago

0000anonymous 10y ago

dont use android?? copperheados?? hello? sure sounds bias to me. and no u wouldnt use gmail, u would use something non fourteen eyes. like protonmail or ur own pgp enigmal with riseup. u wouldnt even use social media. this is ridicules. whatsapp? really? after all the extreme crap they got caught with? how about u advise signal, silence, or xmpp options out there. chromebook?...tails...whonix....librem 15.... qubesos... lets get real here...

eropple 10y ago
As far as Android goes: who's auditing CopperheadOS? What white hats are looking at it and trying to compromise it so that it can be improved? What's their rep, what's their record, and how do they stack up against iOS's internal and external security tests? As far as "ur own pgp enigmal with riseup" goes: how are you going to get people to email you? Are you, a journalist, going to manage SPF/DKIM and make sure you're doing it right? How are you going to manage antispam? Gmail is not perfect--but unless the totality of your threat model includes getting black-bagged because an NSL found encrypted emails in your inbox, it is probably the best option. (Protonmail is fine too, but increases friction--and increased friction increases the likelihood that you're not going to use it, falling back to easier tools.) WhatsApp: either that or Signal are fine (and, indeed, run the same protocol!). XMPP relies largely on federation, which relies on federated servers not being compromised, so no, that's out. (I haven't looked at Silence, can't speak to it.) Chromebooks are a decent option for some use cases, unless (as more and more journalists tend to do) you need something that can easily and effectively edit audio and video. Tails/Whonix/especially-Qubes are not because people need their stuff to actually work and to not spend more of their time fighting their computer than doing their jobs; to that end, a properly patched OS X is a pretty reasonable call. "Getting real here" means finding a workable place on the do-your-job/security curve, and most of what you're saying is not. For example, of course you would "use social media", because that's a large part of the job of a journalist in 2017. Your recommendations, while (I assume) in good faith, indicate a willingness to invest more time in fighting your stuff than doing your job. Nobody else cares. Recommend what's easy and what gets 95% of the way there (and not, as with something like CopperheadOS, actually detracts).
- 10y ago

ploggingdev 10y ago

Can someone explain the reasoning behind these recommendations? Don't : > Use your fingerprint to lock/unlock devices. > Use an Android phone. > Take the devices you work on across the US border. Anyone has experience with their devices being searched at the border? Do they just look at your social media and let you go or do they somehow copy the data on the devices or install any software on the devices? Will the persons devices always be in visibility or do the CBP officers handle them in separate rooms? Assuming I have to carry my laptop and phone across the border, what precautions can I take to minimize the potential privacy violations? After crossing the border, do I just reinstall my OS of choice (Ubuntu) from scratch and reset all passwords? Regarding the browser recommendation, why is Firefox not recommended? It's used in the Tor browser and I have not heard of any major security incident recently with Firefox.

eropple 10y ago
Border patrol cannot force you to divulge a PIN or password. They can force you to apply your fingerprint. Look elsewhere in this thread for "why not use an Android device." Don't carry your work devices across the US border because they may be taken, can be taken out of your view, and may be duplicated (and yeah, you should have FDE on your computers etc., but don't take the chance).
- Buge 10y ago
  The US border patrol cannot force you to give up your password. But other countries (including Canada) can. http://news.nationalpost.com/news/canada/guilty-plea-ends-case-that-pitted-cellphone-privacy-rights-against-border-security-powers http://news.nationalpost.com/news/canada/guilty-plea-ends-ca...
  - tptacek 10y ago
    They might not be able to force that on US citizens, who have an absolute right both to habeas and to enter the country. They can force it on nonresident aliens.
ENOTTY 10y ago

tptacek 10y ago

Before you freak out about these recommendations, please take into account: These instructions are written for unsophisticated users, particularly journalists and activists, and were written with feedback from those users. So, for instance, the steps you might take to arrive at a secure Firefox or Android configuration are probably fine, but not workable for the audience these instructions are intended for. We're simultaneously working with the airport lawyer groups (there's a huge one at ORD). It's been jarring to realize how many compromises are required to make things workable for groups of non-experts to use. Just getting software installed is a major hassle, so anything you install or customize needs to be really worth the effort.

WhitneyLand 10y ago
What about not using public wifi hotspots?
- tptacek 10y ago
  I wouldn't, but the instructions here assume the network itself is compromised, so I'm not sure we gain much security by adding another scary-sounding technical requirement.
fictioncircle 10y ago
Yeah. The only reasonably secure option for Android requires you to own a Nexus device within the window Google pushes security updates regularly. Or you flash it yourself to keep it up to date regularly. And even that is kind of dicey unless its just Google apps + Signal + verifiable OSS.
- hackuser 10y ago
  What about a custom ROM (fork) of Android, sans Google apps? Not an option for typical end-users, of course.
  - fictioncircle 10y ago

lsh123 10y ago

"Use a bluetooth keyboard for easier typing..." Not a good advice for any public place (airports, cafes, etc). Very easy to listen to BT and intercept passwords as user types them in.

codemac 10y ago
There are keyboards that force AES-128 and don't fall back IIRC microsoft makes some. A USB keyboard is almost certainly easier to secure though.
maxerickson 10y ago
Is there a documented attack on say, Apple's Magic Keyboard? (if it is true that some (relatively modern) bluetooth keyboards are sniffable and some aren't, I'm sure you can convince them to amend the article with specific models that are believed to be better)
- ENOTTY 10y ago
  I'd second adding recommendations for specific models. There are a lot of BT keyboards on the market of varying quality.
  - tptacek 10y ago
    (I don't in any way own this document). I acknowledge that the situation with Bluetooth peripherals is complicated† and accept that there are probably a bunch of vendors that are unsafe to use. It might be reasonable to simply require Apple peripherals --- not because they're the best, but because Apple is more accountable to peripherals security than most other vendors are. On the other hand, what we can't reasonably do is create a Bluetooth Keyboard Product Guide in a simple set of security recommendations. Not only will it not be effective, but it will discourage the audience, who will fall back to their previous insecure configurations. So I'd ask to what extent we think Bluetooth sniffing attacks on journalists are a spy movie threat. No matter what device they use, simply by using a wireless device as an input, they're exposing those inputs to timing as well. But then, as well, Apple's software update could be targeted too. The basic idea behind the "use a Bluetooth keyboard recommendation" is, I presume, to convince people who would otherwise use computers to do sensitive work to instead use an iDevice. That's a very sound security principle; those iDevices are far more secure than the median fully-functional computer. If I had to pick between telling a journalist to use a random Bluetooth keyboard with an iPad, or use a Macbook or Thinkpad, I would have a hard time deciding, but I think I'd ultimately go with the random Bluetooth keyboard --- there are too many different ways the computer can be undetectably (to a typical user) owned up, and only one fairly elaborate scenario where the BT keyboard will screw them. What I'm learning from working with at-risk normal users is that a lot of security steps we all take for granted are simply not on the table for the people who need security the most. † Way more complicated than the people claiming "Bluetooth keyboards are trivially sniffable" are letting on

pdog 10y ago

> Avoid installing spurious, unknown or unnecessary extensions. This is wrong. You absolutely must use an ad blocker or noscript extension if you intend to browse the web securely.

tptacek 10y ago
The guide doesn't say not to install an ad blocker, but I dispute that claim nonetheless. Ad blockers are fine, and probably add marginally to security, but I don't think they a necessity --- if you're using Chrome/Chromium. If I was using Firefox or IE, I would agree with you. But step one here is not to be using un-hardened browsers.
- dguido 10y ago
  I generally make an exception for HTTPS Everywhere and Google Password Alert when I wrote things like this, but I agree that maybe it's worth it to cut them and simplify the guide. https://chrome.google.com/webstore/detail/password-alert/noondiphcddnnabmjcihcjfbhfklnnep?hl=en https://chrome.google.com/webstore/detail/password-alert/noo... https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp https://chrome.google.com/webstore/detail/https-everywhere/g...
  - tptacek 10y ago
    HTTPS Everywhere would be a win (I'd have to think about whether it's enough of one to earn its place on the list, but if you added it, you could also suggest an ad-blocker --- another issue there though is suggesting ad blockers to journalists gets to a tricky place). GPA is great, but the premise behind this guide is that if you're relying on passwords for Google you're already boned. It's a security win even with TOTP enabled, but I don't think it's enough to earn a spot. These guidelines are being distributed to activists and journalists along with free U2F keys, for whatever that's worth.
    - hackuser 10y ago
      > HTTPS Everywhere would be a win IME, it breaks too many sites to give to all end-users; if the default configuration omitted sites listed as 'Partial'; maybe it would be passable. Maybe have a subcategory for intermediate users and put it there. Novice-level users (for lack of a better term) have no idea why the website is not working, and thus don't even know to consider disabling HTTPS Everywhere. Also, it makes the user easier to identify.

cgb223 10y ago

While iOS devices are generally more secure, its been proven that Apple has been a part of the various NSA programs (X-Keyscore, PRISM, etc). Chromebooks are made by Google, who is also a known partner ni these programs. It all comes down to who you trust, and recommending that Journalists use iOS Devices and Chromebooks made by Apple and Google who are known snoopers is a bad bet if the thing you're trying to avoid is the US Government. Also, bluetooth keyboards are trivial to listen in on. Not a great recommendation. This article is short but bogus.

tptacek 10y ago
The people these notes are targeted at are not going to use whatever the vanity "secure" non-Google-infected non-Apple-infected non-Microsoft-infected options you'll have in mind. It's not going to happen. If you want to write a separate set of recommendations for people who spend their lives on Tor, that's fine. These recommendations have to work for people who are barely willing to install software, let along switch to idiosyncratic hardware.

lordofmoria 10y ago

Just a bit of feedback: might be nice to repeat the "Don't" in front of each sentence, even if it's grouped under the heading and therefore repetitive: I found myself being like "wait, it's telling me to backup my messages to google drive? Are they client-side encrypted?"

amk_ 10y ago
Yes, I read the article through Readability and it actually stripped out the Do and Don't headers
- idlewords 10y ago
  Thank you both! I'll fix this.

sachinag 10y ago

It would probably behoove someone to sell these laptops, iPads, and iPhones to journalists, lawyers, and other folks with these configurations. It's a lot easier to give them a pre-configured locked down device that they can't mess with than it is to ask them to actually buy a Yubikey. It won't work for everyone - Slate's CMS is notorious for only working in Firefox, for example - but if Pro Publica is going to hire 30 journalists, then be their vendor.

tptacek 10y ago
That's a smart idea. But these instructions are also being given to immigration lawyers and to Muslim rights activists, both of whom have very limited budgets, so vendor isn't a great place to start.
CM30 10y ago
Wouldn't this provide a great targt for spies and security services? I mean, maybe I'm being stupid here, but if I was in charge of the NSA and knew that people with sensitive information were buying this gear from a certain vendor, said vendor would be right at the top of the target list. I don't think I'd be able to trust any individual or company selling 'secure devices' for journalists and activists.
- deleted 10y ago
  [deleted]

projektir 10y ago

Would be helpful to provide alternative to some of the Don'ts. How does one transfer information if they can't transfer anything across the border? Where should one store sensitive information? An encrypted drive you're not supposed to transfer across the border? I'm not really sure what a person is supposed to do with either of those two recommendations, especially if we're saying that person is not tech-savvy. I think these will just be ignored because they don't seem very viable and require a lot of background knowledge and planning. Also, why is Chrome preferred to Firefox? I generally assume Chrome is listened to by Google across the board, and it still lacks something like NoScript. Chrome doesn't seem to do block XSS well, either. Similarly, why Gmail as opposed to, I don't know, something like Protonmail or the like? Safety behind big company, reliability, viability? Why Chromebook and not just a normal Linux? The inherent trust in Google in this list confuses me. And 1password over KeyPass. It seems every cloud-based password manager has been hacked in a round robin fashion, but I guess this solves the other cloud based problem.

chmars 10y ago
I also have my doubts about 1Password – although I am still a 1Password users, at least of the old approach (pay once, cloud sync but no web-accessible storage with 1Password). I guess I will have to look for an alternative sooner or later! :(
- newman314 10y ago
  I use 1Password + Resilio (formerly BTSync) in local sync only mode. It's kind of a pain in the ass sometimes (I can only sync at home) but the upside is no cloud component and it syncs nicely and automatically between multiple machines. For mobile devices, I use the Wifi sync mode.
tptacek 10y ago
1. To transfer information across the border, create an encrypted volume, store it on a cloud provider, and download it when you return. Unfortunately, it's more complicated to do this than it should be, so people hoping to do it need individualized instruction. Also, particularly for refugees, there are legal implications to doing this. Ultimately, the simplest recommendation is: don't bring information across the border at all. Go without. 2. Because Chrome is significantly more secure than Firefox. See: rest of thread. 3. Because no email provider is truly safe, and Google's mail service is better defended than virtually any other mail provider. Things like Protonmail are security gimmicks. If you're concerned enough about messaging safety to use some idiosyncratic email provider, you're concerned enough to stop using email for secrets altogether: use Signal, WhatsApp, or Wire. 4. Because a Chromebook is safer for a typical user than Linux, and also because there's a (remote) chance that people might actually use a Chromebook. The security challenges of 2017 are not an opportunity to finally achieve Linux On The Desktop. 5. The list's most contentious recommendation is a rebuke to Google. 6. Standalone 1Password isn't a cloud-based password manager. People should avoid cloud-based password managers.

Accacin 10y ago

I pretty much follow most of these guidelines already, however I do use the Firefox browser and I wasn't aware it was so inseucre compared to Chrome. Is there a nice guide on hardening Firefox security or am I out of luck because of the sandbox situation?

hackermailman 10y ago
FF does have a sandbox w/some versions https://wiki.mozilla.org/Security/Sandbox#Current_Status https://wiki.mozilla.org/Security/Sandbox#Current_Status Or try Firejail https://firejail.wordpress.com/ https://firejail.wordpress.com/ (Linux) or possibly Sandboxie on Windows https://www.sandboxie.com/ https://www.sandboxie.com/

snowwrestler 10y ago

It's unfortunate that this guide is not presented in two columns, at least partially. It's hard to line up the Don't's with Do's. For example in the Don't section it says "[Don't] Store sensitive information in cloud services like Evernote or Dropbox." Ok, but where is the corresponding entry in the "Do" section, which tells folks how to store sensitive information? Especially in a way that permits more than one person to access and use the information, which is key to how both journalists and activists work? There might not be a "good" answer. But recognizing that people have to work, there is probably a sense of "better" or "best for now". Maybe that's the format: Don't | Better Don't use your fingerprint | Use a long passphrase to lock/unlock devices | to lock your devices. EDIT: This guide is very helpful and kudos to the folks to made it. I offer my thoughts solely in the spirit of "maybe this feedback will be helpful." My intention is not to sit on the sidelines throwing rocks at people who are actually doing things.

idlewords 10y ago
Thanks for the helpful suggestion! I'll try formatting it this way, too.

kayone 10y ago

I'm a bit confused about the don't backup to Google Drive but use Gmail. are you trusting google or not?

tptacek 10y ago
There's virtually nothing in security that works this way. It's not the NFL. We don't pick teams and root for them. There are things that Google does that are superior to the alternatives, and there are things Apple does that are superior to the alternatives.
- kayone 10y ago
  I understand and I agree with your point, however to me Gmail and google drive both fall into one bucket, Google's cloud offering. If any thing I would assume Drive is safer since it isnt forced to interact with an old unsecure protocol. They have full control of how it's implemented.
snowwrestler 10y ago
Mobile messaging, using an end-to-end encrypted system like WhatsApp or Signal, is the most secure way to communicate. Even the service provider cannot access the plaintext content of delivered messages. They exist in plaintext only at the end points (individual phones). But if you store the content of those messages with a cloud provider--regardless of which company--you have killed a lot of security value. The plaintext will sit there, just waiting for someone to go get it, and you'll never know if they do. Email does not work that way. Even if it is encrypted in transit, it is always stored in plaintext in servers at either end. So, taking that into account, which email service provider has the best security team to defend that plaintext. This guide argues it is Google.
deleted 10y ago
[deleted]

loteck 10y ago

Great list, I'm glad the crew in the comment threads put it together. 2 observations: * These lists are often made but are never kept up to date as recommendations change. Will this list be any different? * Use Gmail? We can't pick some other web based, 2FA capable non-US hosted service that doesn't specifically use machines to scan your content for ad serves? This recommendation was the only one that furrowed my brow.

arkem 10y ago
My guess is it's because Google's security team is top notch and happy to share their threat intel with their users and that's much more relevant to journalists than using a non-US based service or one that avoids content based ad serving.
- hackermailman 10y ago
  Except support is nonexistent, so if anything happens to your gmail access you're screwed there's nobody to contact. I would think any non profit who relies on emails for fundraising/networking would want a paid service like FastMail or other paid service with 2FA
  - tptacek 10y ago
    Only in the alternate timeline where customer support and nerd optics are more important than platform security, which nobody other than Google does better.
    - hackermailman 10y ago
      Until you get locked out of your account of course, for a number of reasons such as heavy use that triggers an arbitrary lockout and there's nobody to contact. Somebody might also wish to purposely DoS your account with incorrect logins for a number of reasons too, like hiding a money transfer notification or just to screw with you.
  - mikecb 10y ago

dredmorbius 10y ago

Questions and suggestions: 1. For "Do as much of your work as possible on an iPhone or iPad." -- as opposed to what? Android and Windows? Would listing device options be a possibility? 2. Possibly: add a set of suggestions for transporting device(s) across borders or acquiring them. I suspect mail or package delivery might be an option -- or if it's not, then clarifying the risks would be of interest. 3. Operating systems: A list of most to least secure might also be handy. E.g., WinCE, Windows, MacOS, iOS, Linux, TAILS, etc. Some indication of where "good enough" starts to apply. 4. Out-of-scope for document to include a full set of terms and definitions, but a glossary with links to additional reading might be of interest. 5. Providing "why" links might also be useful. E.g., Fingerprints (can be forced to divulge, fewer legal protections than passwords). 6. Formatting: A bulleted list would be slightly easier to read. A numbered list can be specifically referenced (e.g., "'Don't' #4 ..."). 7. Define terms. E.g., "Long password" "At least 20 characters, 200 if possible", say. Tips on passphrase generation (e.g., xkcd passphrases, "correct battery horse staple". Finally: thank you for setting this up.

idlewords 10y ago
1. As opposed to a laptop. 2. Any concrete advice about crossing borders is hard to give right now. The goal in this document is just to alert people that it is not OK to travel with your work device. 3. For the audience here (think someone providing legal aid at an airport) this is too technical. 4,5,6 Great idea, thank you! 7. It's funny but the XKCD really seems to be the best thing to link.
- dredmorbius 10y ago
  Thanks. 1. Windows laptop, I take it? Or any laptop? 2. Even if specifics are hard to provide, a pointer to best information, a clear statement that "Any concrete advice about crossing borders is hard to give right now" (in fact that exact phrase strikes me as excellent), and perhaps a pointer to a larger document with laws pertaining to specific countries. Ranked, say, by interest and/or travel volume. World Bank has listings: http://data.worldbank.org/indicator/ST.INT.ARVL?year_high_desc=true http://data.worldbank.org/indicator/ST.INT.ARVL?year_high_de... 3. Even people providing legal aid may have support teams who could assimilate the information. Out-of-document link here. Think staged information delivery. 7. It's an effective format for communciation. There are several generators (caveat emptor) as well. For MacOS, it would be easy to create a local generator using wordlists (I've done same on Linux). The problem is actually that the system dictionaries are generally too comprehensive and have really obscure words in them. A GUI wrapper around a Very Simple Shell Script would tend to give good outputs.

krick 10y ago

Is iPhone actually fine replacement for Android in terms of security? I never owned an iPhone, but I was guessing that it is closed-source proprietary piece of hardware with closed-source proprietary piece of software running, which is perfectly able to be transferring all your data to the vendor and most likely does exactly that.

projektir 10y ago
Android is so bad that iPhone is probably better, despite all those issues. The real glaring issue here is that we don't really have good, safe services or devices available to us, especially if you want to stay plugged in (have access to the internet, social media, and necessary tools). Pretty much everything is owned by a corporation or compromised or both. I'm not really convinced that much is gained by using one browser or phone over another at the end of the day. If someone really wants your information, and you're connected to the world, they'll figure out how to get it.
- krick 10y ago
  That's my point. I don't understand how is this recommendation any useful, if I'm not missing anything. Maybe there is a better security guide for a bit more technical people? With why's and how's, explaining what are the real issues and causes of some practice being bad, and what are the possible solutions to it. Why is Android bad? Is it solved by stripping out google services? How do you do it properly? Is it solved by replacing an Android phone with iPhone? Etc. Without any of "jumping into the snake-pit is so bad, that jumping straight into the fire is probably better". Probably better, huh.
jfoutz 10y ago
One thing to think about is the cost of exploits. [1] It could be the case that iPhone users are more high value targets. IMHO It's more likely iPhone exploits are just harder to come by. (not impossible, just tougher) [1] https://arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ https://arstechnica.com/security/2016/09/1-5-million-bounty-...
10y ago

krick 10y ago

Also, why using fingerprint to unlock devices is not recommended?

mattybrennan 10y ago
US law enforcement is allowed to take fingerprints, which can then be used to unlock the device. Somewhere less friendly may just compel you to put your finger on the device
- krick 10y ago
  Is it that different from making you enter your password? I don't see any real issue here if it's the only problem.
  - kevinr 10y ago
    Your password is, in a weird US Constitutional sense, speech, and your 5th Amendment right not to be forced to self-incriminate protects you. Your fingerprint is not speech, and not protected in the same fashion. (Once more for the folks in the back: fingerprints are usernames. Passwords are things you can rotate.)
    - krick 10y ago
      I see. Thanks. The first one seems relevant only for people in the USA, but inability to change fingerprints is something, I guess.
      - zie 10y ago
        Most other countries probably feel similarly, or they don't have anything like the 5th amendment. In places without something like the 5th amendment, you can choose to lie about your password, do it enough times, the device will reset and erase everything(assuming you set that up). One can not lie about their fingerprints. Of course in places without something like the 5th, and you lie a few times, your death may find you quite quickly, there is at the very least an option... With a fingerprint, no options. Have a picture of your finger and game over.

smacktoward 10y ago

> Use Chrome as your browser This one breaks my heart a little. I mean, I get it, I understand why it's there. But it still breaks my heart.

zie 10y ago
Agreed. Luckily Sandboxing, which is pretty much the big feature that sells Chrome for Security will get to FF, it will just take a bit longer. Plus with FF going crazy for Rust, I think FF has a bright future security wise.
- tptacek 10y ago
  An all-Rust browser would make a big difference. Sandboxing is good, but won't close the gap with Chromium, which just invests too much money into software security to lose much ground to other browsers.
  - Locke1689 10y ago
    Is Edge + the new Windows Application Guard similar in protection?
  - zie 10y ago
    Agreed for the most part. There is Servo[0] which is Mozilla's playground for a Rust Browser. It's not really usable for day-to-day browsing, but it's a neat proof of concept. They are actively moving stuff from it into FF, and FF now requires rust to build. Google definitely cares a lot about security. It's great to see them embrace U2F so heavily, that even Chrome supports it out of the box. I'm not sure FF will ever become Rust-only, but if it did, it would take quite a while I think. [0] https://servo.org/ https://servo.org/

w8rbt 10y ago

Step 1: Wear a wig and dark sunglasses and buy a laptop (with cash while you still can) from a Walmart as far away from where you live as possible and never, never connect it to a network. Step 2: The rest is easy. Edit: You guys need to get a sense of humor

jgalt212 10y ago

> If you are going to use email, use Gmail, with a physical security key on your laptop and Google Authenticator on your phone. I understand Google runs a tight ship security-wise, but what about the unintentional information leakage that occurs because they read all your mail to serve you ads?

shawn-furyan 10y ago
If you're using email to communicate with humans, you are using Gmail since your counterparty is almost always using Gmail. Gmail and their ad scanning is unavoidable in practice when using email so your only real recourse is to use a different communication protocol. Gmail is reasonably secure in situations that actually occur frequently. No other providers are. But even Gmail is optimized for adoption and monitization over security, so it's security efforts only go so far, particularly when interacting with other email providers.

zie 10y ago

It's sort of sad and wonderful that the best we can do is an iPad when it comes to secure computing. It's awesome that something you can buy most anywhere for < $500 USD is pretty secure. It's also sad that it's the best we can do, and there is only 1 manufacturer of such a device. We desperately need better privacy and security, both from a legal and a technical point of view.

Buge 10y ago

This should be updated to not just specify the US border. It should say any international border with border control. In Canada you can be put in prison for 1 year if you don't give up your password at the border.

angry_octet 10y ago
While I'm sure you are referring to the Alain Philippon case, your facts are wrong. Firstly, the CBSA action was never tested in court. Failure to divulge information hasn't been defined as 'hindering' before. The case would probably have to go to the Supreme Court of Canada for it to be decided. Secondly, even at the border you can choose to remain silent. See linked page for advice from actual lawyers. The most likely worst outcome is you get refused entry if you are not Canadian. https://bccla.org/2016/08/what-happens-if-you-dont-provide-your-cellphone-password-to-border-agents/ https://bccla.org/2016/08/what-happens-if-you-dont-provide-y...

qrbLPHiKpiux 10y ago

I prefer to use a live version of ubuntu on a flash drive on a laptop with no hard drive in it. A separate sd card, or thumb drive with an entire encrypted file partition. Writing in plain text only.

biafra 10y ago

> If you are going to use email, use Gmail, with ... Is Gmail really the most secure email provider? I am sure it is not for non US citizens. But is it for US citizens. Don't you have better?

biafra 10y ago

> Use a password manager and have it generate random passwords for every site you use. A good password manager is 1password. Be aware, that on Google's Android every app in the background has access to the clipboard. And Google refuses to fix that. It is fixed in CopperheadOS afaik.

teekert 10y ago

So... Use Google services on a modern iDevice and don't use the fingerprint scanner and you're good? The contrast with Snowdens recommendations is quite stark: https://theintercept.com/2015/11/12/edward-snowden-explains-how-to-reclaim-your-privacy/ https://theintercept.com/2015/11/12/edward-snowden-explains-...

secfirstmd 10y ago

Hey everyone. Apologies for the blatant plug but seeing as we are talking about security precautions for non-profits and journalists, it's probably relevant... We build a tool specifically to help non-profits and journalists learn about and manage their digital and physical security on the move. It's called Umbrella App. It's free, open source, on Android and contains tons of lessons on privacy related issues like digital and physical security. Umbrella has everything from how to do basic stuff like communicate with basic tools like Signal to sending a secure email with PGP. However, the unique bit is we also have stuff on the physical side, like how to plan travel, cross borders, set-up a secure physical meeting, deal with detecting surveillance, covering a protest, respond to a kidnapping etc. Basically we have tried to make it a bit of a one-stop-shop for security for regular people, activists, refugees and journalists. We also pull security feeds from places like the UN, Centres for Disease Control etc - which is obviously very important to folks in places like Syria or affected by Zika/Ebola. There’s tons of really relevant stuff in it, especially for those now mobilising for the first time on some issues. Loads of people are writing guides that solve small parts of the puzzle but we have tried to provide the whole picture in the one place. Google Play Store: https://play.google.com/store/apps/details?id=org.secfirst.umbrella https://play.google.com/store/apps/details?id=org.secfirst.u... Amazon App Store: https://www.amazon.com/Security-First-Umbrella-made-easy/dp/B01AKN9M1Y https://www.amazon.com/Security-First-Umbrella-made-easy/dp/... F-Droid Repo: https://secfirst.org/fdroid/repo https://secfirst.org/fdroid/repo Github Repo: https://github.com/securityfirst https://github.com/securityfirst Code Audit: https://secfirst.org/blog.html https://secfirst.org/blog.html Hope some folks here find it useful/interesting! Ends blatant plug

idlewords 10y ago
Please get this vetted by real security people. The fact that you mention PGP suggests to me you haven't.
- secfirstmd 10y ago
  How can a standard guide to installing and using PGP through various different methods be a security issue?

caivvoacmh 10y ago

Great initiative. >1. Don't send any sensitive information by email. >2. Don't store sensitive information in cloud services like Evernote or Dropbox. Both of these are good advice. However, what I don't see is "how to share information securely". The intended audience surely needs a way to exchange information, e.g. documents but what are the recommendations on how they should do this? >Carry a “USB data blocker” (either the whole cable or an adapter that plugs into your cable like this) to charge at airport or hotel chargers. I would suggest that SyncStop[1][2] is recommended instead of the current device on the basis that SyncStop is created and sold by a security company that specialises in hardware security. It is also recommended by Mikko[3] from fsecure. [1] http://syncstop.com/ http://syncstop.com/ [2] https://www.amazon.com/Syncstop-Syncstop/dp/B00ZQAY23U https://www.amazon.com/Syncstop-Syncstop/dp/B00ZQAY23U [3] https://twitter.com/mikko/status/792980858340769792 https://twitter.com/mikko/status/792980858340769792