4 ms·

> 3. Turn off your computer and personal devices when they’re not in use. Even Bruce Schneier recommends you do that[1]. The idea is that if your machine is a

> 3. Turn off your computer and personal devices when they’re not in use. Even Bruce Schneier recommends you do that[1]. The idea is that if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam. Or if there's some network-based exploit, you're not vulnerable while your device is off. 1. https://www.schneier.com/blog/archives/2004/12/safe_personal_c.html https://www.schneier.com/blog/archives/2004/12/safe_personal...

Ajedi32 10y ago
> Turn off the computer when you're not using it, especially if you have an "always on" Internet connection. How old is that article? Sounds like this is from the days back when dial-up was still popular. I guess there may be some marginal increase in security by turning off your computer like this, but I don't think it's the kind of thing most users should be worried about. > if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam If your machine is part of a botnet, you're already compromised and turning it off when you're not using it isn't going to fix that. It might marginally help _other_ people getting DDoSed or spammed by your PC, but it won't improve your own security. > Or if there's some network-based exploit, you're not vulnerable while your device is off I guess. But unless you become aware of the exploit and take measures to mitigate it before turning your PC on and connecting it to the internet, leaving it off when you're not using it is unlikely to help with this - you'll just be compromised as soon as you turn your PC on. Not to mention that the kind of zero-day that would allow compromising a fully up-to-date PC with nothing more than network access to it is extremely rare. I'd argue the security benefits of leaving your computer on so it can auto-install security updates while you're away probably outweighs any marginal benefits you might get from turning it off when not using it. (Though either way the difference is extremely minor.)
- discreditable 10y ago
  The article is from 2004. Keep in mind it's geared towards being very simple. I don't think some of the advice is good, such as deleting cmd.exe and command.com.
Avernar 10y ago
Except if you have a computer with Intel Management Engine or the AMD equivalent. Then it can be accessed when off. And mobile devices can be turned on remotely as well. You'd have to pull the plug or remove the battery to be truly off but nobody goes through that hassle. While currently it would take a state actor to do this eventually this will trickle down into to the hackers.
_eht 10y ago
I guess if your computer is already a spambot, just limiting the amount of time you are spamming isn't really solving the problem. What is the real advantage to spamming for eight working hours vs 24. For you, no advantage. Disadvantage goes to the spam operator, but again, who really cares at that point?

Ajedi32 10y ago

> Turn off the computer when you're not using it, especially if you have an "always on" Internet connection. How old is that article? Sounds like this is from the days back when dial-up was still popular. I guess there may be some marginal increase in security by turning off your computer like this, but I don't think it's the kind of thing most users should be worried about. > if your machine is a spambot and you don't know it, there are fewer windows of time where your machine can be blasting the Internet with spam If your machine is part of a botnet, you're already compromised and turning it off when you're not using it isn't going to fix that. It might marginally help _other_ people getting DDoSed or spammed by your PC, but it won't improve your own security. > Or if there's some network-based exploit, you're not vulnerable while your device is off I guess. But unless you become aware of the exploit and take measures to mitigate it before turning your PC on and connecting it to the internet, leaving it off when you're not using it is unlikely to help with this - you'll just be compromised as soon as you turn your PC on. Not to mention that the kind of zero-day that would allow compromising a fully up-to-date PC with nothing more than network access to it is extremely rare. I'd argue the security benefits of leaving your computer on so it can auto-install security updates while you're away probably outweighs any marginal benefits you might get from turning it off when not using it. (Though either way the difference is extremely minor.)

discreditable 10y ago
The article is from 2004. Keep in mind it's geared towards being very simple. I don't think some of the advice is good, such as deleting cmd.exe and command.com.

Avernar 10y ago

Except if you have a computer with Intel Management Engine or the AMD equivalent. Then it can be accessed when off. And mobile devices can be turned on remotely as well. You'd have to pull the plug or remove the battery to be truly off but nobody goes through that hassle. While currently it would take a state actor to do this eventually this will trickle down into to the hackers.

_eht 10y ago

I guess if your computer is already a spambot, just limiting the amount of time you are spamming isn't really solving the problem. What is the real advantage to spamming for eight working hours vs 24. For you, no advantage. Disadvantage goes to the spam operator, but again, who really cares at that point?