7 ms·

Interesting list, thanks for posting. I'm curious about the rationale of several points on this list. Why shouldn't you use an Android phone but at the same tim

Interesting list, thanks for posting. I'm curious about the rationale of several points on this list. Why shouldn't you use an Android phone but at the same time Chromebooks are recommended? I'm also surprised about uninstalling any antivirus products except for Windows Defender. I understand some companies are moving to CrowdStrike/Carbon Black, but what about individual users or smaller companies. Also, is there a similar list for small companies focused on remote working?

tptacek 10y ago
Because Chromebooks are more secure than Windows, Linux, or Mac laptops, but Android is markedly less secure than iOS. This isn't about which is our favorite company; it's about what the best options are for ordinary users. If you know exactly what you're doing, and you're using a Google phone, you might be able to get approximately the same security out of an Android device as an iOS device. But ordinary users have no chance.
- notspanishflu 10y ago
  Thank you for the list. Can you help me to understand the validity of this statement [0]? > When used with the best practices for web security, the Chromebook is secure against most direct attacks on the local hardware and the Chrome browser, but its dependence on a web-based backend where US courts have already ruled there's less of an expectation of privacy is something no amount of end-point security is going to fix. [0] https://arstechnica.com/information-technology/2013/09/why-the-nsa-loves-googles-chromebook/ https://arstechnica.com/information-technology/2013/09/why-t...
  - tptacek 10y ago
    Files stored on cloud services have less legal protection in the US than files stored locally. Not "no" protection, but less.
    - notspanishflu 10y ago
      But that translates to zero effective protection if the US government is interested in what a journalist is writing with his/her Chromebook.
      - evgen 10y ago
        While what you present is a possible extreme end result it is highly unlikely, and the level of attention would have to be far above just being 'interested' in the work of the journalist. The US government does not care about the work of 99.9999% of the journalists out there and if you are in the group that they care about you know it and are probably going to be using a less user-friendly but more secure process. Contra claims by the tinfoil crowd, Google is not in the habit of giving up info without fighting against the request so this option provides very strong protection for almost all of the potential audience for this.
        notspanishflu 10y ago
        Google is not in the habit but NSA is, as Snowden told us.
        notspanishflu 10y ago
        I would like to know why some people downvoted this comment. Is my statement false? Please, explain why you think so. I expect an intelligent interaction here in HN.
        willstrafach 10y ago
        For US Persons anyway, they cannot get such data without a warrant, you are mistaken (I did not downvote you btw, as your interpretation is semi-common).
        notspanishflu 10y ago
- voltagex_ 10y ago
  Is there any hope for Android at this point? I like the freedom to hack on my phone, but it's quickly feeling like I'll need to get an iPhone for real work and leave the Android stuff as a hobby.
  - tptacek 10y ago
    At least on Google's own phones, Android is improving continuously. When they get to the point where they're comparably secure, the guide will be updated. As you can see: it's not anti-Google bias producing that recommendation: the guide also says to use Chrome, and Chromebooks if possible.
    - Niten 10y ago
      If you don't mind elaborating, what do you consider the most important security properties still missing from Android on the Pixel phone? My personal wishlist would include an equivalent of iOS's ability to encrypt new files to a public key while the phone is locked, as pointed out by Matt Green in "The limitations of Android N Encryption", but I'm interested in your perspective.
      - voltagex_ 10y ago
        From the top of my head: * Pair locking [1] * Updates for longer than 18 months [2] 1: https://www.zdziarski.com/blog/?p=2589 https://www.zdziarski.com/blog/?p=2589 - There was a more up to date guide but I can't find it. 2: https://www.businessinsider.com.au/apple-ios-10-iphone-software-update-2016-9 https://www.businessinsider.com.au/apple-ios-10-iphone-softw...
technion 10y ago
Regarding antivirus, I can only suggest - talk to someone who has worked at an MSP for a while. Companies with minimally or ad-hoc supported environments are nearly always dealing with various outbreaks (I mean literally daily), and yet the one thing they are always doing for security is buying McAfee or SEP because it's the one thing an auditor from an accounting firm told them to do. Have a look at actual detection logs across several thousand machines. You'll see silly things like "tracking cookies" show up ("glad we bought that antivirus!!"), but blocked malware will be far more rare than actual outbreaks. This will leave you with the view that they are not effective. Then, talk to the sales team there. Often the only thing they can tell you about AV is that, aside from Office 365, it's the only guaranteed subscription service a client will sign up to. So now you know why having AV is a big deal. Then look at how many hours get burned on things like "slow servers", where you find your Linux PostgreSQL server is configured with its database being scanned on write. And politically, it's easier to upgrade RAM and CPU than to try and exclude the database. So now you're just totally jaded on AV wish the whole industry didn't exist. I've never seen a bad Defender update nuke a running Windows installation, which I cannot say for any popular product. Look at last week's Webroot meltdown.

tptacek 10y ago

Because Chromebooks are more secure than Windows, Linux, or Mac laptops, but Android is markedly less secure than iOS. This isn't about which is our favorite company; it's about what the best options are for ordinary users. If you know exactly what you're doing, and you're using a Google phone, you might be able to get approximately the same security out of an Android device as an iOS device. But ordinary users have no chance.

notspanishflu 10y ago
Thank you for the list. Can you help me to understand the validity of this statement [0]? > When used with the best practices for web security, the Chromebook is secure against most direct attacks on the local hardware and the Chrome browser, but its dependence on a web-based backend where US courts have already ruled there's less of an expectation of privacy is something no amount of end-point security is going to fix. [0] https://arstechnica.com/information-technology/2013/09/why-the-nsa-loves-googles-chromebook/ https://arstechnica.com/information-technology/2013/09/why-t...
- tptacek 10y ago
  Files stored on cloud services have less legal protection in the US than files stored locally. Not "no" protection, but less.
  - notspanishflu 10y ago
    But that translates to zero effective protection if the US government is interested in what a journalist is writing with his/her Chromebook.
    - evgen 10y ago
      While what you present is a possible extreme end result it is highly unlikely, and the level of attention would have to be far above just being 'interested' in the work of the journalist. The US government does not care about the work of 99.9999% of the journalists out there and if you are in the group that they care about you know it and are probably going to be using a less user-friendly but more secure process. Contra claims by the tinfoil crowd, Google is not in the habit of giving up info without fighting against the request so this option provides very strong protection for almost all of the potential audience for this.
      - notspanishflu 10y ago
        Google is not in the habit but NSA is, as Snowden told us.
        notspanishflu 10y ago
        I would like to know why some people downvoted this comment. Is my statement false? Please, explain why you think so. I expect an intelligent interaction here in HN.
        willstrafach 10y ago
        For US Persons anyway, they cannot get such data without a warrant, you are mistaken (I did not downvote you btw, as your interpretation is semi-common).
        notspanishflu 10y ago
voltagex_ 10y ago
Is there any hope for Android at this point? I like the freedom to hack on my phone, but it's quickly feeling like I'll need to get an iPhone for real work and leave the Android stuff as a hobby.
- tptacek 10y ago
  At least on Google's own phones, Android is improving continuously. When they get to the point where they're comparably secure, the guide will be updated. As you can see: it's not anti-Google bias producing that recommendation: the guide also says to use Chrome, and Chromebooks if possible.
  - Niten 10y ago
    If you don't mind elaborating, what do you consider the most important security properties still missing from Android on the Pixel phone? My personal wishlist would include an equivalent of iOS's ability to encrypt new files to a public key while the phone is locked, as pointed out by Matt Green in "The limitations of Android N Encryption", but I'm interested in your perspective.
    - voltagex_ 10y ago
      From the top of my head: * Pair locking [1] * Updates for longer than 18 months [2] 1: https://www.zdziarski.com/blog/?p=2589 https://www.zdziarski.com/blog/?p=2589 - There was a more up to date guide but I can't find it. 2: https://www.businessinsider.com.au/apple-ios-10-iphone-software-update-2016-9 https://www.businessinsider.com.au/apple-ios-10-iphone-softw...

technion 10y ago

Regarding antivirus, I can only suggest - talk to someone who has worked at an MSP for a while. Companies with minimally or ad-hoc supported environments are nearly always dealing with various outbreaks (I mean literally daily), and yet the one thing they are always doing for security is buying McAfee or SEP because it's the one thing an auditor from an accounting firm told them to do. Have a look at actual detection logs across several thousand machines. You'll see silly things like "tracking cookies" show up ("glad we bought that antivirus!!"), but blocked malware will be far more rare than actual outbreaks. This will leave you with the view that they are not effective. Then, talk to the sales team there. Often the only thing they can tell you about AV is that, aside from Office 365, it's the only guaranteed subscription service a client will sign up to. So now you know why having AV is a big deal. Then look at how many hours get burned on things like "slow servers", where you find your Linux PostgreSQL server is configured with its database being scanned on write. And politically, it's easier to upgrade RAM and CPU than to try and exclude the database. So now you're just totally jaded on AV wish the whole industry didn't exist. I've never seen a bad Defender update nuke a running Windows installation, which I cannot say for any popular product. Look at last week's Webroot meltdown.