9 ms·

Security Guidelines for Congressional Campaigns

107 points by stablemap 9y ago

codinghorror 9y ago
Android: unsafe at any speed, apparently.
- tptacek 9y ago
  Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Campaign workers (or NGO employees) with "Android phones" are people that have every conceivable random phone that happens to be running some variant of Android.
  - arca_vorago 9y ago
    Not to mention even with a better android OS (I've finally switched to lineage from cyagenomod) is the thousand random applications users install. The best thing iOS and the Foss androids did was give more granular app permission control. In general my suggestion is people uninstall every app they don't "need" and to pay carefully attention to permissions. Even when I was an iOS user, all I needed was a terminal, from ssh, emacs, gnus, screen, etc.
  - marcoperaza 9y ago
    >Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. Who cares? Security conditional on expertise, extraordinary caution, and time investment is WORTHLESS. Security is more about guiding (or forcing) human beings to the right behavior than it is about making technical mechanisms available for the willing and able. Your security model should assume that the user is stupid, grossly negligent, and in the case they are the employee or other agent of an organization, somewhat hostile to the interests of the organization.
    - idlewords 9y ago
      I believe tqbf is just trying to head off unproductive Android vs. iOS arguments, and agrees with you.
  - ameliaquining 9y ago
    The security advice I give the non-tech people in my life is to get either an iPhone or a Pixel (or older phone made by Google). Is there any reason this isn't good enough? I vaguely recall that recent iPhones have a few useful crypto features that the Pixel still doesn't, but I'm not sure how much of a difference this makes. Certainly, I view the update situation as the primary reason not to use third-party Android phones, and the Pixel doesn't have that problem.
    - tptacek 9y ago
      Yes, there are reasons that's not good enough. It's not simply that you have to be careful what phone you pick, but also that you have to do things differently on Android phones, including Google's phones. At-risk nonspecialists should avoid all Android phones, and standardize on iPhones.
      - Anderkent 9y ago
        I'd be very interested in reading a longer-form blog / comment on this, if you ever feel like writing one.
  - Bromskloss 9y ago
    > We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Does that mean that there are other specific Android phones that one could have required instead? Or are you keeping silent about the real reason?
tptacek 9y ago
On the off chance this heads off any super-unproductive debates: When you're advising/training at-risk end users, it's not enough that it be possible to achieve some kind of security with a given load-out. It needs to be secure without trying hard. So for the purposes of this document, we don't really need to litigate this phone or that browser. We just have to note that for non-specialist end-users in high-stakes environments: * It has to work. * It has to stand a good chance of retaining secure without trying. * It has to be incredibly simple to get everyone set up the same way.
- codinghorror 9y ago
  A casual read says the safest easiest setup is everyone doing all their work on a recent iPhone model. Good news is, assuming the budget requirement can be met, this is pretty close to what is already happening for most people.
  - jsmthrowaway 9y ago
    Indeed; most Washington types who used to live on Blackberry (excluding those who haven’t yet had to give their precious up) moved to iPhones over Android, in my anecdotal experience. Outlook is the name of the game, and that runs quite well on iOS. Though it sounds like this training would push people toward the Gmail app, which is just fine. One point I would make is that it’s rather easy to make Siri only respond after unlocking, but that’s probably out of scope of this training — and not something staffers are going to remember. For added security, disable Hey Siri, too, because that’s a hot mic. (But again, scope.)
    - tptacek 9y ago
      Can we just all be clear that these aren't "Washington types" we're talking about? These are random businesspeople in random Congressional districts scattered throughout the US.
      - jsmthrowaway 9y ago
idlewords 9y ago
I want to give a little bit of context to this guide. So far I've done this training with six congressional campaigns, and a very similar one with about two dozen journalists. Everyone has a limited mental budget for security hassle, and it's a challenge to fit the most important bits of advice into that budget. The hardest bits are those things that are relatively easy to use, but a beast to set up—password managers and security keys. There's a lot more that could be in this guide, but I've found that it's the most material that I can fit into an hour, and even then the people running for office find it intimidating. However, they are also very glad to get actionable advice, and in a format that is not too technical. By far the most surprising thing to people on this list is the admonition to turn off anti-virus software.
- tptacek 9y ago
  The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.
  - idlewords 9y ago
    Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.
    - discoursism 9y ago
      Maybe the best thing to do is just ban attachments altogether at the domain admin level? https://support.google.com/a/answer/2364580?hl=en https://support.google.com/a/answer/2364580?hl=en
    - closeparen 9y ago
      Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?
walterbell 9y ago
The grugq (Nov 20) on campaign information security: https://medium.com/@thegrugq/campaign-information-security-ff6ac49966e1 https://medium.com/@thegrugq/campaign-information-security-f...
- tptacek 9y ago
  The Grugq's post is strong. The Harvard campaign security report he links to is not; it's actually pretty bad.
  - grugq 9y ago
    I didn't like their report which is why I wrote my guide.
jacobkg 9y ago
It would be worth adding to the article registering your Google account for the Advanced Protection Program: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
neandrake 9y ago
Does anyone have insight as to why they recommend only using Chrome, including using Tor with Chrome and not the Tor browser (fork of Firefox)? Is this just to keep things consistent or are there privacy/security concerns over using Firefox?
- qrbLPHiKpiux 9y ago
  I believe chrome does an outstandingly good job at sandboxing.
- idlewords 9y ago
  Firefox is less secure than Chrome, and the Tor browser is much more dangerous than Firefox. A secondary reason we recommend Chrome is that the FIDO security keys work with that browser, while I believe they don't work yet in Firefox.
  - jimrandomh 9y ago
    Could you elaborate on how the Tor browser is more dangerous than Firefox?
    - idlewords 9y ago
      To quote tqbf on this site, 'Do NOT EVER use Tor Browser. It's the least safe browser you can use: a lagged fork of Firefox for which whole classes of security bugs are potentially WONTFIX'd, and also the only browser that goes out of its way to collect high-value targets.'
      - j_s 9y ago
        src: A Guide to Not Getting Hacked | https://news.ycombinator.com/item?id=15733698 https://news.ycombinator.com/item?id=15733698 (15735789)(Nov2017:175points,78 comments) A very similar conversation to this one, but with more criticism of the advice in the associated article.
- jimrandomh 9y ago
revmoo 9y ago
This looks like a NSA checklist for things they'd prefer you to use in order to fall under the most backdoored stuff they have access to. If this is a legit document it makes me suspicous of iPhones and Signal. e: Like this line right here: "If you have a Windows laptop, make sure it's running Windows 10. " Yeah, being up-to-date on security patches is important but as far as I know, a patched 8.1 install doesn't have any known, open vulnerabilities that I'm aware of. Whereas Windows 10 is the first real OS that is susceptible to a NSL from the feds obligating MS to target specific systems on the next patch tuesday.
wonderous 9y ago
To me, “if you can remember your password, it is likely not strong enough“ — conflicts with suggesting it is okay for a user to use “a six-digit key code” on their iPhone. Any thoughts or clarifications?
- tptacek 9y ago
  Yes: your six-digit PIN is physically secured in ways your online passwords aren’t.
  - tonyztan 9y ago
    To expand on that, the iPhone hardware (secure encalve) limits the number and rate of PIN attempts. Depending on configuration, after a number of incorrect attempts, it either takes an increasingly long time to make a guess or just wipes the device (by destroying the encryption key).
- UncleMeat 9y ago
  This is pretty shitty advice. Online brute force attacks against passwords are rare. The only really important advice for passwords is never reuse anything. This is only achievable with a password manager. So the only really important advice is to use a password manager. Everything else is noise.
  - idlewords 9y ago
    My phrasing is a way of telling people to use a password manager that doesn't rely on them understanding what "password manager" means.
secfirstmd 9y ago
Sorry. I don't even know where to start here but so much of it is really bad advice that doesn't accurately make assessment of user workflows and effective threat modelling.
- idlewords 9y ago
  I'm open to criticism, so maybe pick the worst piece of advice and tell me what it should be instead?
  - kasey_junk 9y ago
    The fact that you don’t have a line item that says “Don’t feed the trolls” seems problematic.
    - idlewords 9y ago
      Trolls gotta eat
seanwilson 9y ago
> You must use an iPhone, model SE or later. Android phones are not safe to use. > If possible, consider getting a Chromebook. This is a simplified computer, far more secure than an ordinary laptop, that can only run the Chrome browser. Reducing attack vectors in this way seems very sensible to be honest. It's crazy to expect users to understand the ins and outs of computers to remain secure. I remember it being common that people would comment that you can't drive a car without a license so you should have something similar for being allowed to use a computer.
abrichr 9y ago
> Under no circumstances use the Tor browser (it's okay to use Tor, but do it with Chrome, and seek additional training on how to set it up). Is this just because Tor Browser prompts the user to update while Chrome updates silently on restart, or something else?
- tptacek 9y ago
  No, it's because Tor Browser is the worst possible combination of attributes: a lagged fork of what is currently (despite heroic efforts from Mozillians) the least secure mainstream browser, packaged in a way that disproportionate numbers of high-value targets use it.
  - grugq 9y ago
    Fully laid out and explained here: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...
fencepost 9y ago
I found this to have a lot of holes at best. If this is for end-users working with a campaign some of this might be appropriate, but really the campaign should have people in charge of security and a lot of things should be funneled through them. If this is for end-users then the advice about antivirus, etc. should be removed because that should NOT be an end-user decision. First thing: How is the campaign going to be operating and handling documents? Security for the scenarios is going to be different. * If it's going to be in one or more offices with tightly restricted access from outside those offices that's probably the best for security but may be less convenient. Primary approach: restrict access to a limited pool of "trusted" devices and keep those secure. * Entirely cloud-based (e.g. GMail, Google Docs, etc. or perhaps the business/enterprise Office365 and OneDrive). Primary approach: Tightly control document access at the storage side, probably primarily based on user accounts, while allowing many devices. * Using online storage but traditional desktop programs, etc. is a second option, but may be harder to control. Primary approach: None, this is a hybrid and I think it has all the weaknesses of both other approaches. Second, be aware of the kinds of threats you need to be ready for. Big areas of concern that jump out at me: * Data theft/exfiltration of sensitive campaign documents. * Data loss/destruction - via malicious trashing by an intruder or via failure of key systems. * Loss of access at key times - are there times where temporary loss of access to systems has a major impact? (I'm used to thinking in terms of electronic medical records for doctors' offices, where at the least a down EMR puts a huge crimp in ability to see patients.) * Possibly addressing of faked documents, but I'm not sure that's an internal security matter that can be addressed beyond being able to say with confidence "Our network has not been breached and we have access/audit logs to prove it." Focusing on what I'd recommend as the best option from a security standpoint (documents, etc. are stored within the network, documents can be accessed only from within the network, network access is tightly controlled, document storage is appropriately partitioned with security groups to limit access) some thoughts. This is also the kind of network I'm most familiar with - I'd never consider having any medical client using any kind of cloud storage for practice documents that could contain PHI/PII (Protected Health Information/Personally Identifiable Information). Re: Updates, absolutely, everything should be kept up-to-date. Ideally patch status, etc. should be monitored for all systems. This includes network equipment as well, most notably routers and any wireless equipment. Re: Anti-virus, I disagree - Choose a good managed AV product, use it, have someone whose job includes getting alerts from it and reviewing logs it generates. I'm partial to Bitdefender, but Emsisoft may also be a good choice and also uses Bitdefender's virus definitions as one component. I'd avoid Kaspersky these days. I say this because I see the logs for managed Bitdefender blocking of known and suspected phishing and malware sites and I get alerts when malware is blocked. A good AV product should also help protect against both hacked websites visited by campaign staff and spearphishing. Re: Email, why is this document talking about personal email? Do not use personal email for campaign work. Do not use personal email on campaign systems (assuming the "closed network" approach). If staff need to deal with personal email because their sister-in-law just sent them the newest Elf Bowling, they can do it on their phones and/or their own time. Re: Email, if using an email system that supports 2-factor auth, use it. Re: Email Attachments, assume malice. The advice to open documents on a phone instead is not unreasonable since the phone viewer is unlikely to have the same vulnerabilities as a desktop program. Viewing documents in a different program may also be a viable option, particularly if your internal use of that program isn't well known (e.g. Word-based attacks are unlikely to impact LibreOffice). Re: Email, Inbound email should be going through all sorts of filtering which may not stop all attacks but should at least be able to cut down on possible noise. As an example with Office365 Exchange, there are a bunch of options (under "International Spam") to block messages based on the language encoding, the country/region it was sent from, etc. Re: Passwords, 1Password is a good option. 1Password Teams is probably a better one. Re: Phones, the advice to use iPhones is probably good, particularly because current-enough iPhones all get software updates where Android phones from different vendors are all over the map. Possible exception: If you're using the all-cloud approach on Google services, the Pixel phones should be a viable choice. If feasible, something that can be remotely wiped (at least email) by a mail administrator is probably not a bad idea. Re: Laptops, yep, full disk encryption, etc. and never plug in USB devices, but on a management side assume that laptops are a weak point and take steps to ensure that the damage from a compromised laptop can be limited. Re: Wireless access for Phones, Laptops, Tablets, etc.: Consider not using Wifi AT ALL. If Wifi is used, lock it down to recognized devices, which should not include ANY personally owned devices, particularly including phones, tablets, etc. Any device that end-users are allowed to install software on is a device that should not be connecting directly to your network. If you're unfortunate enough to have a campaign office in the basement of a steel building, set up a separate "Devices" network (still with authentication) that those devices can connect to. Re: Messaging, yep, Signal. Regard just about anything else particularly including SMS as being plain-text that a skilled attacker could read. Also be wary of apps like Join, MightyText, etc. that allow handling of messages and device notifications from desktops. Re: Browser, I'm not sure I agree with a Chrome-only approach (why no Firefox?), but I don't have a big problem with it. One advantage particularly for individual installations is that it will auto-update in the background, and with process-per-tab I believe new tabs will get created on updated versions (can anyone who's read this wall of text confirm?). I agree with the use of uBlock Origin and HTTPS Everywhere - compromised ad networks particularly with targeted ads could be a real risk. Re: Mobile Browser, Even more than incognito mode, Firefox Focus may be a good choice as a default for browsing that doesn't require logins to sites. Did I leave any gaping holes? This is kind of off the top of my head.
MechEStudent 9y ago
Is this written by the Russians? The Chinese? Are you kidding? iPhone or Android? They are both highly porous and highly perforated. Gmail? Chrome? Here is some on secure browsers: https://www.techworld.com/security/best-8-secure-browsers-3246550/ https://www.techworld.com/security/best-8-secure-browsers-32... Boeing Black? https://economictimes.indiatimes.com/slideshows/tech-life/5-most-secure-smartphones-in-the-world/boeing-black/slideshow/53883006.cms https://economictimes.indiatimes.com/slideshows/tech-life/5-... ... just a little work would give something actually secure. This is like playing charades with guns.
- my_first_acct 9y ago
  In the secure-browser article cited in the parent comment, number eight is the Yandex Browser. Quoting from the article: "Yandex, which is based on Chromium, uses the 'Blink' engine which runs checks through downloads and even uses Kaspersky's antivirus to scan for malicious content." I find this recommendation a bit surprising.
seanieb 9y ago
Without teaching folks what a password manager is and how to use it, it's useless advice. I've seen folks use 1Password with their old password for everything... A 2min demo and an explanation why they should use unique passwords is needed for most.
- idlewords 9y ago
  That's one of the reasons a text guide isn't enough, you need a briefing. Also, the installation procedure for 1password is an absolute nightmare. Ideally people shouldn't even see it.
lordofmoria 9y ago
Very good advice. Couple thoughts: First, Google’s Password Alert extension should be added to the list of extensions. Best protection against spear phishing. Secondly, “Assume that anything you say on Slack or in Twitter direct messages will one day be public. It's fine to use Slack for coordinating and organizing, but be mindful of the conversations you have there. Move private discussions to Signal.” This “eventually public” argument they say is the best framing of the benefit of end-to-end encryption I’ve seen so far. It’s not about “hackers could hack Slack and own your data now!” as much as “eventually any interesting cloud data that’s unencrypted will be made public.”
gok 9y ago
> Siri can reveal information about your contacts even when the phone is locked. So can swiping to the right on iOS 11... or just getting a message notification from Signal with its default settings. For that matter, shouldn’t this guide contain some guidelines about where your contacts should be stored if that’s considered sensitive?
Teodolfo 9y ago
The guide suggests gmail and two factor, but why not also https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ ?
blfr 9y ago
This is the same advice I give to my mom. Especially opening everything she receives, in particular from her students, through Google Drive/Docs. However, do you really trust Google to be the safekeeper of important data for elections? This is at most a temporarily valid advice for democrats.
invisiblep 9y ago
@tptacek and @idlewords can you share how you are teaching these non-tech people how to use a password manager? In my experience it's far from intuitive even if you're using 1Password. Just the first step of explaining how to create a master password that is strong enough to protect all the other secrets is a challenge. I try and describe the diceware process because it will yield a better result than what the user will come up with. Anything you can share would be appreciated.

107 points by stablemap 9y ago

codinghorror 9y ago

Android: unsafe at any speed, apparently.

tptacek 9y ago
Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Campaign workers (or NGO employees) with "Android phones" are people that have every conceivable random phone that happens to be running some variant of Android.
- arca_vorago 9y ago
  Not to mention even with a better android OS (I've finally switched to lineage from cyagenomod) is the thousand random applications users install. The best thing iOS and the Foss androids did was give more granular app permission control. In general my suggestion is people uninstall every app they don't "need" and to pay carefully attention to permissions. Even when I was an iOS user, all I needed was a terminal, from ssh, emacs, gnus, screen, etc.
- marcoperaza 9y ago
  >Specialists with carefully chosen phones can achieve security that is asymptotically as good as a recent iPhone. Who cares? Security conditional on expertise, extraordinary caution, and time investment is WORTHLESS. Security is more about guiding (or forcing) human beings to the right behavior than it is about making technical mechanisms available for the willing and able. Your security model should assume that the user is stupid, grossly negligent, and in the case they are the employee or other agent of an organization, somewhat hostile to the interests of the organization.
  - idlewords 9y ago
    I believe tqbf is just trying to head off unproductive Android vs. iOS arguments, and agrees with you.
- ameliaquining 9y ago
  The security advice I give the non-tech people in my life is to get either an iPhone or a Pixel (or older phone made by Google). Is there any reason this isn't good enough? I vaguely recall that recent iPhones have a few useful crypto features that the Pixel still doesn't, but I'm not sure how much of a difference this makes. Certainly, I view the update situation as the primary reason not to use third-party Android phones, and the Pixel doesn't have that problem.
  - tptacek 9y ago
    Yes, there are reasons that's not good enough. It's not simply that you have to be careful what phone you pick, but also that you have to do things differently on Android phones, including Google's phones. At-risk nonspecialists should avoid all Android phones, and standardize on iPhones.
    - Anderkent 9y ago
      I'd be very interested in reading a longer-form blog / comment on this, if you ever feel like writing one.
- Bromskloss 9y ago
  > We can spare ourselves the world's dumbest HN thread if we stipulate that by far the largest problem with Android is that it means a zillion different things. Does that mean that there are other specific Android phones that one could have required instead? Or are you keeping silent about the real reason?

tptacek 9y ago

On the off chance this heads off any super-unproductive debates: When you're advising/training at-risk end users, it's not enough that it be possible to achieve some kind of security with a given load-out. It needs to be secure without trying hard. So for the purposes of this document, we don't really need to litigate this phone or that browser. We just have to note that for non-specialist end-users in high-stakes environments: * It has to work. * It has to stand a good chance of retaining secure without trying. * It has to be incredibly simple to get everyone set up the same way.

codinghorror 9y ago
A casual read says the safest easiest setup is everyone doing all their work on a recent iPhone model. Good news is, assuming the budget requirement can be met, this is pretty close to what is already happening for most people.
- jsmthrowaway 9y ago
  Indeed; most Washington types who used to live on Blackberry (excluding those who haven’t yet had to give their precious up) moved to iPhones over Android, in my anecdotal experience. Outlook is the name of the game, and that runs quite well on iOS. Though it sounds like this training would push people toward the Gmail app, which is just fine. One point I would make is that it’s rather easy to make Siri only respond after unlocking, but that’s probably out of scope of this training — and not something staffers are going to remember. For added security, disable Hey Siri, too, because that’s a hot mic. (But again, scope.)
  - tptacek 9y ago
    Can we just all be clear that these aren't "Washington types" we're talking about? These are random businesspeople in random Congressional districts scattered throughout the US.
    - jsmthrowaway 9y ago

idlewords 9y ago

I want to give a little bit of context to this guide. So far I've done this training with six congressional campaigns, and a very similar one with about two dozen journalists. Everyone has a limited mental budget for security hassle, and it's a challenge to fit the most important bits of advice into that budget. The hardest bits are those things that are relatively easy to use, but a beast to set up—password managers and security keys. There's a lot more that could be in this guide, but I've found that it's the most material that I can fit into an hour, and even then the people running for office find it intimidating. However, they are also very glad to get actionable advice, and in a format that is not too technical. By far the most surprising thing to people on this list is the admonition to turn off anti-virus software.

tptacek 9y ago
The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.
- idlewords 9y ago
  Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.
  - discoursism 9y ago
    Maybe the best thing to do is just ban attachments altogether at the domain admin level? https://support.google.com/a/answer/2364580?hl=en https://support.google.com/a/answer/2364580?hl=en
  - closeparen 9y ago
    Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?

walterbell 9y ago

The grugq (Nov 20) on campaign information security: https://medium.com/@thegrugq/campaign-information-security-ff6ac49966e1 https://medium.com/@thegrugq/campaign-information-security-f...

tptacek 9y ago
The Grugq's post is strong. The Harvard campaign security report he links to is not; it's actually pretty bad.
- grugq 9y ago
  I didn't like their report which is why I wrote my guide.

jacobkg 9y ago

It would be worth adding to the article registering your Google account for the Advanced Protection Program: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/

neandrake 9y ago

Does anyone have insight as to why they recommend only using Chrome, including using Tor with Chrome and not the Tor browser (fork of Firefox)? Is this just to keep things consistent or are there privacy/security concerns over using Firefox?

qrbLPHiKpiux 9y ago
I believe chrome does an outstandingly good job at sandboxing.
idlewords 9y ago
Firefox is less secure than Chrome, and the Tor browser is much more dangerous than Firefox. A secondary reason we recommend Chrome is that the FIDO security keys work with that browser, while I believe they don't work yet in Firefox.
- jimrandomh 9y ago
  Could you elaborate on how the Tor browser is more dangerous than Firefox?
  - idlewords 9y ago
    To quote tqbf on this site, 'Do NOT EVER use Tor Browser. It's the least safe browser you can use: a lagged fork of Firefox for which whole classes of security bugs are potentially WONTFIX'd, and also the only browser that goes out of its way to collect high-value targets.'
    - j_s 9y ago
      src: A Guide to Not Getting Hacked | https://news.ycombinator.com/item?id=15733698 https://news.ycombinator.com/item?id=15733698 (15735789)(Nov2017:175points,78 comments) A very similar conversation to this one, but with more criticism of the advice in the associated article.
jimrandomh 9y ago

revmoo 9y ago

This looks like a NSA checklist for things they'd prefer you to use in order to fall under the most backdoored stuff they have access to. If this is a legit document it makes me suspicous of iPhones and Signal. e: Like this line right here: "If you have a Windows laptop, make sure it's running Windows 10. " Yeah, being up-to-date on security patches is important but as far as I know, a patched 8.1 install doesn't have any known, open vulnerabilities that I'm aware of. Whereas Windows 10 is the first real OS that is susceptible to a NSL from the feds obligating MS to target specific systems on the next patch tuesday.

wonderous 9y ago

To me, “if you can remember your password, it is likely not strong enough“ — conflicts with suggesting it is okay for a user to use “a six-digit key code” on their iPhone. Any thoughts or clarifications?

tptacek 9y ago
Yes: your six-digit PIN is physically secured in ways your online passwords aren’t.
- tonyztan 9y ago
  To expand on that, the iPhone hardware (secure encalve) limits the number and rate of PIN attempts. Depending on configuration, after a number of incorrect attempts, it either takes an increasingly long time to make a guess or just wipes the device (by destroying the encryption key).
UncleMeat 9y ago
This is pretty shitty advice. Online brute force attacks against passwords are rare. The only really important advice for passwords is never reuse anything. This is only achievable with a password manager. So the only really important advice is to use a password manager. Everything else is noise.
- idlewords 9y ago
  My phrasing is a way of telling people to use a password manager that doesn't rely on them understanding what "password manager" means.

secfirstmd 9y ago

Sorry. I don't even know where to start here but so much of it is really bad advice that doesn't accurately make assessment of user workflows and effective threat modelling.

idlewords 9y ago
I'm open to criticism, so maybe pick the worst piece of advice and tell me what it should be instead?
- kasey_junk 9y ago
  The fact that you don’t have a line item that says “Don’t feed the trolls” seems problematic.
  - idlewords 9y ago
    Trolls gotta eat

seanwilson 9y ago

> You must use an iPhone, model SE or later. Android phones are not safe to use. > If possible, consider getting a Chromebook. This is a simplified computer, far more secure than an ordinary laptop, that can only run the Chrome browser. Reducing attack vectors in this way seems very sensible to be honest. It's crazy to expect users to understand the ins and outs of computers to remain secure. I remember it being common that people would comment that you can't drive a car without a license so you should have something similar for being allowed to use a computer.

abrichr 9y ago

> Under no circumstances use the Tor browser (it's okay to use Tor, but do it with Chrome, and seek additional training on how to set it up). Is this just because Tor Browser prompts the user to update while Chrome updates silently on restart, or something else?

tptacek 9y ago
No, it's because Tor Browser is the worst possible combination of attributes: a lagged fork of what is currently (despite heroic efforts from Mozillians) the least secure mainstream browser, packaged in a way that disproportionate numbers of high-value targets use it.
- grugq 9y ago
  Fully laid out and explained here: https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908 https://medium.com/@thegrugq/tor-and-its-discontents-ef51648...

fencepost 9y ago

I found this to have a lot of holes at best. If this is for end-users working with a campaign some of this might be appropriate, but really the campaign should have people in charge of security and a lot of things should be funneled through them. If this is for end-users then the advice about antivirus, etc. should be removed because that should NOT be an end-user decision. First thing: How is the campaign going to be operating and handling documents? Security for the scenarios is going to be different. * If it's going to be in one or more offices with tightly restricted access from outside those offices that's probably the best for security but may be less convenient. Primary approach: restrict access to a limited pool of "trusted" devices and keep those secure. * Entirely cloud-based (e.g. GMail, Google Docs, etc. or perhaps the business/enterprise Office365 and OneDrive). Primary approach: Tightly control document access at the storage side, probably primarily based on user accounts, while allowing many devices. * Using online storage but traditional desktop programs, etc. is a second option, but may be harder to control. Primary approach: None, this is a hybrid and I think it has all the weaknesses of both other approaches. Second, be aware of the kinds of threats you need to be ready for. Big areas of concern that jump out at me: * Data theft/exfiltration of sensitive campaign documents. * Data loss/destruction - via malicious trashing by an intruder or via failure of key systems. * Loss of access at key times - are there times where temporary loss of access to systems has a major impact? (I'm used to thinking in terms of electronic medical records for doctors' offices, where at the least a down EMR puts a huge crimp in ability to see patients.) * Possibly addressing of faked documents, but I'm not sure that's an internal security matter that can be addressed beyond being able to say with confidence "Our network has not been breached and we have access/audit logs to prove it." Focusing on what I'd recommend as the best option from a security standpoint (documents, etc. are stored within the network, documents can be accessed only from within the network, network access is tightly controlled, document storage is appropriately partitioned with security groups to limit access) some thoughts. This is also the kind of network I'm most familiar with - I'd never consider having any medical client using any kind of cloud storage for practice documents that could contain PHI/PII (Protected Health Information/Personally Identifiable Information). Re: Updates, absolutely, everything should be kept up-to-date. Ideally patch status, etc. should be monitored for all systems. This includes network equipment as well, most notably routers and any wireless equipment. Re: Anti-virus, I disagree - Choose a good managed AV product, use it, have someone whose job includes getting alerts from it and reviewing logs it generates. I'm partial to Bitdefender, but Emsisoft may also be a good choice and also uses Bitdefender's virus definitions as one component. I'd avoid Kaspersky these days. I say this because I see the logs for managed Bitdefender blocking of known and suspected phishing and malware sites and I get alerts when malware is blocked. A good AV product should also help protect against both hacked websites visited by campaign staff and spearphishing. Re: Email, why is this document talking about personal email? Do not use personal email for campaign work. Do not use personal email on campaign systems (assuming the "closed network" approach). If staff need to deal with personal email because their sister-in-law just sent them the newest Elf Bowling, they can do it on their phones and/or their own time. Re: Email, if using an email system that supports 2-factor auth, use it. Re: Email Attachments, assume malice. The advice to open documents on a phone instead is not unreasonable since the phone viewer is unlikely to have the same vulnerabilities as a desktop program. Viewing documents in a different program may also be a viable option, particularly if your internal use of that program isn't well known (e.g. Word-based attacks are unlikely to impact LibreOffice). Re: Email, Inbound email should be going through all sorts of filtering which may not stop all attacks but should at least be able to cut down on possible noise. As an example with Office365 Exchange, there are a bunch of options (under "International Spam") to block messages based on the language encoding, the country/region it was sent from, etc. Re: Passwords, 1Password is a good option. 1Password Teams is probably a better one. Re: Phones, the advice to use iPhones is probably good, particularly because current-enough iPhones all get software updates where Android phones from different vendors are all over the map. Possible exception: If you're using the all-cloud approach on Google services, the Pixel phones should be a viable choice. If feasible, something that can be remotely wiped (at least email) by a mail administrator is probably not a bad idea. Re: Laptops, yep, full disk encryption, etc. and never plug in USB devices, but on a management side assume that laptops are a weak point and take steps to ensure that the damage from a compromised laptop can be limited. Re: Wireless access for Phones, Laptops, Tablets, etc.: Consider not using Wifi AT ALL. If Wifi is used, lock it down to recognized devices, which should not include ANY personally owned devices, particularly including phones, tablets, etc. Any device that end-users are allowed to install software on is a device that should not be connecting directly to your network. If you're unfortunate enough to have a campaign office in the basement of a steel building, set up a separate "Devices" network (still with authentication) that those devices can connect to. Re: Messaging, yep, Signal. Regard just about anything else particularly including SMS as being plain-text that a skilled attacker could read. Also be wary of apps like Join, MightyText, etc. that allow handling of messages and device notifications from desktops. Re: Browser, I'm not sure I agree with a Chrome-only approach (why no Firefox?), but I don't have a big problem with it. One advantage particularly for individual installations is that it will auto-update in the background, and with process-per-tab I believe new tabs will get created on updated versions (can anyone who's read this wall of text confirm?). I agree with the use of uBlock Origin and HTTPS Everywhere - compromised ad networks particularly with targeted ads could be a real risk. Re: Mobile Browser, Even more than incognito mode, Firefox Focus may be a good choice as a default for browsing that doesn't require logins to sites. Did I leave any gaping holes? This is kind of off the top of my head.

MechEStudent 9y ago

Is this written by the Russians? The Chinese? Are you kidding? iPhone or Android? They are both highly porous and highly perforated. Gmail? Chrome? Here is some on secure browsers: https://www.techworld.com/security/best-8-secure-browsers-3246550/ https://www.techworld.com/security/best-8-secure-browsers-32... Boeing Black? https://economictimes.indiatimes.com/slideshows/tech-life/5-most-secure-smartphones-in-the-world/boeing-black/slideshow/53883006.cms https://economictimes.indiatimes.com/slideshows/tech-life/5-... ... just a little work would give something actually secure. This is like playing charades with guns.

my_first_acct 9y ago
In the secure-browser article cited in the parent comment, number eight is the Yandex Browser. Quoting from the article: "Yandex, which is based on Chromium, uses the 'Blink' engine which runs checks through downloads and even uses Kaspersky's antivirus to scan for malicious content." I find this recommendation a bit surprising.

seanieb 9y ago

Without teaching folks what a password manager is and how to use it, it's useless advice. I've seen folks use 1Password with their old password for everything... A 2min demo and an explanation why they should use unique passwords is needed for most.

idlewords 9y ago
That's one of the reasons a text guide isn't enough, you need a briefing. Also, the installation procedure for 1password is an absolute nightmare. Ideally people shouldn't even see it.

lordofmoria 9y ago

Very good advice. Couple thoughts: First, Google’s Password Alert extension should be added to the list of extensions. Best protection against spear phishing. Secondly, “Assume that anything you say on Slack or in Twitter direct messages will one day be public. It's fine to use Slack for coordinating and organizing, but be mindful of the conversations you have there. Move private discussions to Signal.” This “eventually public” argument they say is the best framing of the benefit of end-to-end encryption I’ve seen so far. It’s not about “hackers could hack Slack and own your data now!” as much as “eventually any interesting cloud data that’s unencrypted will be made public.”

gok 9y ago

> Siri can reveal information about your contacts even when the phone is locked. So can swiping to the right on iOS 11... or just getting a message notification from Signal with its default settings. For that matter, shouldn’t this guide contain some guidelines about where your contacts should be stored if that’s considered sensitive?

Teodolfo 9y ago

The guide suggests gmail and two factor, but why not also https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ ?

blfr 9y ago

This is the same advice I give to my mom. Especially opening everything she receives, in particular from her students, through Google Drive/Docs. However, do you really trust Google to be the safekeeper of important data for elections? This is at most a temporarily valid advice for democrats.

invisiblep 9y ago

@tptacek and @idlewords can you share how you are teaching these non-tech people how to use a password manager? In my experience it's far from intuitive even if you're using 1Password. Just the first step of explaining how to create a master password that is strong enough to protect all the other secrets is a challenge. I try and describe the diceware process because it will yield a better result than what the user will come up with. Anything you can share would be appreciated.