4 ms·

I want to give a little bit of context to this guide. So far I've done this training with six congressional campaigns, and a very similar one with about two doz

I want to give a little bit of context to this guide. So far I've done this training with six congressional campaigns, and a very similar one with about two dozen journalists. Everyone has a limited mental budget for security hassle, and it's a challenge to fit the most important bits of advice into that budget. The hardest bits are those things that are relatively easy to use, but a beast to set up—password managers and security keys. There's a lot more that could be in this guide, but I've found that it's the most material that I can fit into an hour, and even then the people running for office find it intimidating. However, they are also very glad to get actionable advice, and in a format that is not too technical. By far the most surprising thing to people on this list is the admonition to turn off anti-virus software.

tptacek 9y ago
The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.
- idlewords 9y ago
  Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.
  - discoursism 9y ago
    Maybe the best thing to do is just ban attachments altogether at the domain admin level? https://support.google.com/a/answer/2364580?hl=en https://support.google.com/a/answer/2364580?hl=en
  - closeparen 9y ago
    Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?
    - pharrington 9y ago
      Is there a standard workflow for talking to sources?
      - closeparen 9y ago
        No, but there certainly is for filing stories and running them through a series of editing desks.
    - jsmthrowaway 9y ago
      Keep in mind "journalist" is a broad term now. Most blogs or new media mastheads work that way or track changes in Google Docs/G Suite/whatever. In general, I'd assume you're right about traditional papers, who I'd expect to work the way you suggest. Smart money is following what WaPo is doing in that space with Arc. They've begun to corner that market.
- tedunangst 9y ago
  I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbates phishing. I think U2F probably helps a lot here, but I would really push to move away from web based workflows. It puts a lot of really dangerous UI all in the same window. In a world where people use Outlook (or pine, harhar) they don't type their all powerful email password into the browser because why the hell would the browser ever ask for the email password. But I think that ship has sunk.
  - blfr 9y ago
    First, running things locally opens you to local exploits which, once successful, can capture not only your email password but everything else you do on a computer. Second, with a password manager, users shouldn't be typing passwords in. I don't even know my Gmail password.
deleted 9y ago
[deleted]
616c 9y ago
I live in DC, with socialize with many others in a similar professional situation as infosec people. I'll read your site again to not wait on answer here, I'm a huge fan of you after reading your longform stuff on Yemen and seeing your mention of the TS idea before on HN 1-2 years ago. Is there any need for volunteers on the ground. What can I do to help you?
philipodonnell 9y ago
Can you briefly explain about turning off anti-virus? I see that but nothing about why, or why Windows Defender is still ok and how that differs from the general category of anti virus? Maybe its in your course so you don't want to spill the beans, but all of your other advice seems consistently good, this one could use some more explanation for the uninitiated who have heard the exact opposite for, like, ever. :-)
- 3pt14159 9y ago
  Because intelligence agencies buy or hack antivirus software because its access patterns don't look suspicious. Scanning your harddrive and uploading random contents? What AV is supposed to be doing. Windows Defender is different because if Microsoft wants to fuck you and you're using Windows, they already can.
- Anderkent 9y ago
  The problem is that many AVs are not tested well, and prone to actually making you more vulnerable by bugs in their analysis code. Basically, think of receiving an email with a malware attachment. If you have good hygiene, you won't open it yourself. But your AV will open it to 'scan' it, and that gives it an opportunity to compromise it. Add the fact that most AV runs with high privileges and is not sandboxes, and this is a pretty bad state.
- UncleMeat 9y ago
  AV only detects already known malware, and often poorly. As a trade off you are running highly privileged code that fundamentally needs to process untrusted input and is often of low quality. For a high interest target, AV software opens up more holes than it closes.
IBM 9y ago
An iPad should be just as secure as an iPhone, right? I'm sure that's much more common and an easier sell than a Chromebook in D.C.
- codinghorror 9y ago
  Yeah this is a good point plus the latest iPad Pro is amazing, performance and feature wise.
technion 9y ago
I want to throw some anecdata on this. Someone I know could be considered a high profile target. A few months back I helped him migrate from Internet Explorer, to Chrome. I was onsite for most of an afternoon helping the process. For the next few weeks I received phone calls because he was lost and needed help. I've seen Reddit comments on people in similar positions with statements like "they should be on Qubes OS, period" or "they should use Tails only" or "anyone in that position should be using deblobbed Thinkpad". I can only tell those commentators they have tried to help such a person. Thank you for a much more realistic view on the situation.

tptacek 9y ago

The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.

idlewords 9y ago
Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.
- discoursism 9y ago
  Maybe the best thing to do is just ban attachments altogether at the domain admin level? https://support.google.com/a/answer/2364580?hl=en https://support.google.com/a/answer/2364580?hl=en
- closeparen 9y ago
  Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?
  - pharrington 9y ago
    Is there a standard workflow for talking to sources?
    - closeparen 9y ago
      No, but there certainly is for filing stories and running them through a series of editing desks.
  - jsmthrowaway 9y ago
    Keep in mind "journalist" is a broad term now. Most blogs or new media mastheads work that way or track changes in Google Docs/G Suite/whatever. In general, I'd assume you're right about traditional papers, who I'd expect to work the way you suggest. Smart money is following what WaPo is doing in that space with Arc. They've begun to corner that market.
tedunangst 9y ago
I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbates phishing. I think U2F probably helps a lot here, but I would really push to move away from web based workflows. It puts a lot of really dangerous UI all in the same window. In a world where people use Outlook (or pine, harhar) they don't type their all powerful email password into the browser because why the hell would the browser ever ask for the email password. But I think that ship has sunk.
- blfr 9y ago
  First, running things locally opens you to local exploits which, once successful, can capture not only your email password but everything else you do on a computer. Second, with a password manager, users shouldn't be typing passwords in. I don't even know my Gmail password.

deleted 9y ago

[deleted]

616c 9y ago

I live in DC, with socialize with many others in a similar professional situation as infosec people. I'll read your site again to not wait on answer here, I'm a huge fan of you after reading your longform stuff on Yemen and seeing your mention of the TS idea before on HN 1-2 years ago. Is there any need for volunteers on the ground. What can I do to help you?

philipodonnell 9y ago

Can you briefly explain about turning off anti-virus? I see that but nothing about why, or why Windows Defender is still ok and how that differs from the general category of anti virus? Maybe its in your course so you don't want to spill the beans, but all of your other advice seems consistently good, this one could use some more explanation for the uninitiated who have heard the exact opposite for, like, ever. :-)

3pt14159 9y ago
Because intelligence agencies buy or hack antivirus software because its access patterns don't look suspicious. Scanning your harddrive and uploading random contents? What AV is supposed to be doing. Windows Defender is different because if Microsoft wants to fuck you and you're using Windows, they already can.
Anderkent 9y ago
The problem is that many AVs are not tested well, and prone to actually making you more vulnerable by bugs in their analysis code. Basically, think of receiving an email with a malware attachment. If you have good hygiene, you won't open it yourself. But your AV will open it to 'scan' it, and that gives it an opportunity to compromise it. Add the fact that most AV runs with high privileges and is not sandboxes, and this is a pretty bad state.
UncleMeat 9y ago
AV only detects already known malware, and often poorly. As a trade off you are running highly privileged code that fundamentally needs to process untrusted input and is often of low quality. For a high interest target, AV software opens up more holes than it closes.

IBM 9y ago

An iPad should be just as secure as an iPhone, right? I'm sure that's much more common and an easier sell than a Chromebook in D.C.

codinghorror 9y ago
Yeah this is a good point plus the latest iPad Pro is amazing, performance and feature wise.

technion 9y ago

I want to throw some anecdata on this. Someone I know could be considered a high profile target. A few months back I helped him migrate from Internet Explorer, to Chrome. I was onsite for most of an afternoon helping the process. For the next few weeks I received phone calls because he was lost and needed help. I've seen Reddit comments on people in similar positions with statements like "they should be on Qubes OS, period" or "they should use Tails only" or "anyone in that position should be using deblobbed Thinkpad". I can only tell those commentators they have tried to help such a person. Thank you for a much more realistic view on the situation.