3 ms·

Lists like these are dangerous as they should be tailored per situation/person. On most occasions i have experience with it's usually best for the operative to

by coretx 8y ago

Lists like these are dangerous as they should be tailored per situation/person. On most occasions i have experience with it's usually best for the operative to behave like the generic tech-moron he/she is in order to NOT stand out of the crowd / raise attention. When something sensitive is about to commence, stick the TAILS usb stick in the laptop & go. Microwave the USB stick when done. But as in my first alinea; advice like this should be tailored at all times.

tptacek 8y ago
Hence the title: "basic security precautions" for "non-profits" and "journalists".
- coretx 8y ago
  Both ( political ) non-profits and journalists are targeted by nation states. Not just in developing nations, but also in the EU and USA. This implies that just "Basis security precautions" don't suffice by a longshot, in fact they become a threat.
  - tptacek 8y ago
    It's easy to forget that people from all over the world comment here, and colloquialisms in the US might not translate to wherever it is you're from (I have no idea, FWIW). So, my guess is that you and I are just using two different meanings of the words "basic precautions".
newscracker 8y ago
Security has trade offs that need to be carefully weighed for each situation before some appropriate decisions are taken (with the benefit of knowledge). But a big hurdle here is that the target audience has a critical need to have very good protective measures in place but is also at the same time very likely not to know about the trade offs or how to weigh the trade offs or even have a relatively good understanding of the basis of the trade offs. Hence the need for generic advice that could be easier to follow for most people while providing a better set of protections than the status quo (with the status quo being not even considering the security part and making assumptions based solely on habit and convenience). Anyone who has taken some of this advice to heart and still is unsure would usually find a way to ask people who know better for tailored advice.
- coretx 8y ago
  For a general statement I agree with you. I find it even a good thing to teach everyone, not just journalists, basic data hygiene. The target audience set however is far from general. They are journalists and non-profits. Such entities have adversaries such as https://en.wikipedia.org/wiki/Tailored_Access_Operations https://en.wikipedia.org/wiki/Tailored_Access_Operations haunting them. Even most well trained security professionals are far from qualified enough to deal with such actors. In other words, people should be honest with the journalists and tell them they are not competent enough to assess or commit trade offs. On most occassions, knowing you are not secure is the best security you can get as it alters your behaviour accordingly.

by coretx 8y ago

tptacek 8y ago

Hence the title: "basic security precautions" for "non-profits" and "journalists".

coretx 8y ago
Both ( political ) non-profits and journalists are targeted by nation states. Not just in developing nations, but also in the EU and USA. This implies that just "Basis security precautions" don't suffice by a longshot, in fact they become a threat.
- tptacek 8y ago
  It's easy to forget that people from all over the world comment here, and colloquialisms in the US might not translate to wherever it is you're from (I have no idea, FWIW). So, my guess is that you and I are just using two different meanings of the words "basic precautions".

newscracker 8y ago

Security has trade offs that need to be carefully weighed for each situation before some appropriate decisions are taken (with the benefit of knowledge). But a big hurdle here is that the target audience has a critical need to have very good protective measures in place but is also at the same time very likely not to know about the trade offs or how to weigh the trade offs or even have a relatively good understanding of the basis of the trade offs. Hence the need for generic advice that could be easier to follow for most people while providing a better set of protections than the status quo (with the status quo being not even considering the security part and making assumptions based solely on habit and convenience). Anyone who has taken some of this advice to heart and still is unsure would usually find a way to ask people who know better for tailored advice.

coretx 8y ago
For a general statement I agree with you. I find it even a good thing to teach everyone, not just journalists, basic data hygiene. The target audience set however is far from general. They are journalists and non-profits. Such entities have adversaries such as https://en.wikipedia.org/wiki/Tailored_Access_Operations https://en.wikipedia.org/wiki/Tailored_Access_Operations haunting them. Even most well trained security professionals are far from qualified enough to deal with such actors. In other words, people should be honest with the journalists and tell them they are not competent enough to assess or commit trade offs. On most occassions, knowing you are not secure is the best security you can get as it alters your behaviour accordingly.