12 ms·

The Bare Minimum You Should Do to Protect Your Family's Data

148 points by octosphere 8y ago

Sushi-san 8y ago
I think that it's beneficial that Mozilla pushes this privacy-minded ideology. People who aren't tech-savvy might not know these tips.
codegeek 8y ago
Overall a good resource but please no to "antivirus" software like McAfee. Absolutely horrible and makes it worse.
- cwyers 8y ago
  Yeah, the antivirus recommendation sticks out like a sore thumb, and makes me wonder if anyone with a good background in security vetted the rest of it.
- Sushi-san 8y ago
  The only program of that nature I would recommend is MalwareBytes.
- streetchase 8y ago
  I’ve found that most antivirus software is just bloat.
- ozim 8y ago
  Ok so you have kids who play say Minecraft, they download all mods they can in zipfiles and install all the other games packs from weird internet forums. What is bigger threat and attack vector, McAfee, Symantec or modding forums for 10 year old? For me installing AV is silly I don't download and run random crap from internet that friend from school also installed. But If I would have kids having installed AV and updated is quite good idea. I also wonder all time how my non technical close ones break their computers, I don't know what they are clicking but I do not get unusable windows 10 every 3 months. My gf is not technical but she almost never install anything on her laptop and it works fine, so for this one I am quite happy.
  - astura 8y ago
    Is McAfee really better than Windows Defender in this use case though?
minton 8y ago
>Turn off location services. Will this make it impossible to find your lost iPhone?
- Sushi-san 8y ago
  Yes, but you can edit location settings for individual apps IIRC.
kgwxd 8y ago
"Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec." Installing more proprietary software with unrestricted access seems like a huge step backwards. https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#Antivirus_vendor_cooperation https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#A...
- badrabbit 8y ago
  Windows itseld is a proprietary software. MS Defender does an ok job but for most malware that target consumers,those av softwares are not a negative. As a techie you might have nation state actors employing sophisticated attacks or corpirations spying on users. But the most immediate threat to consumers are things like phishing attacks,ransomware and banking trojans.
  - deleted 8y ago
    [deleted]
- amluto 8y ago
  That’s a somewhat minor issue compared to the fact that the major anti-virus products appear to be effectively adware with a dubiously secure scanning engine built in. Whenever I help clean up someone’s Windows computer, I treat any antivirus product other than Windows Defender as malware and get rid of it.
  - deleted 8y ago
    [deleted]
  - qwerty456127 8y ago
    As for resident antiviruses I would generally agree (even for purely logical reasons - that means adding another 3-rd party to the 100% trusted list, you grant their app godlike access to your computer and everything on it and let it talk freely and secretly to their vendor), nevertheless a live-cd version of something like Dr.Web can be of great use in such cases, Windows Defender a well as other antiviruses ran under an infected system can often be futile against viruses infesting it. Perhaps open-source ClamAV can do the job too but I'm not sure.
imbusy111 8y ago
I expected better from Mozilla. Connecting to unsecured WiFi is mostly not a problem. Most websites and applocations encrypt traffic and the security of the channel does not matter. Plus, the recommendation to installl shady antivirus software throws the motivation of this article into doubt.
- glitcher 8y ago
  I agree. The section on "Use tough passwords and change them frequently", except for the final suggestion to use a password manager, felt like antiquated password advice.
  - plemer 8y ago
    What do you use instead of a password manager?
    - TimTheTinker 8y ago
      I think you misunderstood the sentence. OP is saying TA's password advice (except for "use a password manager") is antiquated.
      - plemer 8y ago
        You're correct, I misread. Thank you.
  - stretchwithme 8y ago
    As long as the password manager is trusted. Some are run by a single person nobody's heard of. I met a woman in Vegas who ran one and who couldn't believe that people trusted it so much.
    - tokyodude 8y ago
      And then there are ones like LastPass that people on HN seem to recommend even though their TOS basically says they spy on all your browser behavior and sell it to 3rd parties
epistasis 8y ago
> Fine-tune your browser settings This is not so great advice, especially as a "bare minimum." What setting would a user really want to change here? The only advice should perhaps be the last sentence "Consider using plug-ins like Privacy Badger or HTTPS Everywhere to block tracking or keep your activity safer from snoops." And then explain what they do.
pasta 8y ago
Mozilla should enable safe browser settings by default. For example: third party cookies are never needed on 99% of the sites you visit.
Zhenya 8y ago
"Use antivirus protection. Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec. Beware of free antivirus software, as it can contain malware. The iOS operating system has antivirus software built in..." Do people still really install anti-virus? Isn't it just another vector for attack since they themeselves use exploits to manipulate the OS? Linux for desktop, pixel or iOS for phone. Signal for communication, fastmail or Gmail on g suite for email. Minimize installed apps on phone Run JavaScript blocker on Firefox if you're using an Android (and on your desktop).
- cmurf 8y ago
  Not only do people install it, I see it required in corporate IT all the time. As in, they even set a VPN policy that checks your anti-virus definitions for currency and will refuse to connect if the definitions aren't current or if anti-virus is not installed. These same corporate IT who force 90 day password changes, and nonsense like 5pEAzhawh$ instead of fivepizzassoundsgoodbutdontforgetthebeer because no matter what longer is better.
  - perplamps 8y ago
    That's often due to PCI compliance which I believe mandates antivirus software.
  - pbhjpbhj 8y ago
    I was on a site the other day, which I won't share publicly, that required "NO MORE than 6 characters, including precisely 1 number and 1 capital" (paraphrase, my emphasis) ... I definitely WTF-ed at that. My default is 20 characters of alphanum, or 16 of "graph" (though I drop look alike characters; 32 chars if I'm entering payment details). One has to hope they have a small limit on retries. They definitely carry commercially sensitive data and do payment processing. What worries me is they used js to catch my attempt to use 20 chars, so they're not operating completely naively -- all I can think was it was a misinterpretation and s/most/least.
saagarjha 8y ago
> They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” Obligatory xkcd telling you to not do this: https://xkcd.com/936/ https://xkcd.com/936/
- ImprovedSilence 8y ago
  I'm by no means and expert is this field, but I thought at some point I had heard that using words like the xkcd comic were actually less secure, I thought what I heard was that there is a type of dictionary search that can be more efficient in cracking those "all words" passwords (as in, you don't really have 44 bits of entropy). Again, I've got no source, and am not very knowledgeable in this space, so someone correct me.
  - heinrich5991 8y ago
    Assuming you pull these four words randomly (not-human-random, actually random) out of a dictionary of at least 2048 words, and separate them by a space, you have a password of (at least) 44 bits of entropy. There's no way a "dictionary" attack can reduce the possible password space to less than 244 possibilities.
    - astura 8y ago
      You can use Dicewear to generate these passwords: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html They recommend a minimum of six words though.
    - ImprovedSilence 8y ago
      Some quick googling gave me this:https://paul.reviews/passwords-why-using-3-random-words-is-a-really-bad-idea/ https://paul.reviews/passwords-why-using-3-random-words-is-a... (also good stuff here: https://security.stackexchange.com/questions/151165/is-randomly-generating-passwords-from-an-assortment-of-dictionary-words-cryptogr https://security.stackexchange.com/questions/151165/is-rando...) It seems the consensus is to use 5-6 words, and following the xkcd trick of 4 may not be enough.
ChrisSD 8y ago
> Use tough passwords and change them frequently. The best practice for passwords is to use real words or phrases you can remember easily — but spell them incorrectly. They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” The result of encouraging frequent changes: 5pEAzhawh$, 5pEAzhawh$2, 5pEAzhawh$3, 5pEAzhawh$4, 5pEAzhawh$5, ... > Even better, use a password manager like Lastpass. They really should have lead with this.
- lewisinc 8y ago
  https://xkcd.com/936/ https://xkcd.com/936/
- TimTheTinker 8y ago
  Yes, they clearly didn't consult (and/or use) security researchers' most recent recommendations about passwords. Password managers have become a nearly non-negotiable necessity. Telling people just use a password manager is becoming kind of like telling developers just use source control 15 years ago. You just won't know how important they are (or the true cost/benefit) until you start using one yourself.
  - astura 8y ago
    15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.
    - TimTheTinker 8y ago
      > Source control was very, very standard 15 years ago. For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`. There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-user repo or set up your own server. (Back then, the only viable DVCS systems were commercial.)
hannob 8y ago
More than half of that I wouldn't advice or would have serious caveats about the advice given... This is really a strange document... Just a few examples: "Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" <- sorry, that's not how email works. I want to get emails from strangers that care about what I do. "Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks. "Even better, get a VPN (virtual private network) — but, just like with antivirus software, don’t use a free VPN." How should an average user know if the VPN is a scam? (More than half of VPN providers are scam and there's little reason to believe that payed providers are always better.) "Use tough passwords and change them frequently." Changing passwords frequently is considered deprecated advice. The single most important rule about passwords is to use unique passwords. Which they don't say at all... I could go on... Update: Mozilla deleted the post after criticism, see https://twitter.com/asadotzler/status/1068961020540899329 https://twitter.com/asadotzler/status/1068961020540899329
- porphyrogene 8y ago
  I agree and I'm glad that it was taken down. However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. Most phones should have certain network sharing features disabled before accessing an unsecured network. Among people I know it is common for someone to ask if anyone is currently running a mobile hotspot before opening their own. Questions like "Why not just use the cafe's (or bar's) WiFi?" don't even need to be asked. Many people click the links at the bottom of a news article, open every email they get and click their contents with abandon and generally ignore they privacy and security on the web. That does not mean that that behavior should go unchallenged or that we should dismiss basic personal security with the old phrase, "Everyone is doing it."
  - lsc 8y ago
    >However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. I would call it an "appeal to practicality" I mean, sure, you and I carry mobile plans with tethering capabilities; my iphone/verizon combo is nearly always better than your average free or included with purchase wifi network. But I also have a device that was like a grand up front and the service is north of $100/month. It's a totally reasonable and practical solution for me, sure, but for someone who doesn't work in tech, or for someone who has kids, etc, etc... for a lot of people, spending that much on connectivity is not particularly practical. (you can get cheaper tethering setups, of course; those that I've tried have been worse in the areas where I've tried them; it has been more than a year since I tried, so the 'verizon is the best if you don't care about price' statement may be out of date, and of course, different areas have different coverage. YMMV, of course. My main point is just that if you want tethering that is consistently better than free wifi... that's going to cost you an amount of money that might be impractical for most people.) I mean, sure, you could still just not use data... my computer would be more secure if I left it off. But it would also be a lot less useful.
cmurf 8y ago
Author needs to read, or re-read NIST 800-63B. https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html Do not change passwords frequently. Do not use short passwords and try to compensate by using special characters and nonsensical word obfuscation, instead use long passphrases, the longer the better.
z3t4 8y ago
If you don't want web sites to track you, you better not use a browser with JavaScript. eg. you better not user Firefox :P Also to avoid tracking you are better off using other peoples internet connection, eg. not your own.
afpx 8y ago
Does anyone know how data taken in data breeches is used by attackers? I’ve always been curious.
stevew20 8y ago
As someone who has dropped almost all social media (mostly so I can get more done, but also for privacy), I can point out some non obvious consequences. This blog post mentions that stopping the use of Facebook will prevent you from seeing your nephews baby pictures... This is true. My extended family and remote friends actually got upset when I dropped Facebook. They asked why I didn't want to be part of their lives, asked why I was choosing not to talk to them anymore... All while texting me on phones that allow instantaneous communication of any type of election media imaginable, more so that Facebook allows. Moral of the story: Facebook and other social media makes most people socially lazy with continuous use. If you don't believe me, go try to meet someone under the age of 30 "out in the wild", at a bar or venue. Bars used to be easiest places to meet anyone at, just walk in, sit at the front, and start chatting. I'm not talking about people who are on their phones ignoring the outside world; even people just chilling and having a beer just don't know how to talk to someone outside of their social media platforms.
jobigoud 8y ago
Also avoid DNA services. If one family member does it it can compromise the entire family.
- astura 8y ago
  "Compromise" in what sense? I don't find any sort of value in DNA services, but I don't feel "compromised" one bit that my brother uses them. Anyway, the idea of "family" when we get into DNA is not useful, a skilled person can track you down because a total stranger who you share great great great grandparents with uploaded their DNA into an open source DNA database, which is what happened with the Last Area Rapist.
  - diminoten 8y ago
    If you murder someone, they might be able to find you via 32andme. Some people would say, "Don't murder people, then!" but folks sometimes prefer, "How dare they catch you, what a violation of your privacy!"
    - astura 8y ago
      So don't use 23 and me to make sure if your relatives can get away with murder?
      - pessimizer 8y ago
        Everyone who doesn't want their genetics searched has a murder to hide. The punchline: the series of rapes and murders that was used to institutionalize mass DNA collection turned out to have been done by a cop who didn't have DNA taken.
    - Cpoll 8y ago
      Even if you don't commit the crime, you become more vulnerable to being false-flagged for it by a combination of lab contamination and a DNA database search. Of course, if you go down this line of reasoning, you need to weigh the probability of this versus the probability of dying to an undiagnosed/late-diagnosed genetic condition.
radovanb 8y ago
Page not found 404 error.
- astura 8y ago
  They pulled it, because it was garbage: https://twitter.com/asadotzler/status/1068961020540899329?s=20 https://twitter.com/asadotzler/status/1068961020540899329?s=...
AnaniasAnanas 8y ago
Ironically another advice to protect your privacy would be not to use Firefox - considering all the new telemetry, newtabpage, beacons, and calling-home that Firefox nowadays does.
jimnotgym 8y ago
404? Has it been taken down?
e_d_e_v 8y ago
Link to archive: http://web.archive.org/web/20181127021739/https://blog.mozilla.org/internetcitizen/2018/11/25/the-bare-minimum-you-should-do-to-protect-your-familys-data/ http://web.archive.org/web/20181127021739/https://blog.mozil...
- octosphere 8y ago
  Also, for posterity it can be found here too: https://archive.is/7SYNe https://archive.is/7SYNe
deleted 8y ago
[deleted]
michaelwu 8y ago
Hitting a 404 now. Maybe all the comments here made them the blog editors realize they posted some bizarre advice.
lifeisstillgood 8y ago
OK, ... so what would the Hacker News Guide to Online Family Security look like? - ISPs - Routers - Ad Blockers - OS - Data storage / backups - Facebook or not ? - ios v android ...
- jaxn 8y ago
  I have PiHole running on our home network blocking ads, phisihing domains, etc. I also don't use the ISP router / wifi. I feel like those two things are good steps towards protecting my family. They give me some piece of mind at least.
  - intopieces 8y ago
    Have you run into any issues that required tweaking of the PiHole set-up? I'm running PiHole + a hand-rolled VPN on Digital Ocean but I'm looking to put together little PiHole boxes for my family who live across the country. It needs to pretty much be perfect out of the box or they'll unplug it. I've only had to disconnect once or twice to unsubscribe from spam lists, but I doubt my family would even bother.
    - jaxn 8y ago
      The only thing that almost annoys me is that Google ads are blocked on the redirect, but not display. So sometimes I click them and have to go back and click the organic result. I could probably tweak it. I am running it on a old Pi B (the old one with an RCA jack). No issues. if I was sending to family across the country, I'd probably add remote access of some sort for myself.
miguelmota 8y ago
The advice was basic high level advice which at this point should be common knowledge for anyone using the internet. I can see why they took down the blog post because it was disappointing content
gkoberger 8y ago
It was removed: https://twitter.com/asadotzler/status/1068961020540899329?s=20 https://twitter.com/asadotzler/status/1068961020540899329?s=... But here's the original article: https://web.archive.org/web/20181130081659/https://blog.mozilla.org/internetcitizen/2018/11/25/the-bare-minimum-you-should-do-to-protect-your-familys-data/ https://web.archive.org/web/20181130081659/https://blog.mozi...
- octosphere 8y ago
  Also on Archive.today: https://archive.is/7SYNe https://archive.is/7SYNe
Budabellly 8y ago
I've been wondering recently, (how) do identity protection or fraud protection software services actually work? I feel like someone actually doing that right would be a big deal but haven't heard anything special about the market leaders.
qwerty456127 8y ago
> Use tough passwords and change them frequently. This is a futile advice, no sane person is ever going to follow it. You can memorize a tough password or two but change them and memorize the new ones frequently... nope. > Tweak your home assistants. Don't use home assistants unless you are a kind of person who really doesn't mind broadcasting their whole life as a reality show without even being informed when you're on air. I can't imagine a reasonable privacy-caring person who would.
deleted 8y ago
[deleted]
octosphere 8y ago
There's a mirror here: https://archive.is/7SYNe https://archive.is/7SYNe

148 points by octosphere 8y ago

I think that it's beneficial that Mozilla pushes this privacy-minded ideology. People who aren't tech-savvy might not know these tips.

codegeek 8y ago

Overall a good resource but please no to "antivirus" software like McAfee. Absolutely horrible and makes it worse.

cwyers 8y ago
Yeah, the antivirus recommendation sticks out like a sore thumb, and makes me wonder if anyone with a good background in security vetted the rest of it.
Sushi-san 8y ago
The only program of that nature I would recommend is MalwareBytes.
streetchase 8y ago
I’ve found that most antivirus software is just bloat.
ozim 8y ago
Ok so you have kids who play say Minecraft, they download all mods they can in zipfiles and install all the other games packs from weird internet forums. What is bigger threat and attack vector, McAfee, Symantec or modding forums for 10 year old? For me installing AV is silly I don't download and run random crap from internet that friend from school also installed. But If I would have kids having installed AV and updated is quite good idea. I also wonder all time how my non technical close ones break their computers, I don't know what they are clicking but I do not get unusable windows 10 every 3 months. My gf is not technical but she almost never install anything on her laptop and it works fine, so for this one I am quite happy.
- astura 8y ago
  Is McAfee really better than Windows Defender in this use case though?

minton 8y ago

>Turn off location services. Will this make it impossible to find your lost iPhone?

Sushi-san 8y ago
Yes, but you can edit location settings for individual apps IIRC.

kgwxd 8y ago

"Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec." Installing more proprietary software with unrestricted access seems like a huge step backwards. https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#Antivirus_vendor_cooperation https://en.wikipedia.org/wiki/Magic_Lantern_%28software%29#A...

badrabbit 8y ago
Windows itseld is a proprietary software. MS Defender does an ok job but for most malware that target consumers,those av softwares are not a negative. As a techie you might have nation state actors employing sophisticated attacks or corpirations spying on users. But the most immediate threat to consumers are things like phishing attacks,ransomware and banking trojans.
- deleted 8y ago
  [deleted]
amluto 8y ago
That’s a somewhat minor issue compared to the fact that the major anti-virus products appear to be effectively adware with a dubiously secure scanning engine built in. Whenever I help clean up someone’s Windows computer, I treat any antivirus product other than Windows Defender as malware and get rid of it.
- deleted 8y ago
  [deleted]
- qwerty456127 8y ago
  As for resident antiviruses I would generally agree (even for purely logical reasons - that means adding another 3-rd party to the 100% trusted list, you grant their app godlike access to your computer and everything on it and let it talk freely and secretly to their vendor), nevertheless a live-cd version of something like Dr.Web can be of great use in such cases, Windows Defender a well as other antiviruses ran under an infected system can often be futile against viruses infesting it. Perhaps open-source ClamAV can do the job too but I'm not sure.

imbusy111 8y ago

I expected better from Mozilla. Connecting to unsecured WiFi is mostly not a problem. Most websites and applocations encrypt traffic and the security of the channel does not matter. Plus, the recommendation to installl shady antivirus software throws the motivation of this article into doubt.

glitcher 8y ago
I agree. The section on "Use tough passwords and change them frequently", except for the final suggestion to use a password manager, felt like antiquated password advice.
- plemer 8y ago
  What do you use instead of a password manager?
  - TimTheTinker 8y ago
    I think you misunderstood the sentence. OP is saying TA's password advice (except for "use a password manager") is antiquated.
    - plemer 8y ago
      You're correct, I misread. Thank you.
- stretchwithme 8y ago
  As long as the password manager is trusted. Some are run by a single person nobody's heard of. I met a woman in Vegas who ran one and who couldn't believe that people trusted it so much.
  - tokyodude 8y ago
    And then there are ones like LastPass that people on HN seem to recommend even though their TOS basically says they spy on all your browser behavior and sell it to 3rd parties

epistasis 8y ago

> Fine-tune your browser settings This is not so great advice, especially as a "bare minimum." What setting would a user really want to change here? The only advice should perhaps be the last sentence "Consider using plug-ins like Privacy Badger or HTTPS Everywhere to block tracking or keep your activity safer from snoops." And then explain what they do.

pasta 8y ago

Mozilla should enable safe browser settings by default. For example: third party cookies are never needed on 99% of the sites you visit.

Zhenya 8y ago

"Use antivirus protection. Buy and download antivirus software from a reputable source such as McAfee, Norton, or Symantec. Beware of free antivirus software, as it can contain malware. The iOS operating system has antivirus software built in..." Do people still really install anti-virus? Isn't it just another vector for attack since they themeselves use exploits to manipulate the OS? Linux for desktop, pixel or iOS for phone. Signal for communication, fastmail or Gmail on g suite for email. Minimize installed apps on phone Run JavaScript blocker on Firefox if you're using an Android (and on your desktop).

cmurf 8y ago
Not only do people install it, I see it required in corporate IT all the time. As in, they even set a VPN policy that checks your anti-virus definitions for currency and will refuse to connect if the definitions aren't current or if anti-virus is not installed. These same corporate IT who force 90 day password changes, and nonsense like 5pEAzhawh$ instead of fivepizzassoundsgoodbutdontforgetthebeer because no matter what longer is better.
- perplamps 8y ago
  That's often due to PCI compliance which I believe mandates antivirus software.
- pbhjpbhj 8y ago
  I was on a site the other day, which I won't share publicly, that required "NO MORE than 6 characters, including precisely 1 number and 1 capital" (paraphrase, my emphasis) ... I definitely WTF-ed at that. My default is 20 characters of alphanum, or 16 of "graph" (though I drop look alike characters; 32 chars if I'm entering payment details). One has to hope they have a small limit on retries. They definitely carry commercially sensitive data and do payment processing. What worries me is they used js to catch my attempt to use 20 chars, so they're not operating completely naively -- all I can think was it was a misinterpretation and s/most/least.

saagarjha 8y ago

> They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” Obligatory xkcd telling you to not do this: https://xkcd.com/936/ https://xkcd.com/936/

ImprovedSilence 8y ago
I'm by no means and expert is this field, but I thought at some point I had heard that using words like the xkcd comic were actually less secure, I thought what I heard was that there is a type of dictionary search that can be more efficient in cracking those "all words" passwords (as in, you don't really have 44 bits of entropy). Again, I've got no source, and am not very knowledgeable in this space, so someone correct me.
- heinrich5991 8y ago
  Assuming you pull these four words randomly (not-human-random, actually random) out of a dictionary of at least 2048 words, and separate them by a space, you have a password of (at least) 44 bits of entropy. There's no way a "dictionary" attack can reduce the possible password space to less than 244 possibilities.
  - astura 8y ago
    You can use Dicewear to generate these passwords: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html They recommend a minimum of six words though.
  - ImprovedSilence 8y ago
    Some quick googling gave me this:https://paul.reviews/passwords-why-using-3-random-words-is-a-really-bad-idea/ https://paul.reviews/passwords-why-using-3-random-words-is-a... (also good stuff here: https://security.stackexchange.com/questions/151165/is-randomly-generating-passwords-from-an-assortment-of-dictionary-words-cryptogr https://security.stackexchange.com/questions/151165/is-rando...) It seems the consensus is to use 5-6 words, and following the xkcd trick of 4 may not be enough.

ChrisSD 8y ago

> Use tough passwords and change them frequently. The best practice for passwords is to use real words or phrases you can remember easily — but spell them incorrectly. They should be at least eight characters and have a combination of letters, numbers, and special characters, such as 5pEAzhawh$ for “five pizzas.” The result of encouraging frequent changes: 5pEAzhawh$, 5pEAzhawh$2, 5pEAzhawh$3, 5pEAzhawh$4, 5pEAzhawh$5, ... > Even better, use a password manager like Lastpass. They really should have lead with this.

lewisinc 8y ago
https://xkcd.com/936/ https://xkcd.com/936/
TimTheTinker 8y ago
Yes, they clearly didn't consult (and/or use) security researchers' most recent recommendations about passwords. Password managers have become a nearly non-negotiable necessity. Telling people just use a password manager is becoming kind of like telling developers just use source control 15 years ago. You just won't know how important they are (or the true cost/benefit) until you start using one yourself.
- astura 8y ago
  15 years ago? Source control was very, very standard 15 years ago. 15 years ago I would have run, not walked, from a job if they didn't use source control. There was no git, we used CVS, which was almost old enough to vote at that time.
  - TimTheTinker 8y ago
    > Source control was very, very standard 15 years ago. For commercial shops, perhaps. But back then the bar for using source control was much, much higher, so for many small projects, people didn't bother. There wasn't anything as simple as `git init`. There were a few public CVS and SVN servers that were appropriate for open source projects, but for anything personal or commercial, you had to use a local, single-user repo or set up your own server. (Back then, the only viable DVCS systems were commercial.)

hannob 8y ago

More than half of that I wouldn't advice or would have serious caveats about the advice given... This is really a strange document... Just a few examples: "Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" <- sorry, that's not how email works. I want to get emails from strangers that care about what I do. "Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks. "Even better, get a VPN (virtual private network) — but, just like with antivirus software, don’t use a free VPN." How should an average user know if the VPN is a scam? (More than half of VPN providers are scam and there's little reason to believe that payed providers are always better.) "Use tough passwords and change them frequently." Changing passwords frequently is considered deprecated advice. The single most important rule about passwords is to use unique passwords. Which they don't say at all... I could go on... Update: Mozilla deleted the post after criticism, see https://twitter.com/asadotzler/status/1068961020540899329 https://twitter.com/asadotzler/status/1068961020540899329

porphyrogene 8y ago
I agree and I'm glad that it was taken down. However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. Most phones should have certain network sharing features disabled before accessing an unsecured network. Among people I know it is common for someone to ask if anyone is currently running a mobile hotspot before opening their own. Questions like "Why not just use the cafe's (or bar's) WiFi?" don't even need to be asked. Many people click the links at the bottom of a news article, open every email they get and click their contents with abandon and generally ignore they privacy and security on the web. That does not mean that that behavior should go unchallenged or that we should dismiss basic personal security with the old phrase, "Everyone is doing it."
- lsc 8y ago
  >However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. I would call it an "appeal to practicality" I mean, sure, you and I carry mobile plans with tethering capabilities; my iphone/verizon combo is nearly always better than your average free or included with purchase wifi network. But I also have a device that was like a grand up front and the service is north of $100/month. It's a totally reasonable and practical solution for me, sure, but for someone who doesn't work in tech, or for someone who has kids, etc, etc... for a lot of people, spending that much on connectivity is not particularly practical. (you can get cheaper tethering setups, of course; those that I've tried have been worse in the areas where I've tried them; it has been more than a year since I tried, so the 'verizon is the best if you don't care about price' statement may be out of date, and of course, different areas have different coverage. YMMV, of course. My main point is just that if you want tethering that is consistently better than free wifi... that's going to cost you an amount of money that might be impractical for most people.) I mean, sure, you could still just not use data... my computer would be more secure if I left it off. But it would also be a lot less useful.

cmurf 8y ago

Author needs to read, or re-read NIST 800-63B. https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html Do not change passwords frequently. Do not use short passwords and try to compensate by using special characters and nonsensical word obfuscation, instead use long passphrases, the longer the better.

z3t4 8y ago

If you don't want web sites to track you, you better not use a browser with JavaScript. eg. you better not user Firefox :P Also to avoid tracking you are better off using other peoples internet connection, eg. not your own.

afpx 8y ago

Does anyone know how data taken in data breeches is used by attackers? I’ve always been curious.

stevew20 8y ago

As someone who has dropped almost all social media (mostly so I can get more done, but also for privacy), I can point out some non obvious consequences. This blog post mentions that stopping the use of Facebook will prevent you from seeing your nephews baby pictures... This is true. My extended family and remote friends actually got upset when I dropped Facebook. They asked why I didn't want to be part of their lives, asked why I was choosing not to talk to them anymore... All while texting me on phones that allow instantaneous communication of any type of election media imaginable, more so that Facebook allows. Moral of the story: Facebook and other social media makes most people socially lazy with continuous use. If you don't believe me, go try to meet someone under the age of 30 "out in the wild", at a bar or venue. Bars used to be easiest places to meet anyone at, just walk in, sit at the front, and start chatting. I'm not talking about people who are on their phones ignoring the outside world; even people just chilling and having a beer just don't know how to talk to someone outside of their social media platforms.

jobigoud 8y ago

Also avoid DNA services. If one family member does it it can compromise the entire family.

astura 8y ago
"Compromise" in what sense? I don't find any sort of value in DNA services, but I don't feel "compromised" one bit that my brother uses them. Anyway, the idea of "family" when we get into DNA is not useful, a skilled person can track you down because a total stranger who you share great great great grandparents with uploaded their DNA into an open source DNA database, which is what happened with the Last Area Rapist.
- diminoten 8y ago
  If you murder someone, they might be able to find you via 32andme. Some people would say, "Don't murder people, then!" but folks sometimes prefer, "How dare they catch you, what a violation of your privacy!"
  - astura 8y ago
    So don't use 23 and me to make sure if your relatives can get away with murder?
    - pessimizer 8y ago
      Everyone who doesn't want their genetics searched has a murder to hide. The punchline: the series of rapes and murders that was used to institutionalize mass DNA collection turned out to have been done by a cop who didn't have DNA taken.
  - Cpoll 8y ago
    Even if you don't commit the crime, you become more vulnerable to being false-flagged for it by a combination of lab contamination and a DNA database search. Of course, if you go down this line of reasoning, you need to weigh the probability of this versus the probability of dying to an undiagnosed/late-diagnosed genetic condition.

radovanb 8y ago

Page not found 404 error.

astura 8y ago
They pulled it, because it was garbage: https://twitter.com/asadotzler/status/1068961020540899329?s=20 https://twitter.com/asadotzler/status/1068961020540899329?s=...

AnaniasAnanas 8y ago

Ironically another advice to protect your privacy would be not to use Firefox - considering all the new telemetry, newtabpage, beacons, and calling-home that Firefox nowadays does.

jimnotgym 8y ago

404? Has it been taken down?

e_d_e_v 8y ago

Link to archive: http://web.archive.org/web/20181127021739/https://blog.mozilla.org/internetcitizen/2018/11/25/the-bare-minimum-you-should-do-to-protect-your-familys-data/ http://web.archive.org/web/20181127021739/https://blog.mozil...

octosphere 8y ago
Also, for posterity it can be found here too: https://archive.is/7SYNe https://archive.is/7SYNe

deleted 8y ago

[deleted]

michaelwu 8y ago

Hitting a 404 now. Maybe all the comments here made them the blog editors realize they posted some bizarre advice.

lifeisstillgood 8y ago

OK, ... so what would the Hacker News Guide to Online Family Security look like? - ISPs - Routers - Ad Blockers - OS - Data storage / backups - Facebook or not ? - ios v android ...

jaxn 8y ago
I have PiHole running on our home network blocking ads, phisihing domains, etc. I also don't use the ISP router / wifi. I feel like those two things are good steps towards protecting my family. They give me some piece of mind at least.
- intopieces 8y ago
  Have you run into any issues that required tweaking of the PiHole set-up? I'm running PiHole + a hand-rolled VPN on Digital Ocean but I'm looking to put together little PiHole boxes for my family who live across the country. It needs to pretty much be perfect out of the box or they'll unplug it. I've only had to disconnect once or twice to unsubscribe from spam lists, but I doubt my family would even bother.
  - jaxn 8y ago
    The only thing that almost annoys me is that Google ads are blocked on the redirect, but not display. So sometimes I click them and have to go back and click the organic result. I could probably tweak it. I am running it on a old Pi B (the old one with an RCA jack). No issues. if I was sending to family across the country, I'd probably add remote access of some sort for myself.

miguelmota 8y ago

The advice was basic high level advice which at this point should be common knowledge for anyone using the internet. I can see why they took down the blog post because it was disappointing content

gkoberger 8y ago

It was removed: https://twitter.com/asadotzler/status/1068961020540899329?s=20 https://twitter.com/asadotzler/status/1068961020540899329?s=... But here's the original article: https://web.archive.org/web/20181130081659/https://blog.mozilla.org/internetcitizen/2018/11/25/the-bare-minimum-you-should-do-to-protect-your-familys-data/ https://web.archive.org/web/20181130081659/https://blog.mozi...

octosphere 8y ago
Also on Archive.today: https://archive.is/7SYNe https://archive.is/7SYNe

Budabellly 8y ago

I've been wondering recently, (how) do identity protection or fraud protection software services actually work? I feel like someone actually doing that right would be a big deal but haven't heard anything special about the market leaders.

qwerty456127 8y ago

> Use tough passwords and change them frequently. This is a futile advice, no sane person is ever going to follow it. You can memorize a tough password or two but change them and memorize the new ones frequently... nope. > Tweak your home assistants. Don't use home assistants unless you are a kind of person who really doesn't mind broadcasting their whole life as a reality show without even being informed when you're on air. I can't imagine a reasonable privacy-caring person who would.

deleted 8y ago

[deleted]

octosphere 8y ago

There's a mirror here: https://archive.is/7SYNe https://archive.is/7SYNe