4 ms·

This checklist is pretty disappointing. It's a lot of pretty empty platitudes, with no actionable info on what to actually do. Telling politicians to install up

by chc4 7y ago

This checklist is pretty disappointing. It's a lot of pretty empty platitudes, with no actionable info on what to actually do. Telling politicians to install updates and enable OS security features (which ones! what OS! is XP still ok if they just install all the patches?) and revoke API keys (what's an API? from what?) isn't comprehensive advice. Contrast with https://techsolidarity.org/resources/congressional_howto.html https://techsolidarity.org/resources/congressional_howto.htm... which is a checklist by the person behind The Great Slate, a tech-backed grassroots Democratic funding push who has actually worked with politicians. It tells you what phone to buy, what links to click to enable more security for GMail, what app to install to have secure communications. Most politicans are about as savvy as your grandmother.

CiPHPerCoder 7y ago
I recommend the Tech Solidarity resource to people all the time, alongside https://decentsecurity.com https://decentsecurity.com
overkill28 7y ago
Do you know his rationale for some of the blanket statements like "always use an iPhone, never an Android device" and "never use Safari on your laptop, but it's ok to do so on your phone?" Presumably sophisticated opponents are targeting iPhones and mobile Safari as much as Android and desktop Safari
- tptacek 7y ago
  Sophisticated attackers target everything. Desktop Safari is a much softer target than Mobile Safari, and, while flagship Android devices can be made asymptotically as secure as iPhones, the median Android phone held by a campaign staffer is much less secure than the median iPhone, which is something you quickly discover when you see the menagerie of devices campaign staffers use. The two biggest threats campaigns face are phishing and attachments. There are two good ways we know of to break attachment attacks: view attachments in cloud viewers, like Google's PDF viewer, or view them on mobile devices, where they can't trivially be clicked into monstrously insecure desktop productivity applications. Of the two approaches, the latter --- sticking to mobile devices --- is the one that can be deployed with the least amount of end-user training.
  - packet_nerd 7y ago
    > Under no circumstances use the Tor browser (it's okay to use Tor, but do it with Chrome, and seek additional training on how to set it up). I'm not sure I get the rational behind this one? Is it just because they are already using Chrome, so it's better to reduce the attack avenues? Also, it seems to me if you need to use Tor, it's probably not a good idea to do so on your regular Windows desktop. Wouldn't Tails be better advice while also being more foolproof for less tech savy people?
    - tptacek 7y ago
      Tor Browser might be the least safe browser on the entire Internet: it's a very specific, always-behind version of Firefox (itself not the most hardened browser) selected preferentially by sensitive targets, who have opted in to being collapsed down to a single program for exploits to target.

by chc4 7y ago

CiPHPerCoder 7y ago

I recommend the Tech Solidarity resource to people all the time, alongside https://decentsecurity.com https://decentsecurity.com

overkill28 7y ago

Do you know his rationale for some of the blanket statements like "always use an iPhone, never an Android device" and "never use Safari on your laptop, but it's ok to do so on your phone?" Presumably sophisticated opponents are targeting iPhones and mobile Safari as much as Android and desktop Safari

tptacek 7y ago
Sophisticated attackers target everything. Desktop Safari is a much softer target than Mobile Safari, and, while flagship Android devices can be made asymptotically as secure as iPhones, the median Android phone held by a campaign staffer is much less secure than the median iPhone, which is something you quickly discover when you see the menagerie of devices campaign staffers use. The two biggest threats campaigns face are phishing and attachments. There are two good ways we know of to break attachment attacks: view attachments in cloud viewers, like Google's PDF viewer, or view them on mobile devices, where they can't trivially be clicked into monstrously insecure desktop productivity applications. Of the two approaches, the latter --- sticking to mobile devices --- is the one that can be deployed with the least amount of end-user training.
- packet_nerd 7y ago
  > Under no circumstances use the Tor browser (it's okay to use Tor, but do it with Chrome, and seek additional training on how to set it up). I'm not sure I get the rational behind this one? Is it just because they are already using Chrome, so it's better to reduce the attack avenues? Also, it seems to me if you need to use Tor, it's probably not a good idea to do so on your regular Windows desktop. Wouldn't Tails be better advice while also being more foolproof for less tech savy people?
  - tptacek 7y ago
    Tor Browser might be the least safe browser on the entire Internet: it's a very specific, always-behind version of Firefox (itself not the most hardened browser) selected preferentially by sensitive targets, who have opted in to being collapsed down to a single program for exploits to target.