11 ms·

Ask HN: What steps do you take to protect yourself and your family online?

• deleted 5y ago
  [deleted]
• jacquesm 5y ago
  No Windows based computers. As for identity theft, it happens as well here in Europe, but not as often because there is a pretty strict KYC requirement for banks.
  • foepys 5y ago
    I don't understand why you single out Windows. iPhones seem to get owned by iMessage exploits regularly, every Android patch seems to include critical fixes to the media framework (if those patches even reach your device), macOS has had its fair share of exploits and viruses, and Linux is just not interesting enough at the moment.
    • watermelon0 5y ago
      Majority of malware (intended for average users) still primarily targets Windows, so there is just less chance you will ever encounter it on other platforms. It just makes sense to target 95% of people, and not care that much about the rest. Most if not all vulnerabilities on up-to-date iOS/Android are used for targeted attacks (people with power, journalists, etc.) and not to reach regular people. AFAIK most malware is still delivered when users install some software, so it would be nice if Windows would become a bit more locked down by default, and only allow installing from approved stores (i.e. Microsoft Store, Steam, and similar.)
• vmoore 5y ago
  > I found out that someone opened a bank account in my name How did you find out that?
• auslegung 5y ago
  For your specific issue, you can do a credit freeze (or whatever it’s called). These have pros and cons, and there are different levels of freezes (all called different things iirc). Research them and use them if it makes sense. Signup for regular credit score reports. I get a monthly email from one of the credit score companies, plus immediate emails if my credit gets checked. I use 1password and Fastmail with my own domain, and privacy.com. With those three (and their integrations) I can easily create unique debit cards, unique email addresses, and unique passwords each time I register for another site/service. This doesn’t help your specific issue but it helps with a lot of things. Use NextDNS on your router and devices and set it up to use dns-over-https. Block ads etc. Links to above mentioned sites which may benefit me and/or you: - https://nextdns.io/?from=k6bqh5rg https://nextdns.io/?from=k6bqh5rg - https://ref.fm/u26310488 https://ref.fm/u26310488 (fastmail) - https://privacy.com/join/JCPFN https://privacy.com/join/JCPFN
  • akudha 5y ago
    I have done a credit lock, is that enough? Or do I need a credit freeze?
    • deleted 5y ago
      [deleted]
    • wnevets 5y ago
      You probably want the credit freeze. These companies are required by the US law to provide the service for free. Credit locks usually require payment to get.
    • starwind 5y ago
      Credit "locks" are kind of a scam. You definitely want to put a 1 year fraud alert on your credit report where a lender is supposed to call the number you include to verify that you applied for credit. You can also freeze your credit if you have no plans to apply for any credit cards or a mortgage in the immediate future. Get the fraud alert on Chex, too. They're the equivalent of the credit rating agencies for bank accounts. If you don't need to switch banks soon, I'd definitely freeze that one. https://www.chexsystems.com/web/chexsystems/consumerdebit/page/IdentityTheft/securityalert/ https://www.chexsystems.com/web/chexsystems/consumerdebit/pa... https://www.chexsystems.com/web/chexsystems/consumerdebit/page/securityfreeze/placefreeze/ https://www.chexsystems.com/web/chexsystems/consumerdebit/pa... If you have a credit card through Chase, AmEx, or CapitalOne you can get free credit monitoring where they'll email you or send you a push notification as soon as a lender does a hard-pull against either your Tranunion or Experian reports. Have you filed a police report? I've had my identity stolen and helped some of my friends resolve identity theft issues so I speak from experience: you will get so much further if you can fax or email people copies of a police report Hmu if you need any help resolving this.
• deleted 5y ago
  [deleted]
• _huayra_ 5y ago
  https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-Li... It's a pain to do, but it really helps to opt out of data broker lists. I have a reminder to do this once per year, and only the "diff" of my life updates show up (e.g. address reappears because I moved, changed voter registration as a result, etc). There are also services you can pay to do this, but they are usually priced extremely high or are straight up scams (i.e. they'll take your PII and then scam you with it). It's better to just do it yourself so you know there's no middlemen to be forced to trust.
  • jrhomie 5y ago
    I tried this about a year ago but it was pretty futile. The issue is that data brokers repopulate your info every ~6-8 weeks. It's designed to be nearly impossible to keep up with. This bothered me so much that I actually started a company to solve the problem of continuous opt-out from data brokers. I think we’re priced pretty reasonably given how important this stuff is ($99/yr). As far as trust goes, we went through YC W21 (as RoundRobin) and I’m happy to answer any questions people have. www.crowdshield.com
    • hash872 5y ago
      I remove myself from data broker websites as a hobby, and I don't find it futile at all. They haven't repopulated my data whatsoever, and they actually take GPDR/CCPA threats pretty seriously. (Sometimes you do need to email the executives directly- fun fact, you can just look them up on other data broker sites!) I've removed myself from every one, for free, with a minimal time commitment. You may just be plugging your company, no offense
      • jdoss 5y ago
        I am glad they posted. I'd rather spend my time not removing myself from these sites as I have other things I'd rather be doing.
        • 5y ago
• hourislate 5y ago
  I'm assuming you're in the USA. The most important thing you can do too prevent things like Bank Accounts, Credit cards, etc opened in your name is to lock your Credit History. Without access no one can open up any kind of account. You might also want to lock down your SS Account. Here are some links to get you started. https://www.consumer.ftc.gov/topics/identity-theft https://www.consumer.ftc.gov/topics/identity-theft https://www.consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts https://www.consumer.ftc.gov/articles/what-know-about-credit... https://www.consumer.ftc.gov/articles/how-stop-junk-mail https://www.consumer.ftc.gov/articles/how-stop-junk-mail
  • bellyfullofbac 5y ago
    It seems like there needs to be a political push to fix the easily exploited systems that just use SSN, etc. E.g. make laws that require banks, etc. to need some other form of authentication. But I guess an upgrade of systems will cost hundreds of millions of dollars...
    • hourislate 5y ago
      I was given some good advice a decade ago by my father inlaw. Every time you are asked for personal info, give as little as possible (need to know/least privilege). When filling out forms, just the necessary fields (ex: no middle name/initial, home phone, etc). Do they really need a copy drivers lic at the doctors office? You can even call your Medical Insurance company and get a code that the dentist or doctor can put in instead of your SS number, that way you're not giving it out as much. There are plenty of things that require little effort that can go a long way. Opt out of CC/Insurance/Junk mail. Reduce the paper trail is good practice, bills should be handled online, direct deposit, etc. And I shouldn't have to say this but never use your real name online and refrain from all social media unless you can participate anonymously. I go as far as using a VPN and Private browsing as a minimum/baseline. At Thanks Giving, I would duck and hide every time someone took a photo so my face wouldn't end up on FB or other social media. My goal is to one day disappear from having any online presence or a minuscule foot print, no email, dumb phone, services, etc.
• lotsofpulp 5y ago
  Freeze children’s SSN with all 3 credit reporting agencies. Open irs.gov, social security, and other government accounts before someone else can. I use Strongbox with Keepass databases to keep track of it all stored in iCloud so spouse can access TOTP it for shared items. Use content blocker (I use Wipr) in Safari, and ublock origin Firefox/chrome. And then don’t download or install random software. Check your credit report every year at each credit reporting agency every 4 months by going to annualcreditreport.com
  • farski 5y ago
    There's a fourth credit agency now that it's recommended to put a freeze on, but I don't remember the name off the top of my head.
    • kube-system 5y ago
      Innovis?
    • starwind 5y ago
      You're probably thinking either Innovis or NCTUE (which does utilities and telecom stuff). Innovis makes it real easy to freeze or put a fraud alert on your report with them
• replwoacause 5y ago
  - Bitwarden - Privacy.com - Fastmail - kDrive - 2-factor on all services
• MerelyMortal 5y ago
  Since there are probably young people reading this, or parents of young people (teach them this): Do not give out you SSN to anyone except the government, and try every possible way to avoid giving it out to anyone else. Paper forms ask for it all the time, leave it blank. In fact, leave as much blank on any form as possible (I have never been asked for info that I've left blank). Cell phone companies and utility providers ask for it, instead offer to pay a deposit or go post-paid. I haven't tried this before, but my understanding is that U.S. law requires banks to have a unique personal identifier number for its customers. Banks default to SSNs, but the law does not specify it has to be a SSN. Try to create an account in-person and use a Driver License number. If I have any incorrect understandings, please reply with your knowledge; or if you have any further ideas, please reply with your advice. Thank you. Edit: removed idea about not getting a SSN for kids. Sounds like way more hassle than any potential benefit.
  • dymk 5y ago
    Skipping setting up a SSN for your child seems like it’s going to set them up for major headaches once they’re older.
    • MerelyMortal 5y ago
      Edited my original comment to remove it. I do not have enough info to give adivice. Sorry.
      • PopAlongKid 5y ago
        No, if someone is eligible for an SSN, they are not eligible for an ITIN.
  • PopAlongKid 5y ago
    It is vastly easier to apply for the SSN at the hospital at time of birth. If you don't, there are many non-trivial hurdles to jump through later[0]: At a Social Security office: If you wait to apply for your child’s number, you must: • Complete an application for a Social Security card; and • Show us original documents proving your child’s: — U.S. citizenship; — Age; and — Identity. • Show us documents proving your identity and your relationship to the child. [0] https://www.ssa.gov/pubs/EN-05-10023.pdf https://www.ssa.gov/pubs/EN-05-10023.pdf
• jszymborski 5y ago
  Sorry to hear it. # Here are some of the things that I've done. Here's to hoping it's effective. 1) Everyone uses Bitwarden[0] to store their passwords. We have an Organisation account which makes sharing passwords easy. I check master passwords against HaveIBeenPwned, and ask they use the generated Bitwarden passwords for their accounts. 2) The least tech-saavy amongst my family either get Chromebooks (which I despise because Google), or they get a Windows machine that I lock down pretty hard [1]. The lock-down may look draconian to power users, but they've yet to mention they can't do something they want to. 3) Its listed in the link in (2), but I make sure everyone runs uBlock Origin. It's far more useful than an antivirus. 4) I have a few catch-all emails I encourage my family to use for subscriptions. When asked for an email, use [website name]@[family member code].[domain].[tld]. That way, unless spearfished, you're likely to know the true providence of an email. 5) We have a NAS that is 3-2-1 backed-up, and encourage everyone to keep sensitive information there. Hopefully this is enough to avoid cryptolockers extorting us. # Things I want to do 5) It would be better if we used one of those self-hosted random email generators to prevent maliciously constructed email domains at our catch-all instilling false confidence. 6) I'd like to install PiHole [2]. 7) I have a Twilio number that goes straight to voice mail and sends me the audio files and forwards SMS. I'd like to create these for my family (maybe using extension numbers?) so they can use them on forms. [0] https://bitwarden.com/ https://bitwarden.com/ [1] https://noteaureus.org/post/tutorials/sysadmin/win4unsavvy/ https://noteaureus.org/post/tutorials/sysadmin/win4unsavvy/ [2] https://pi-hole.net/ https://pi-hole.net/
  • rymurr 5y ago
    your tutorial for locking down windows is super useful, thanks! Any recommendations for remote administration? I would like to set this up for my parents but need to be able to address any issues they might have w/o a transatlantic flight ;-)
    • hluska 5y ago
      My parents have different levels of technical skills but I help both. My Dad is a nerd - I didn’t see it coming but I’m planning on stealing his lunch money the next time I get to see him. My Mom really hates computers and though I know this isn’t technically possible, they seem to hate her back. Despite their differences, I can use Quick Assist with both. And between my Dad’s sudden turn towards becoming me in high school and my Mom’s innocent transgressions, I’ve never run into anything I couldn’t fix with it. Worst case scenario, my Dad and I have talked about a volunteer based group of people who help other cats around his age. If your parents are on the same side of the ocean as we are, we can help in a closer timezone. My Dad is a retired police officer (you can trust him) turned nerd (you maybe shouldn’t trust him) and I’ve been drafted into the odd role of his nerd supervisor. If you’re worried about your folks, he’ll give them his phone number.
• traceroute66 5y ago
  Its a tough question to answer, with so many "if's" and "maybes". There have already been some good suggestions here which I won't repeat. But one I would suggest is minimising the number of places with your "real" information, i.e. if "real" information is not required by law (e.g. financial services, health services, insurance, billing etc.), then train yourselves to use pseudo information. For example, if a website asks for your date of birth. Ask yourself, is it required by law or is it just for user profiling. If the latter, then just invent a date of birth (and if the date of birth may be required for password recovery, make a note of it in your password manager). The same goes for your "real" name. Do you need to give them your real name as shown on your government ID ? Or can you give an abbreviation or even pseudonym ? The same goes for answers to "security questions", just invent stuff, don't give the "true" answer. You can take all the technical countermeasures you like, but sometimes it's easier to KISS ... if a service doesn't need your details, don't give it to them in the first place.
  • isbvhodnvemrwvn 5y ago
    And have separate e-mails. I have three tiers of them - one is for official matters, the other for semi-official, the third for the rest. I almost always use garbled usernames as well.
    • traceroute66 5y ago
      > And have separate e-mails Absolutely ! But that aspect is not just a security thing, its an anti-spam thing. Infact I'd almost consider the security aspect a bonus, the ability to kill off email addresses if you start getting spammed is the primary benefit (for me at least!).
      • cinntaile 5y ago
        It is a security thing since you use your emailaddress for logging in and resetting passwords. If somebody gains access to your email it can be troublesome.
      • HPsquared 5y ago
• deleted 5y ago
  [deleted]
• slvrspoon 5y ago
  disclaimer: i'm a co-founder. https://joindeleteme.com/ https://joindeleteme.com/ we consistently find in our DeleteMe searches fairly "rich" profile info sold by data brokers and SEO'd on Google not just on our customers themselves but also their family. This often includes: spouse full name and age (and obviously relationship) and, more disturbingly, children's names and ages. We try to remove all this via opt-outs. The implications of such full family profile data being easily available by simple Google searches and for sale "cheap" at data brokers are not imhop awesome. Lastly, leaving privacy aside, from a security perspective, do NOT use children/family members names and years of births in ANY passwords.
• GoodbyeMrChips 5y ago
  > I found out that someone opened a bank account in my name...... but I am not receiving any help from the bank. Interesting. Assuming this is to take out loans in your name, it is the bank who are being defrauded, not you. Registered snail-mail to the banks fraud/legal team reiterating this often works wonders. I say snail mail as it gives you a legal trail, goes directly to the department responsible and (at least in this part of the world) gives very cheap next day delivery. This is much easier and less stressful than being kept on hold indefinitely, only to speak to a clueless fuckwit in a call centre.
  • starwind 5y ago
    They should start by filing a police report for identity theft, and emailing things to customer service or faxing can give a faster and better paper trail
    • GoodbyeMrChips 5y ago
      I agree with you in principle, however calling it "identity theft" is to be discouraged. Assuming this is to take out fraudulent loans, the 'theft' is occurring from the bank, not OP. Calling this "identity theft" is an attempt to put the onus of blame on OP for the failure of corporations to protect personal information and combat fraud. My point is that OP needs to strongly push back against this. This is for the bank to fix, and OP should put a legal claim into the bank (aka bill them!) both for their time and any financial losses they suffer due to the banks negligence. Regards email vs snail mail; a recipient cannot claim registered snail mail was not received, unlike the case with email. This is a reason legal departments use registered snail mail :-)
      • starwind 5y ago
        You're right, I missed when you said registered snail mail, I didn't see that (I need new glasses, it's getting too hard to read) and I thought you just meant normal mail. Second point: this absolutely is identity theft and that isn't a strike against op at all. Someone impersonated op to open an account. You're correct that the bank is liable for the fraud, but op is still the victim of a crime and has to jump through hoops to fix it. And the bank isn't going to pay a dime to op. For all we know, someone submitted a really good fake driver's license (or a copy of the real one) and SS card and opened the account. I'm not blaming op at all—I had my identity stolen twice and the most you can blame me for is not putting fraud alerts on my credit reports, including one I didn't even know about—but the balls in their court to fix this
• starwind 5y ago
  I generate random passwords and use my browser’s password manager cause I didn’t like the way other password managers integrated with my browser. I just keep the passwords I need manually in sync between devices. I have a Yubikey for for some really important accounts and I’ve thought up a way to generate unique passwords that I have to remember (like work passwords) that aren’t just upping the number at the end by 1 like “pepperoni4” to “pepperoni5”. If I can pick an alternative to phone-based 2FA, I’ll do it, otherwise I’ll just roll with the phone-based stuff cause it’s way better than nothing. I have a fake life that I made up like a different grandfather, first car, or first job, and I add a number between -10 and 10 to every digit of my birthday to get a new one for signing up for password recovery. I block 3rd party cookies and delete other cookies weekly. I have an ad blocker and I don’t use the default DNS from my ISP, and I keep things updated for my modem and router. I don’t hit up sketchy sites so I don’t feel like I need a JavaScript blocker. Most of the crap I’ve seen has been through malicious ads. I use a container for Google. I went through the tedious process of having my info deleted from the biggest data brokers and wiped out from some online databases. They pop up again now and again but usually an email takes care of it. I had my identity stolen in the past so I just cite that reason. I don’t give out my SSN except to banks, employers, and the government. I use my passport if someone needs to establish my citizenship. Utilities are the most pushy but if you give them like a $50 deposit or set up autopay they’ll skip that part. Again, saying I’m the victim of identity theft goes a long way. I set up accounts with Social Security and I have an IRS pin so no one beats me to it. I have 7 year fraud alerts and froze my credit for the three bureaus, and I do free credit monitoring (useful before I froze my credit). I did the same for Chex, Innovis, LexisNexis and NCTUE. I froze my info from the Work Number. I asked my bank for additional security measures and they happily obliged. I use my AmEx for near everything online and contactless payment for paying at gas stations or if I’m worried about skimmers. I never use my debit card for anything except to get cash out of the ATM and I have a daily limit set up.
• blibble 5y ago
  1) family have had it drummed into them to never click links in emails or open attachments unless it's something they explicitly requested moments before 2) no Windows
• em-bee 5y ago
  names are not unique. i can probably find at least half a dozen people sharing the same first and last name as me. how does someone opening a bank account with the same name as you enable them to affect you? if it does, then there is a system that is seriously broken.
  • starwind 5y ago
    I'm assuming they used ops SSN. They may have been trying to write bad checks or launder money through the account
• bob331 5y ago
  Delete all of your social media
• rsync 5y ago
  There is really no reason to use your real name and address for anything online - perhaps only airline tickets and government agencies (eftps, ftb.ca.gov, etc.). Remember: Visa/MC cannot verify cardholder name. They pretend that they can and merchants believe that they can but there is no mechanism to do so.[1] If the numbers match up, you can use "Mickey Mouse". No online retailer/merchant/provider has ever seen our real name (or real address). We created a pseudonym and attached it to a PO BOX in our town and a twilio phone number. This doesn't solve every problem but it does solve the simple issues of identity theft and impersonation or (very low level) attackers correlating our activity to other activities. YMMV. IANAL. [1] There is some weird "verified by visa" thing that does attempt to confirm identity but I've only seen it once in the last 12 years ...
  • calcifer 5y ago
    For card payments, yes there is no verification but for bank transfers, at least here in the UK, "confirmation of payee" is a thing and wrong names are rejected [1]. [1] https://www.ukfinance.org.uk/confirmation-of-payee https://www.ukfinance.org.uk/confirmation-of-payee
    • max1cc 5y ago
      How is this relevant?
      • OJFord 5y ago
        > There is really no reason to use your real name and address for anything online > wrong names are rejected How isn't it? Unless you're saying 'there is really no reason to participate in e-commerce', which is... true I suppose...
        • rsync 5y ago
          No, I also thought that this was somewhat irrelevant ... None of my e-commerce involves bank transfers. I would decline it as a payment method. I have no idea why anyone would be doing this.
• rohithkp 5y ago
  Bitwarden, Adguard-Home/NextDNS, UBlock Origin, Privacy Badger, Disable Flash, LocalCDN(Replacing Decentraleyes), Selfthosted Paperless-ng and Nextcloud instances for storage and documents with seperate accounts for each family member secured behind authelia with 2FA. Docker-Mail-Server instance with catchall emails for each family member. Enabled 2FA for every sensitive account. Private Selfthosted Wireguard tunnel to access local network services publically (behind a CGNAT network). Non technical family members have been instructed to never use real names while signing up for trivial services online. Guacamole to provide remote assistance when required.
  • ksec 5y ago
    >LocalCDN(Replacing Decentraleyes), I am sure this isn't the first time the idea has popped up. Should LocalCDN be a built-in feature in Browser?
    • rohithkp 5y ago
      Ideally, going by the cancerous nature of the internet in 2021, web browsers should ship with ublock origin, automatic https upgrades, an usable js-blocking toggle and LocalCDN-esque features out of the box. Chrome would never do something like that but maybe firefox could. Improves privacy and usability overall.
• fsflover 5y ago
  Using https://qubes-os.org https://qubes-os.org as a daily driver. Browsing Internet in disposable VMs. Storing passwords in offline VMs.
• deleted 5y ago
  [deleted]
• bigmattystyles 5y ago
  I understand that politicians don’t necessarily look out for the best interest of their constituents over that of powerful lobbies, like big finance. But if it were legislatively possible, would there be any down sides to society as a whole to flipping the script? Meaning make banks the ones responsible for opening an account without doing due diligence? Make credit reporting companies the ones responsible for essential libeling someone for fraudulent credit report entries… I can’t think of any, banks would have to pay to do due diligence but most businesses should have to.
• acd 5y ago
  1. Duckduckgo search engine, privacy 2. Noscript, ublock, privacybradger, vpn ad network 3. No Google, facebook for kids 4. Limited youtube 5. Privacy dns settings, dnsdec over tls 6. Encrypted backups 7. Password manager 8. Paranoid security auto updates
• t0bia_s 5y ago
  Pi-hole as primary DNS, 9.9.9.9 as secondary DNS. All browsers with plugins uBlock, Unhook, Privacy Badger, Decentraleyes. No google services on any device, preferred open source SW. No banking apps on smartphones, all card payments need to be verified by code from SMS and PIN. Pay by cash everywhere it is possible.
  • Peanuts99 5y ago
    It's there a point to using pihole of you have a secondary DNS. Your device will just do a round robin request and could end up with DNS records you want filtered?
    • t0bia_s 5y ago
      Pi-hole require upstream DNS Servers to be set.
  • tugberkk 5y ago
    I always thought using apps (especially on ios) is more secure than browser. Why do you not use them?
• dudul 5y ago
  Freeze your credit report with the 3 main companies.
• fractalf 5y ago
  Replaced my parents PCs running windows, with Linux Mint (they are very happy). PI-hole at home for the "smart" Tv. Ofc linux and firefox (w/ublock and containers). I'm more worries of protecting against tracking/spying than freud
• kwhitefoot 5y ago
  I don't do anything specifically to protect myself online. What I have done is to move to a country where opening an account in someone else's name is really quite difficult. Of course I didn't move with this in mind. Identity theft/fraud seems less frequent here in Norway than in at least the US and UK. This leads me to believe that in the long run it is regulation and the provision of good ways of verifying identity that are the only real solution.