4 ms·

Sorry to hear it. # Here are some of the things that I've done. Here's to hoping it's effective. 1) Everyone uses Bitwarden[0] to store their passwords. We ha

Sorry to hear it. # Here are some of the things that I've done. Here's to hoping it's effective. 1) Everyone uses Bitwarden[0] to store their passwords. We have an Organisation account which makes sharing passwords easy. I check master passwords against HaveIBeenPwned, and ask they use the generated Bitwarden passwords for their accounts. 2) The least tech-saavy amongst my family either get Chromebooks (which I despise because Google), or they get a Windows machine that I lock down pretty hard [1]. The lock-down may look draconian to power users, but they've yet to mention they can't do something they want to. 3) Its listed in the link in (2), but I make sure everyone runs uBlock Origin. It's far more useful than an antivirus. 4) I have a few catch-all emails I encourage my family to use for subscriptions. When asked for an email, use [website name]@[family member code].[domain].[tld]. That way, unless spearfished, you're likely to know the true providence of an email. 5) We have a NAS that is 3-2-1 backed-up, and encourage everyone to keep sensitive information there. Hopefully this is enough to avoid cryptolockers extorting us. # Things I want to do 5) It would be better if we used one of those self-hosted random email generators to prevent maliciously constructed email domains at our catch-all instilling false confidence. 6) I'd like to install PiHole [2]. 7) I have a Twilio number that goes straight to voice mail and sends me the audio files and forwards SMS. I'd like to create these for my family (maybe using extension numbers?) so they can use them on forms. [0] https://bitwarden.com/ https://bitwarden.com/ [1] https://noteaureus.org/post/tutorials/sysadmin/win4unsavvy/ https://noteaureus.org/post/tutorials/sysadmin/win4unsavvy/ [2] https://pi-hole.net/ https://pi-hole.net/

rymurr 5y ago
your tutorial for locking down windows is super useful, thanks! Any recommendations for remote administration? I would like to set this up for my parents but need to be able to address any issues they might have w/o a transatlantic flight ;-)
- hluska 5y ago
  My parents have different levels of technical skills but I help both. My Dad is a nerd - I didn’t see it coming but I’m planning on stealing his lunch money the next time I get to see him. My Mom really hates computers and though I know this isn’t technically possible, they seem to hate her back. Despite their differences, I can use Quick Assist with both. And between my Dad’s sudden turn towards becoming me in high school and my Mom’s innocent transgressions, I’ve never run into anything I couldn’t fix with it. Worst case scenario, my Dad and I have talked about a volunteer based group of people who help other cats around his age. If your parents are on the same side of the ocean as we are, we can help in a closer timezone. My Dad is a retired police officer (you can trust him) turned nerd (you maybe shouldn’t trust him) and I’ve been drafted into the odd role of his nerd supervisor. If you’re worried about your folks, he’ll give them his phone number.
  - mapster 5y ago
    You should blog about this. Super relevant now w booming boomer demo.
- PenguinCoder 5y ago
  AnyDesk is free for personal use, as long as you're not for some reason domain joined.
- jszymborski 5y ago
  Glad you liked the tutorial :) I don't have a lot of experience with remote administration, but I use Tailscale with RDP/VNC/SSH to access my own machines when I'm away from them. I like to avoid TeamViewer/AnyDesk/etc... because the GUI makes it too easy for folk to get scammed (watching Kitboga all these years makes me want to avoid them like the plague).
admax88qqq 5y ago
I seem to be on a continual quest for better backup/storage. I'd love to hear more about your NAS setup.
- verve_rat 5y ago
  Yes, me too. I've got a unraid nas at home and I've really struggled to figure out a no hassle backup solution.
- jszymborski 5y ago
  I doubt it's the perfect backup set-up, but I've been able to do regular restore tests. I have a Synology NAS which has a Borg community package. I use BorgBase for remote backups, and have another local backup on one of the volumes in the NAS. I keep dailies for a week, monthlies for a year and three yearlies, with automatic pruning. Once a year, I do my best to back-up my most important stuff on DVDs, but I'm not a very disciplined person. I keep them on a spindle, which is also probably bad practice.
garrtt 5y ago
Not very familiar with self hosted emails, could you explain how the subscription emails work? How does putting the website before the @ work? Does your email server then forward those emails to the corresponding family member since I’m guessing the email address doesn’t exist before subscribing.
- jimktrains2 5y ago
  Each family member has a subdomain all to themselves. The website before the @ allows them to know where the sender got the email address from. You can have catch-all addresses on emails, so anything without a mailbox is sent to the default mailbox that's configured. It need not be self hosted to do this. Most email providers provide this functionality.
  - jszymborski 5y ago
    That's exactly right. I don't self-host the email (you can use any service that takes catch-alls like mailbox.org). anything '@subdomain' gets forwarded to its respective family member's email.
- 2Gkashmiri 5y ago
  i use mailinabox on a cheap vps. 10-20 minutes install no problem. what the poster meant was hackernews@12.familyname.xyz here 12 is family member code and hackernews is the actual website where that person is trying to get registered. this is pretty awesome setup because if you get spams from anyone, you can simply see which family member signed up for which website and which one is leaking data. the next step, if required would be to delete that account/email and be done with it. no more spam, no more going back. If you do need that email in future, recreating it would be trivial, like if you need to get back into an old account or the like
runjake 5y ago
If you can’t find time to getting Pi-hole going, check out NextDNS, which is only $1.99 a month and very configurable (if you want. It also has sensible defaults.) https://nextdns.io https://nextdns.io I believe the fellow who runs NextDNS is on HN.
- culopatin 5y ago
  You don’t even need to pay. I’ve been using the free version on 3 devices and I’ve never gotten to max out the number of requests
a-r-t 5y ago
The problem with Twilio numbers (or any other VoIP) is that most websites don't accept them for account creation.
- rsync 5y ago
  If you're really going to go down this rabbit hole (and this is HN, after all) you should consider creating and maintaining a "2FA Mule": https://news.ycombinator.com/item?id=28251107 https://news.ycombinator.com/item?id=28251107
  - a-r-t 5y ago
    This is pretty cool, but it adds flexibility rather than security.
  - jszymborski 5y ago
    Interesting! This honestly does not seem that awful to set up at all.
codegeek 5y ago
Also go here https://identitytheft.gov https://identitytheft.gov and make sure to follow the steps they have.
unbanned 5y ago
>I check master passwords against HaveIBeenPwned How? I'm just imagining the wallet inspector from that episode of the Simpsons
- jszymborski 5y ago
  haha, yah there's a deal of trust in managing systems like this. Luckily they can also check the passwords themselves, but I try to teach them not to input their master password into websites that aren't on the bitwarden domain. I use the website directly https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
  - unbanned 5y ago
    Why can't you submit a {modern popular secure hash} of your password to this website? Your password will be in plain text in their logs. Ridiculous. Didn't have I been owned recently get sold to someone as well?
Abishek_Muthian 5y ago
> The least tech-saavy amongst my family either get Chromebooks (which I despise because Google), or they get a Windows machine that I lock down pretty hard Sounds reasonable, Installing alternate OS on Chromebooks is also an option[1]. This is especially useful since Chromebooks are often subsidized and portable laptops capable of running Linux (or even Windows) often cost at least 2x more. Note: Alternate OS on Chromebooks doesn't guarantee bypassing hardware level data collection if any. > I'd like to install PiHole Add NETDATA[1] to the same device you're installing PiHole in and set up alerts on Netdata. This way you can get an notification when there's weird activity on the network(not just silent blocking), e.g. You'll see apps from your phone, tablet calling out their analytics mama during midnight to push out data. [1] https://mrchromebox.tech/ https://mrchromebox.tech/ [2] https://learn.netdata.cloud/guides/monitor/pi-hole-raspberry-pi https://learn.netdata.cloud/guides/monitor/pi-hole-raspberry...
- jszymborski 5y ago
  Interesting! Now I have extra reason to set-up that Pi-Hole :) Thanks!
mapster 5y ago
Has no one wrapped up the above into a business?

rymurr 5y ago

your tutorial for locking down windows is super useful, thanks! Any recommendations for remote administration? I would like to set this up for my parents but need to be able to address any issues they might have w/o a transatlantic flight ;-)

hluska 5y ago
My parents have different levels of technical skills but I help both. My Dad is a nerd - I didn’t see it coming but I’m planning on stealing his lunch money the next time I get to see him. My Mom really hates computers and though I know this isn’t technically possible, they seem to hate her back. Despite their differences, I can use Quick Assist with both. And between my Dad’s sudden turn towards becoming me in high school and my Mom’s innocent transgressions, I’ve never run into anything I couldn’t fix with it. Worst case scenario, my Dad and I have talked about a volunteer based group of people who help other cats around his age. If your parents are on the same side of the ocean as we are, we can help in a closer timezone. My Dad is a retired police officer (you can trust him) turned nerd (you maybe shouldn’t trust him) and I’ve been drafted into the odd role of his nerd supervisor. If you’re worried about your folks, he’ll give them his phone number.
- mapster 5y ago
  You should blog about this. Super relevant now w booming boomer demo.
PenguinCoder 5y ago
AnyDesk is free for personal use, as long as you're not for some reason domain joined.
jszymborski 5y ago
Glad you liked the tutorial :) I don't have a lot of experience with remote administration, but I use Tailscale with RDP/VNC/SSH to access my own machines when I'm away from them. I like to avoid TeamViewer/AnyDesk/etc... because the GUI makes it too easy for folk to get scammed (watching Kitboga all these years makes me want to avoid them like the plague).

admax88qqq 5y ago

I seem to be on a continual quest for better backup/storage. I'd love to hear more about your NAS setup.

verve_rat 5y ago
Yes, me too. I've got a unraid nas at home and I've really struggled to figure out a no hassle backup solution.
jszymborski 5y ago
I doubt it's the perfect backup set-up, but I've been able to do regular restore tests. I have a Synology NAS which has a Borg community package. I use BorgBase for remote backups, and have another local backup on one of the volumes in the NAS. I keep dailies for a week, monthlies for a year and three yearlies, with automatic pruning. Once a year, I do my best to back-up my most important stuff on DVDs, but I'm not a very disciplined person. I keep them on a spindle, which is also probably bad practice.

garrtt 5y ago

Not very familiar with self hosted emails, could you explain how the subscription emails work? How does putting the website before the @ work? Does your email server then forward those emails to the corresponding family member since I’m guessing the email address doesn’t exist before subscribing.

jimktrains2 5y ago
Each family member has a subdomain all to themselves. The website before the @ allows them to know where the sender got the email address from. You can have catch-all addresses on emails, so anything without a mailbox is sent to the default mailbox that's configured. It need not be self hosted to do this. Most email providers provide this functionality.
- jszymborski 5y ago
  That's exactly right. I don't self-host the email (you can use any service that takes catch-alls like mailbox.org). anything '@subdomain' gets forwarded to its respective family member's email.
2Gkashmiri 5y ago
i use mailinabox on a cheap vps. 10-20 minutes install no problem. what the poster meant was hackernews@12.familyname.xyz here 12 is family member code and hackernews is the actual website where that person is trying to get registered. this is pretty awesome setup because if you get spams from anyone, you can simply see which family member signed up for which website and which one is leaking data. the next step, if required would be to delete that account/email and be done with it. no more spam, no more going back. If you do need that email in future, recreating it would be trivial, like if you need to get back into an old account or the like

runjake 5y ago

If you can’t find time to getting Pi-hole going, check out NextDNS, which is only $1.99 a month and very configurable (if you want. It also has sensible defaults.) https://nextdns.io https://nextdns.io I believe the fellow who runs NextDNS is on HN.

culopatin 5y ago
You don’t even need to pay. I’ve been using the free version on 3 devices and I’ve never gotten to max out the number of requests

a-r-t 5y ago

The problem with Twilio numbers (or any other VoIP) is that most websites don't accept them for account creation.

rsync 5y ago
If you're really going to go down this rabbit hole (and this is HN, after all) you should consider creating and maintaining a "2FA Mule": https://news.ycombinator.com/item?id=28251107 https://news.ycombinator.com/item?id=28251107
- a-r-t 5y ago
  This is pretty cool, but it adds flexibility rather than security.
- jszymborski 5y ago
  Interesting! This honestly does not seem that awful to set up at all.

codegeek 5y ago

Also go here https://identitytheft.gov https://identitytheft.gov and make sure to follow the steps they have.

unbanned 5y ago

>I check master passwords against HaveIBeenPwned How? I'm just imagining the wallet inspector from that episode of the Simpsons

jszymborski 5y ago
haha, yah there's a deal of trust in managing systems like this. Luckily they can also check the passwords themselves, but I try to teach them not to input their master password into websites that aren't on the bitwarden domain. I use the website directly https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- unbanned 5y ago
  Why can't you submit a {modern popular secure hash} of your password to this website? Your password will be in plain text in their logs. Ridiculous. Didn't have I been owned recently get sold to someone as well?

Abishek_Muthian 5y ago

> The least tech-saavy amongst my family either get Chromebooks (which I despise because Google), or they get a Windows machine that I lock down pretty hard Sounds reasonable, Installing alternate OS on Chromebooks is also an option[1]. This is especially useful since Chromebooks are often subsidized and portable laptops capable of running Linux (or even Windows) often cost at least 2x more. Note: Alternate OS on Chromebooks doesn't guarantee bypassing hardware level data collection if any. > I'd like to install PiHole Add NETDATA[1] to the same device you're installing PiHole in and set up alerts on Netdata. This way you can get an notification when there's weird activity on the network(not just silent blocking), e.g. You'll see apps from your phone, tablet calling out their analytics mama during midnight to push out data. [1] https://mrchromebox.tech/ https://mrchromebox.tech/ [2] https://learn.netdata.cloud/guides/monitor/pi-hole-raspberry-pi https://learn.netdata.cloud/guides/monitor/pi-hole-raspberry...

jszymborski 5y ago
Interesting! Now I have extra reason to set-up that Pi-Hole :) Thanks!

mapster 5y ago

Has no one wrapped up the above into a business?