4 ms·

With security the first question always needs to be, "What is your threat model?" I'm sure this list has some valuable tips but it just jumps into a bunch of "

With security the first question always needs to be, "What is your threat model?" I'm sure this list has some valuable tips but it just jumps into a bunch of "do this, don't do that" action items without contextualizing recommendations for what an individual is trying to protect themselves against, or what they don't care about.

booi 5y ago
Part of the reason to have a list like this is so people can pick up good security practices without having to think about and understand possible threat vectors. For example, it's unlikely a lay person would even know that they should be checking that they're looking at https versions of sites and they probably shouldn't have to know that. We as the tech community could easily just recommend them the HTTPS everywhere extension and call it a day.
- djrogers 5y ago
  Hard disagree here - without knowing the why, people will inevitably lapse. Your example is a great one - if a lay person saw a website that wouldn't load with the extension you recommended them, they'd just turn it off if they didn't know why it mattered.
  - billdietrich1 5y ago
    No, I disagree. Most people are so baffled by computers that they don't want to know "why" or "how things work". They just want to be told what to do, or better still they just want you to make it work. So just tell them "here, do backups THIS way, use THIS password manager, I've installed an ad/script-blocker in your browser, now you're in better shape".
SrslyJosh 5y ago
One of the first things I noticed is "Avoid Face Unlock." Their rationale is: > there are numerous ways to fool it and gain access to the device, through digital photos and reconstructions from CCTV footage. The words "fool it" link to a four year old Forbes article that doesn't actually describe any successful attacks in detail. I'm not saying that there aren't successful attacks (there are, particularly for devices that rely entirely on a front-facing camera), but I find the lack of nuance here to be unhelpful. A cheap smartphone that just uses its front-facing camera for facial recognition is not the same thing as a high-end smartphone that incorporates a depth sensor, and this list should communicate that clearly and link to more relevant information. (Like actual, successful attacks on facial recognition systems.)
- autoexec 5y ago
  Facial recognition has a long history of attacks, poorly designed implementations, and abuses. You can avoid every one of those problems (past, current, and future) by just not using it. It doesn't matter if you've got a cheap cell phone or the newest thing off the line, attacks will evolve as technology patches up old problems. Sources and links to more detailed info isn't a bad idea, but specific examples will be outdated much more quickly than the general advice will remain relevant.
  - NavinF 5y ago
    The alternative is a pin that anyone can watch you type in. “gain access to the device, through digital photos and reconstructions from CCTV footage” is a hell of a lot harder than reconstructing a pin from CCTV footage ;)
    - autoexec 5y ago
      > The alternative is a pin that anyone can watch you type in. If they're standing directly over your shoulder sure, but you show your face to far more people. You may also be able to have your phone scramble the order of the numbers to make it harder for people to know your pin, or use gestures to unlock your device. You can also reset you pin far easier than you can reset your face. face recognition can work even if you're asleep, unconscious, or dead too, but nobody can ask you for a pin in that situation.
logifail 5y ago
> With security the first question always needs to be, "What is your threat model?" Great point, but where could one/should one start trying to work out the answer to that question, both at a personal level and in a business setting?
- elefanten 5y ago
  I’m curious too. Most of the passing discussions I’ve heard focuses on: 1) How rich are you 2) Which governments want to lock you up for your beliefs/endeavors? I’m wondering if there are other big topics or any interesting nuance
  - vorpalhex 5y ago
    Likelihood of attack and who the likely attackers are. My elderly mother is likely to be attacked but those attackers are unskilled low rent scammers and chase lots of leads. A well known author is likely to be attacked by singular focused attackers who will do research and stalk their victims. An activist is more likely to face Government level attackers than my elderly mother.
- woojoo666 5y ago
  This video by TechLore is a good start: https://www.youtube.com/watch?v=DHZRhboZhfI https://www.youtube.com/watch?v=DHZRhboZhfI
ozim 5y ago
List is saying "personal checklist" and then each point has "recommended", "optional", "advanced". By reading with understanding - threat model for this list is average Joe that is using internet on daily basis, but is not too technical maybe decent at using computers, so recommended for me seems like good baseline for everyone. Optional is for showing what are other options that someone might try out, but mostly are not that important. Advanced is for showing off that author knows more than basics, hence implementing any of it would be security larping most of the time. Well maybe author should add more context but from what I see, someone can still infer context of recommendations, without stating it explicitly.
billdietrich1 5y ago
I think most people's threat model is the same. They just want to protect all their data against all threats, to a reasonable level of inconvenience. It's too general to be useful. So, instead of trying to come up with a threat model, just use best practices. Backups, password manager, blockers in browser, software updating, firewalls, etc. Now, if you're the 1 person in 100 or 1000 who has a stalker or who is ordering drugs over the internet, trying to create a specific threat model is appropriate.

booi 5y ago

Part of the reason to have a list like this is so people can pick up good security practices without having to think about and understand possible threat vectors. For example, it's unlikely a lay person would even know that they should be checking that they're looking at https versions of sites and they probably shouldn't have to know that. We as the tech community could easily just recommend them the HTTPS everywhere extension and call it a day.

djrogers 5y ago
Hard disagree here - without knowing the why, people will inevitably lapse. Your example is a great one - if a lay person saw a website that wouldn't load with the extension you recommended them, they'd just turn it off if they didn't know why it mattered.
- billdietrich1 5y ago
  No, I disagree. Most people are so baffled by computers that they don't want to know "why" or "how things work". They just want to be told what to do, or better still they just want you to make it work. So just tell them "here, do backups THIS way, use THIS password manager, I've installed an ad/script-blocker in your browser, now you're in better shape".

SrslyJosh 5y ago

One of the first things I noticed is "Avoid Face Unlock." Their rationale is: > there are numerous ways to fool it and gain access to the device, through digital photos and reconstructions from CCTV footage. The words "fool it" link to a four year old Forbes article that doesn't actually describe any successful attacks in detail. I'm not saying that there aren't successful attacks (there are, particularly for devices that rely entirely on a front-facing camera), but I find the lack of nuance here to be unhelpful. A cheap smartphone that just uses its front-facing camera for facial recognition is not the same thing as a high-end smartphone that incorporates a depth sensor, and this list should communicate that clearly and link to more relevant information. (Like actual, successful attacks on facial recognition systems.)

autoexec 5y ago
Facial recognition has a long history of attacks, poorly designed implementations, and abuses. You can avoid every one of those problems (past, current, and future) by just not using it. It doesn't matter if you've got a cheap cell phone or the newest thing off the line, attacks will evolve as technology patches up old problems. Sources and links to more detailed info isn't a bad idea, but specific examples will be outdated much more quickly than the general advice will remain relevant.
- NavinF 5y ago
  The alternative is a pin that anyone can watch you type in. “gain access to the device, through digital photos and reconstructions from CCTV footage” is a hell of a lot harder than reconstructing a pin from CCTV footage ;)
  - autoexec 5y ago
    > The alternative is a pin that anyone can watch you type in. If they're standing directly over your shoulder sure, but you show your face to far more people. You may also be able to have your phone scramble the order of the numbers to make it harder for people to know your pin, or use gestures to unlock your device. You can also reset you pin far easier than you can reset your face. face recognition can work even if you're asleep, unconscious, or dead too, but nobody can ask you for a pin in that situation.

logifail 5y ago

> With security the first question always needs to be, "What is your threat model?" Great point, but where could one/should one start trying to work out the answer to that question, both at a personal level and in a business setting?

elefanten 5y ago
I’m curious too. Most of the passing discussions I’ve heard focuses on: 1) How rich are you 2) Which governments want to lock you up for your beliefs/endeavors? I’m wondering if there are other big topics or any interesting nuance
- vorpalhex 5y ago
  Likelihood of attack and who the likely attackers are. My elderly mother is likely to be attacked but those attackers are unskilled low rent scammers and chase lots of leads. A well known author is likely to be attacked by singular focused attackers who will do research and stalk their victims. An activist is more likely to face Government level attackers than my elderly mother.
woojoo666 5y ago
This video by TechLore is a good start: https://www.youtube.com/watch?v=DHZRhboZhfI https://www.youtube.com/watch?v=DHZRhboZhfI

ozim 5y ago

List is saying "personal checklist" and then each point has "recommended", "optional", "advanced". By reading with understanding - threat model for this list is average Joe that is using internet on daily basis, but is not too technical maybe decent at using computers, so recommended for me seems like good baseline for everyone. Optional is for showing what are other options that someone might try out, but mostly are not that important. Advanced is for showing off that author knows more than basics, hence implementing any of it would be security larping most of the time. Well maybe author should add more context but from what I see, someone can still infer context of recommendations, without stating it explicitly.

billdietrich1 5y ago

I think most people's threat model is the same. They just want to protect all their data against all threats, to a reasonable level of inconvenience. It's too general to be useful. So, instead of trying to come up with a threat model, just use best practices. Backups, password manager, blockers in browser, software updating, firewalls, etc. Now, if you're the 1 person in 100 or 1000 who has a stalker or who is ordering drugs over the internet, trying to create a specific threat model is appropriate.