Security

Security

Security is a broad term covering everything from stopping your girlfriend from finding your porn folder to stopping the NSA from breaking into your nuclear power plant.

In our post-Snowden world, it is easy to fall into security nihilism (i.e. "'they' know everything so why bother?") or to think you have nothing to hide.

The worst thing you can have is a false sense of security.

This page cannot possibly define every attack and mitigation strategy available. Instead it aims to provide a decent overview of basic security principles and techniques.

Define your adversary

Who/What do you want to have security from? Who/What is a threat to you? Who/What do you want to keep things private from?

• Your mother?
• Thieves?
• Hackers, Viruses, Malware and Phishing?
• Advertisers/Marketing companies who build profiles on you to sell you garbage?
• Rivals and rival businesses?
• Government policies you don't agree with and wish to legally avoid?
• Foreign government policies you don't agree with?
• Copyright trolls?
• Local Law Enforcement Agencies (LEA)?
• National Law Enforcement Agencies?

or perhaps you wish to:

• Publish anonymously?
• Keep journalistic sources safe?
• Participate in whistleblowing?

or are you under attack from:

• Psycho ex-partners/family members?
• Internet trolls/doxxers?

or maybe you just want to:

• Be as secure as possible as a fun experiment?

Knowing your "enemy" is important. Thinking in terms of NSA technology is depressing, but narrowing your threat down to advertising trackers makes the battle seem much more practical and winnable.

Threat analysis

For any adversary, there are a few key factors you must consider if you want to create an effective defense.

• Competence - Just because it's possible to defeat your security, doesn't mean your adversary can. Not everyone knows how to do everything.

• Resources - Knowing how to do something and being able to do it are two different things. For instance, the adversary may know a quantum algorithm to quickly crack your encrypted file, but if they don't actually have access to a quantum computer, that won't do them much good (although they can archive the file indefinitely until QCs become commonplace).

• Motivation - Does the attacker want to attack you? The attackers that have the most competence and resources often want to get something worthwhile for their trouble. They prefer high value targets like banks, government sites, corporate networks, eCommerce credit card databases, and huge swathes of very insecure computers that can be used as botnets. You don't really need to have perfect security to avoid getting attacked, you just need to have more security than is worth defeating to get what you have (or appear to have).
• Physical access - It is a maxim of security that if the adversary has physical access to your computer, you've lost. Physical access doesn't just mean stealing the computer and putting it in a secret vault, it can be as simple as being able to come into your house and plant some kind of concealed device on the computer while you're out buying groceries.

Typically, the most dangerous hackers have high competence but not physical access. The ones that have physical access rarely are competent. The ones that have both resources and competence have better things to do than hack you. At most you will be hit by their automated software that looks for common, typical weaknesses (really bad passwords like "qwerty" or "rosebud", running vulnerable software that is years behind on security updates) in millions of machines. This is why security through obscurity will work on them - they can easily defeat your system, but it's not worth it for them since there's not enough people like you out there to justify the effort of writing a hack.

So, at both ends of the spectrum you have a balance: Each class of adversary always has one or more severe disadvantage. You can exploit this to create strong defense. The one exception is government intelligence agencies like NSA. These have both physical access, are highly competent, and have immense resources. The only thing standing between you and them is motivation. In other words, the moment NSA has a reason to suspect you, you're done. Best you can do is don't do things they don't like.

Practices by kind of adversary

Against your mother

Your mother can:

• Physically access your computer.
• Physically access your computer when you're not there.
• Spy over your shoulder.

These can be serious security implications, however your mother is unlikely to either:

• Have the technical knowledge to perform an attack.
• Have the motivation to perform an attack.

Her motivation:

• None, actually. All your mother is likely to do is walk past when you're masturbating, or perform a Windows Search for her cat photos and accidentally turn up your hentai.

In response, you can:

• Lock the door to your room.
• Zip/rar/7z your porn with a password.
• Encrypt your home directory.
• Put a password on your bios and deny her booting your computer.

Against thieves

Thieves can:

• Physically steal your computer and deny you access to your data.
• Remove the storage drive from your computer and recover data.
• Recruit a nerd friend to do something with your hardware.
• Sell your storage drive to someone who might be actually interested in its content.

Their motivation:

• Making money as fast as possible from selling off your stuff. If they can get your data they will sell it, but if they can't they will settle for the cash value of your hardware.

They are interested in:

• First and foremost, your hardware.
• In second term, whatever personal data they can find inside. They will usually give up if they can't access it.

In response you can:

• Encrypt your home directory.
• Use full disk encryption.
• Backup your data and physically hide it.

Against hackers, viruses, malware and phishing

Assuming hackers here are your run of the mill script kiddies and not nation states, hackers can:

• Use Remote Exploits to access your computer (hacking your computer).
• Trick you into running exploits on your computer (viruses, malware).
• Trick you into disclosing the credentials to your computer or web services (phishing).
• Manipulate company employees into handing over your login details or control of your account (social engineering)
• Guess the credentials to your computer or web services (cracking).
• Break into web services and determine your credentials (hacking web services).

While hackers will always know about security problems before everyone else, they are less likely to use their brand new exploits against random people. High value targets (whether they be financial (paypal?), political (fbi website?) or lulzy (the fappening)) are much more likely to be their focus. Unknown exploits are valuable: They are obtained by hard work or paying for them on the black market. But the moment you use them, everyone will find out and patch the hole. So the hacker wants to make it count, he doesn't want to blow his one shot on something worthless.

Day to day attacks will be from relatively unskilled hackers (script kiddies) and deployed against ip address on the internet.

Occasionally a large internet service will lose it's password database to hackers e.g. twitch.tv. Sooner or later one of these headline hacks will affect you.

In response you can:

• Keep your operating system and software up to date to cut down on remote exploits.
• Use anti-virus and anti-malware scanning software.
• Be wary about running unknown software or logging into untrusted sites (common sense 2016).
• Run a restrictive firewall to allow only certain applications access to the network.
• Use a password manager to generate random, secure passwords for your local computer accounts and web services.
• Use a different password on each site. Knowing one password shouldn't make it easier to guess the others.
• Give fake personal info where possible, so that info from one hacked account can't be used to break into other accounts by messing with the "Forgot Password" feature or calling and manipulating support/customer service.
• Only use trusted web services, and give them as little sensitive data as possible.
• If you shop online, try to delete Credit Cards when you're done using them, don't keep them saved in the account.
• Use Two Factor Authentication (2FA) for higher value web services (banking, email).

Against a jealous girlfriend

Let's supposed that through sheer dumb luck, you managed to get a girlfriend. Unfortunately, she was a jealous bitch from the beginning, but due to >tfwnogf you ended up accepting her anyway. Now you're stuck with a girl who wants to control your entire life. What do you do?

Your girlfriend can:

• Physically access your computer and phone.
• Spy over your shoulder.
• Possibly physically access your computer when you're not there.
• Recruit nerd friends, i.e. hackers, viruses, malware and phishing, to help her break into your devices if you put up any resistance.

Her motivation:

• Get any shred of positive evidence that you're cucking her. For security purposes, assume that a jealous girlfriend is emotionally attached to the idea that you're going to cuck her. No amount of evidence against will ever convince her of the opposite, and a single, dubious figment of evidence in favor will confirm her suspicions. Her determination will be extreme: they say hell hath no fury but that of a woman scorned, so be prepared for a fight that at best will only end when either side decides to break up, at worst with injury or material damage for either side, or if you live in an SJW place, with a false rape accusation.

She is interested in:

• Your location ("why were you on this part of town where this bitch lives?").
• Your communication metadata ("who is that skank you talk to all the time?").
• Your personal media ("who is this bitch in the picture?").
• Your login credentials (there is no better place to find all that than your social media accounts).

In response, you can:

• Do everything you would do against your mom, against thieves and against virii, hackers and malware.
• Never share your passwords. This is going to be the hardest one. Women are natural savants when it comes to emotions and know every single emotional manipulation trick under the sun, and a jealous girlfriend will have no qualms on abusing them if that's what it takes to make you cough up your password. Do not fall for any blackmail, badmouthing, refusal of sexual consent, melodrama, fake tears or blaming. Password sharing is not a proof of love or a ritual of intimacy, it is a dangerous practice that negates every single countermeasure you take against information breaches. Be especially wary if this is your first girlfriend: chances are she perfectly knows you have the relationship experience of a high school kid (even if you consistently negate it, girls are experts at reading your true emotions), meaning that you will fall squarely for every single one of her tricks and charms.
• * Alternatively, create a decoy account and share the password to that. Before sharing, protest that you hardly use your account anyway, and that you're embarrassed about how you don't have any friends. This will make it more credible.
• Keep your phone with you at all times, with a password lock, encrypted and with instant screen lock. Consider enabling the fingerprint reader if securing your phone outweighs giving the botnet your fingerprint.
• * The phone is the weakest link:
• * * A truly strong password makes using the phone very inconvenient, since you have to unlock many times a day and typing on a phone is hard.
• * * Of all your device, the one you will most commonly have to unlock in full view of others is your phone.
• * * The way keyboards are implemented on phones (current character shown unmasked) makes shoulder surfing very easy.
• * * All the convenient options like PIN or pattern are laughably insecure.
• * * She can touch your finger to the scanner while you're asleep.
• * * Face/eye recognition can be defeated with a photo.
• * * Phones are easy to break into by connecting to a computer.
• * It is very hard to keep your phone secure. Either have a secret secondary phone, or do not keep anything valuable on the phone.
• * When deleting something, make sure you immediately overwrite your phone's writable storage with random data; on Android phones this is done with cat /dev/urandom > /sdcard/dsfargeg.fgsfds and then rm /sdcard/dsfargeg.fgsfds on Terminal Emulator.
• * Do a factory reset once in a while; depending on the magnitude of her jealousy, it could be anything from once every other month to every single week.
• Enable two-factor authentication as a safeguard against password sharing. This way, even if you share your password, she will require the login code that has been sent to your sealed, locked, encrypted phone that can only be unlocked with your own finger.
• Be especially wary of spear phishing. Do not click on any weird link sent by your closest friends, or if you feel compelled to do so, open it from a tightly secured operating system (a fresh VM) where you have never logged in to your social networks.
• Keep your GPS off at all times, or use a custom ROM that restricts apps' access to your location.
• Keep your lawyer on standby and call them the very moment she involves law enforcement into the mix (e.g. threatening with a rape accusation).
• Bail out of the relationship the very moment she starts inflicting physical violence on your or your possessions. >tfwnogf is better than >tfw my gf hits me.

Advertisers/Marketing companies

Advertisers can:

• Collect information when you login to them.
• Track you across different websites you visit without logging into them.
• Track you via GPS on your phone.
• Track you online via WiFi on your phone.
• Track you offline via WiFi on your phone.
• Track you offline via credit/debit cards.
• Track you offline via reward/membership cards.

Some of the security (or privacy) threats with advertisers are opt-in (i.e. you accepted it) and generally advertiser tracking isn't going to mess up your day. Problems arise when advertisers sell your information on to third parties (who in turn sell it to other third parties), go broke and auction off your data, get hacked or are victims of mass surveillance.

It's worth noting that their revenue models would be colossally damaged if everyone ran adblocking software.

In response you can:

• Not create social media accounts, or create accounts with false information (although you'll still have the same friends, so are still opting in big time).
• Disable third party cookies in your browsers.
• Turn off GPS on your phone, or use a custom rom to limit which apps have access to your GPS.
• Turn off WiFi on your phone, or use a custom rom to limit which apps have access to WiFi.
• Turn off WiFi when you're out and about, especially in malls/shopping centres.
• Use cash.
• * Debit cards tell your bank what you're buying and who from and where, and they sell that.
• * Credit cards tell VISA/Mastercard/etc what you're buying and who from and where.
• Don't use reward cards. Most people never use the "rewards" and your privacy is worth more.

But I've already given them everything!

So you've already given Facebook your phone number and address and date of birth? They already know your schools and job and hobbies? Why close the gate when the horse has bolted?

• You'll change jobs.
• You'll move house.
• Your interests will change.
• Your friends will change.
• You'll get married/divorced/have children.
• You could even change your name or get married and change your surname.

Sure, the data they have today will still be valid in a week. But in six months? A year? Five years? The sooner you cut off advertisers from up to date information, the sooner it'll be out of date. Their databases will say you still like Linkin Park and Jackass unless you tell them otherwise. They'll also miss out on your patterns over time, not knowing the path of your history and making their future predictions inaccurate.

Cellphone service providers

Your cell phone service provider can:

• See what cell tower you are connected to whenever your phone is on.
• See when your phone is switched off or out of coverage (they can't tell which).
• See who you call and text, when and where, and for how long.
• See who calls and texts you, when where you are, and for how long.
• See your data usage metadata and perhaps "full take" data.
• Sell you a phone preloaded with their applications, which have all kinds of permissions granted.

Cell phones are a big problem when trying to avoid location tracking. Without the cell tower your phone is only a phone when you have WiFi access, or not at all.

In response you can:

• Use OTR in any instant messaging conversations. Install Pidgin and the OTR plugin for PC, and Xabber or ChatSecure for Android.
• Use VoIP and data messaging instead of traditional calls and texts. Encrypted VoIP and messaging exists.
• Convince your contacts to use VoIP and data messaging.
• Install a firewall to restrict which apps have access to the data connection, or turn your data connection off completely.
• Uninstall preloaded apps, flash a custom ROM or buy a standalone phone unlocked from any provider.
• Leave your phone at home when you're going out.
• Keep airplane mode turned on when you don't use your phone (you can have it automatically turn on whenever the screen is off).

Internet service providers

While your ISP is able to collect your metadata and block access to websites, these are generally because of Government Policy. Some ISPs will offer a "family friendly" site blocking option which you can turn off. Remember that while ISPs can most certainly be nefarious, usually it's the laws that compel them to give up your data to security agencies that can do you in, as the ISPs really can't do anything about it, but comply.

Your home or business ISP can:

• Provide you with an email service which they control (e.g. you@yourISP.com).
• Force you to use a modem which they retain root access to, which may also contain serious bugs.
• Send you a modem that is configured by default to use their DNS, allowing easy logging of your traffic.

In response you can:

• Use an alternative email service and/or use PGP.
• Use OTR in any instant messaging conversations. Install Pidgin and the OTR plugin for PC, and Xabber or ChatSecure for Android.
• Bridge your ISP modem to a router which you control (or just ditch your ISP modem for one you bought personally, if possible). $50 will buy you an OpenWRT compatible router.