Hacker News Reader

Comment by idlewords | Hacker News Reader

I want to give a little bit of context to this guide. So far I've done this training with six congressional campaigns, and a very similar one with about two dozen journalists.

Everyone has a limited mental budget for security hassle, and it's a challenge to fit the most important bits of advice into that budget. The hardest bits are those things that are relatively easy to use, but a beast to set up—password managers and security keys.

There's a lot more that could be in this guide, but I've found that it's the most material that I can fit into an hour, and even then the people running for office find it intimidating. However, they are also very glad to get actionable advice, and in a format that is not too technical.

By far the most surprising thing to people on this list is the admonition to turn off anti-virus software.

View on HN

I want to throw some anecdata on this.

Someone I know could be considered a high profile target. A few months back I helped him migrate from Internet Explorer, to Chrome.

I was onsite for most of an afternoon helping the process. For the next few weeks I received phone calls because he was lost and needed help.

I've seen Reddit comments on people in similar positions with statements like "they should be on Qubes OS, period" or "they should use Tails only" or "anyone in that position should be using deblobbed Thinkpad".

I can only tell those commentators they have tried to help such a person. Thank you for a much more realistic view on the situation.

The one you really want to figure out how to nail is the email attachment problem. This is as good as any realistic advice I've seen, but you just know that even for people who read this stuff really carefully, attachments are how they're going to get owned up.

Campaigns seem like they might be easier to wean off attachments than journalists, who routinely email documents back and forth to their editor with 'track changes' turned on. But I'm eager to follow up with campaigns in a couple of months and see whether they actually followed the advice.

Maybe the best thing to do is just ban attachments altogether at the domain admin level?

https://support.google.com/a/answer/2364580?hl=en

Which journalists? City papers have managed their writing/editing workflows in software specifically meant for newsrooms since long before there were GUIs. Freelancers, maybe?

Is there a standard workflow for talking to sources?

No, but there certainly is for filing stories and running them through a series of editing desks.

Keep in mind "journalist" is a broad term now. Most blogs or new media mastheads work that way or track changes in Google Docs/G Suite/whatever. In general, I'd assume you're right about traditional papers, who I'd expect to work the way you suggest.

Smart money is following what WaPo is doing in that space with Arc. They've begun to corner that market.

I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbates phishing. I think U2F probably helps a lot here, but I would really push to move away from web based workflows. It puts a lot of really dangerous UI all in the same window. In a world where people use Outlook (or pine, harhar) they don't type their all powerful email password into the browser because why the hell would the browser ever ask for the email password. But I think that ship has sunk.

First, running things locally opens you to local exploits which, once successful, can capture not only your email password but everything else you do on a computer.

Second, with a password manager, users shouldn't be typing passwords in. I don't even know my Gmail password.

Can you briefly explain about turning off anti-virus? I see that but nothing about why, or why Windows Defender is still ok and how that differs from the general category of anti virus?

Maybe its in your course so you don't want to spill the beans, but all of your other advice seems consistently good, this one could use some more explanation for the uninitiated who have heard the exact opposite for, like, ever. :-)

The problem is that many AVs are not tested well, and prone to actually making you more vulnerable by bugs in their analysis code.

Basically, think of receiving an email with a malware attachment. If you have good hygiene, you won't open it yourself. But your AV will open it to 'scan' it, and that gives it an opportunity to compromise it.

Add the fact that most AV runs with high privileges and is not sandboxes, and this is a pretty bad state.

Because intelligence agencies buy or hack antivirus software because its access patterns don't look suspicious. Scanning your harddrive and uploading random contents? What AV is supposed to be doing.

Windows Defender is different because if Microsoft wants to fuck you and you're using Windows, they already can.

AV only detects already known malware, and often poorly. As a trade off you are running highly privileged code that fundamentally needs to process untrusted input and is often of low quality. For a high interest target, AV software opens up more holes than it closes.

An iPad should be just as secure as an iPhone, right? I'm sure that's much more common and an easier sell than a Chromebook in D.C.

Yeah this is a good point plus the latest iPad Pro is amazing, performance and feature wise.

I live in DC, with socialize with many others in a similar professional situation as infosec people.

I'll read your site again to not wait on answer here, I'm a huge fan of you after reading your longform stuff on Yemen and seeing your mention of the TS idea before on HN 1-2 years ago. Is there any need for volunteers on the ground. What can I do to help you?

Reply on news.ycombinator.com