Basic security precautions for non-profits and journalists (2017) | Hacker News Reader

Basic security precautions for non-profits and journalists (2017)

techsolidarity.org

71 pointsColinWright44 comments

Open articleView on HN

Previous HN post of this article and discussion from February 2017 with a wealth of advice and comments:

https://news.ycombinator.com/item?id=13622684

> Don't store sensitive information in cloud services like Evernote or Dropbox.

Good advice but distinguishing when the cloud is involved is getting harder, even for technical people.

They recommend (in another article on congressional campaigns) using Google Drive over Evernote or Dropbox.

How about iCloud Drive? Trustworthy/secure as Google Drive?

Don’t use Android... do use Gmail?

I though the same thing, and they also say use Chrome. Maybe two different threat models? I'd say Gmail is very secure, maybe not very private though? It seems like it would be super hard for an average bad guy to break into a Gmail account. So if you're defending yourself against people who are trying to break into your email account through average methods, Gmail is the way to go.

I think the main argument here is that Gmail+Chrome lets you use a hardware second factor for login.

Tangent: I thought with webauthn and the new Firefox, U2F keys should work with Google Services.

Has anyone been able to log in using a Yubikey and Firefox to Google? Because I haven't.

Yes, I do this, on Debian stable, using the browser download from the Firefox website. You need a recent Firefox (I think the latest ESR is fine but not before that) and for stupid reasons you need to register the security key with Chrome, but once it's associated with your account you can log in via Firefox.

The register/use distinction is really stupid, but probably what's going to help me. Thanks a lot!

> Has anyone been able to log in using a Yubikey and Firefox to Google? Because I haven't.

Yes, this works ever since Google introduced new accounts page. Tested with Firefox on Windows and Linux.

It should be supported in Firefox now. In general you should be fine using Firefox (note: not Tor Browser) if security is important to you.

What are your reservations about Tor Browser? (Or is it just that Tor is a different threat model and ballgame?)

For this threat model (hacking by nation states and political activists) the focus is on the individual products, not the company. Gmail and Chrome are considered to be the most secure options; Android is not.

This is likely because the threat model does not include a threat for data which is collected for advertising purposes, but rather prioritizes the threat of random hackers or mid-high-range resourced state level actors.

While Google is certainly a threat for those of us who value privacy, this is a different issue than being persistently targeted by resourced hackers.

Also, Google are one of the more secure email providers, they spend a fairly significant amount of resources towards researching and defending against resource rich state actors. This combined with how seemless they’ve made hardware based 2 factor work with their products makes them one of the better options for anyone who will be persistently targeted like a journalist. And anyone with a threat model similar to a journalist will be using u2f if they have any technical sense whatsoever.

But isn’t Gmail going to give your unencrypted emails up when they get a warrant?

That's right.

It's not about avoiding Google. Google does excellent security work. It's about using the most secure products in each category. An Android phone can be made asymptotically as secure as an iPhone, but only by an expert.

Buy a Pixel, set a secure passcode. There you go.

No, that's wishful. The Pixels are the most secure Android phones you can buy, but they are not natively as secure as an iPhone.

But: if it helps put a dumb argument to rest, consider that in the populations being trained, "Android phone" means "phone from an insane variety of vendors, most of whom are not competent to sell or maintain a secure phone".

Pixels are the #1 pick for security, but not with it's default ROM installed. https://copperhead.co/ is a seriously hardened ROM without google play services and simply having security as a #1 priority.

I don't even know where to start with this but let's just stipulate that when I said "experts can get an Android phone asymptotically as secure as an iPhone", I meant stuff like "people can pick very specific models and then install an entire custom operating system on the phone". I don't actually agree with what you're saying, but the argument will be unproductive, and I think we're close enough that my point stands.

Why iPhone instead of Android?

Couple of odd points

- Don't use your fingerprint to lock/unlock devices.

(presumably because you can be unconscious, and still unlock your phone?)

But the stand out one for me was

If you have a Windows laptop, uninstall any antivirus products except for Windows Defender (from Microsoft).

I am assuming this means that they don't trust Symantec? Who might be installing backdoors? How verified is this threat? And should we tell every major bank / finance house / government who seem to have AV everywhere.

AFAIK in the US, you can be forced to unlock your phone with fingerprint (as in, they'll hold your finger on your phone by force if necessary), but not with your password.

Regarding AV, there's been a bunch of security problems with anti virus and "security" software bundled with anti virus packages, I'd guess that's the reason.

This is an example of what makes it so hard to communicate security advice to laypeople: nerds come out of the woodwork trying to reconstruct and critique the advice from first principles, and going off on all sorts of weird tangents.

So: no, nobody serious trusts Symantec. But not because they're "installing backdoors"; it's because their software is complicated, embedded deep into the guts of the operating system, is historically full of bugs, and doesn't actually solve the problem it purports to solve.

OK. I should have been ... clearer - what I meant was if not using AV is good advice, why is that and why do so many many corporates ignore that advice?

The why is AV untrustworthy you covered, but why do so many people keep using it?

Edit: I could take a guess but not now :-)

If you really need to open an attachment, it’s best to open it on Google Drive, in the cloud. Let them deal with any virus issues.

Why corporates continue to use third-party AV is probably a combination of momentum, marketing, and 'something must be done - this is something' but I'm just speculating.

> presumably because you can be unconscious, and still unlock your phone?

You can, in the US, also be legally forced to unlock your phone by fingerprint, while you can't be forced to input your password, AFAIK.

Lists like these are dangerous as they should be tailored per situation/person.

On most occasions i have experience with it's usually best for the operative to behave like the generic tech-moron he/she is in order to NOT stand out of the crowd / raise attention. When something sensitive is about to commence, stick the TAILS usb stick in the laptop & go. Microwave the USB stick when done. But as in my first alinea; advice like this should be tailored at all times.

Hence the title: "basic security precautions" for "non-profits" and "journalists".

Both ( political ) non-profits and journalists are targeted by nation states. Not just in developing nations, but also in the EU and USA. This implies that just "Basis security precautions" don't suffice by a longshot, in fact they become a threat.

It's easy to forget that people from all over the world comment here, and colloquialisms in the US might not translate to wherever it is you're from (I have no idea, FWIW). So, my guess is that you and I are just using two different meanings of the words "basic precautions".

Security has trade offs that need to be carefully weighed for each situation before some appropriate decisions are taken (with the benefit of knowledge).

But a big hurdle here is that the target audience has a critical need to have very good protective measures in place but is also at the same time very likely not to know about the trade offs or how to weigh the trade offs or even have a relatively good understanding of the basis of the trade offs. Hence the need for generic advice that could be easier to follow for most people while providing a better set of protections than the status quo (with the status quo being not even considering the security part and making assumptions based solely on habit and convenience).

Anyone who has taken some of this advice to heart and still is unsure would usually find a way to ask people who know better for tailored advice.

For a general statement I agree with you. I find it even a good thing to teach everyone, not just journalists, basic data hygiene. The target audience set however is far from general. They are journalists and non-profits. Such entities have adversaries such as https://en.wikipedia.org/wiki/Tailored_Access_Operations haunting them. Even most well trained security professionals are far from qualified enough to deal with such actors. In other words, people should be honest with the journalists and tell them they are not competent enough to assess or commit trade offs. On most occassions, knowing you are not secure is the best security you can get as it alters your behaviour accordingly.

The list says to use an iPhone instead of a laptop, I presume because the iPhone has hardware encryption coming from the Secure Enclave. But newer MacBook Pros from Apple, and even the iMac Pro, feature the T2 chip to achieve the same result as the Secure Enclave with regards to encryption.

I guess my point is this list is deeply flawed because it explains none of its decision-making process. Journalists aren’t idiots. Tell them why they should not use a laptop.

Working journalists don't care about the T2 chip in the iMac Pro. They don't even know what it is.

(Maybe a few tech journalists do, but certainly it's going to be a small minority of journalists in general)

You’re not even following the logic of the list: it explains in detail how to turn on full disk encryption, meaning that journalists should care about those details.

I guess my second point is: don’t trust a list about security that was not updated in a year.

Please do tell us which of the details on that list are now outdated.

Two small things: the list says to buy an iPhone Se, 6 or 7. Obviously newer iPhones have been released. Someone could construe that as implying there is something wrong with the newer iPhones, when it’s quite the contrary on the security front.

The list bans laptops, all laptops. For no explained reason. I assume it’s because of hardware encryption, and since last year we now have hardware encrypted computers from Apple (the 2018 MacBook Pro and the iMac Pro).

The list bans laptops because they are general computing devices where you install a huge multitude of programms willy-nilly from all kinds of sources.

Chromebooks are exempted, because they are basically a web browser and little more.

I mean, yes, that is the reason the guidelines recommend avoiding laptops, but it's also worth saying that not only does the list not ban laptops, but it also has multiple recommendations for using laptops more securely.

Trained a lot of journalists, have you? A lot of them asked you about the chipsets in the machines they were using?

For what it's worth: no, the important difference between a Macbook and an iPhone isn't the SEP.

What is so different from physical access to an unlocked iPhone than an unlocked Mac? You’re screwed either way, no?

Yes, if someone has physical access to an unlocked iphone or mac you're screwed. The author's idea might rather be about the OS, the main difference between an iphone and a mac (or pc for that matter) is the os. Hence the recommandation for a chromebook.

I suppose the author assumes that on ios a random website is less likely to have access to your files (articles).

So this might be more about protection from attackers who don't have physical access to the device.

Reply on news.ycombinator.com