Comment by hannob | Hacker News Reader

Comment by hannob | Hacker News Reader

Parent Full thread

More than half of that I wouldn't advice or would have serious caveats about the advice given...

This is really a strange document...

Just a few examples:

"Don’t open emails, texts, ]...] from anyone you don’t know, don’t recognize, or weren’t expecting" <- sorry, that's not how email works. I want to get emails from strangers that care about what I do.

"Don’t use unsecure Wi-Fi networks" Largely outdated due to HTTPS and completely impractical. Everyone uses the Wifi at starbucks.

"Even better, get a VPN (virtual private network) — but, just like with antivirus software, don’t use a free VPN." How should an average user know if the VPN is a scam? (More than half of VPN providers are scam and there's little reason to believe that payed providers are always better.)

"Use tough passwords and change them frequently." Changing passwords frequently is considered deprecated advice. The single most important rule about passwords is to use unique passwords. Which they don't say at all...

I could go on...

Update: Mozilla deleted the post after criticism, see https://twitter.com/asadotzler/status/1068961020540899329

I agree and I'm glad that it was taken down. However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices. Most phones should have certain network sharing features disabled before accessing an unsecured network. Among people I know it is common for someone to ask if anyone is currently running a mobile hotspot before opening their own. Questions like "Why not just use the cafe's (or bar's) WiFi?" don't even need to be asked.

Many people click the links at the bottom of a news article, open every email they get and click their contents with abandon and generally ignore they privacy and security on the web. That does not mean that that behavior should go unchallenged or that we should dismiss basic personal security with the old phrase, "Everyone is doing it."

>However, an appeal to popularity, "Everyone uses the wifi at starbucks" is strange to see from someone who is advocating better security practices.

I would call it an "appeal to practicality"

I mean, sure, you and I carry mobile plans with tethering capabilities; my iphone/verizon combo is nearly always better than your average free or included with purchase wifi network. But I also have a device that was like a grand up front and the service is north of $100/month. It's a totally reasonable and practical solution for me, sure, but for someone who doesn't work in tech, or for someone who has kids, etc, etc... for a lot of people, spending that much on connectivity is not particularly practical.

(you can get cheaper tethering setups, of course; those that I've tried have been worse in the areas where I've tried them; it has been more than a year since I tried, so the 'verizon is the best if you don't care about price' statement may be out of date, and of course, different areas have different coverage. YMMV, of course. My main point is just that if you want tethering that is consistently better than free wifi... that's going to cost you an amount of money that might be impractical for most people.)

I mean, sure, you could still just not use data... my computer would be more secure if I left it off. But it would also be a lot less useful.

I ended up writing my own take on bare minimum security practices for less-technical people as a sort of response to the Mozilla article:

https://medium.com/@perplamps/super-basic-security-advice-f9...

If anyone finds any problems or disagrees with any of my suggestions, let me know and I'll update it!

I don't see any problem with the article but almost all the points you raised show there are things hardware vendors, operating system vendors, application developers, and essentially our world should fix on our end and not burden users with it.

For example, some web browsers (Google Chrome and Apple Safari) offer to create randomized passwords.

Revolut allows you to generate "virtual" credit cards which are just disposable credit card numbers linked to your account. You can spun one for every major online service you use (Netflix, Amazon, etc.) in case it gets hacked or for any transaction you're making on a less trusted site.

Mozilla seems to have a habit of occasionally demonstrating really poor judgment in the areas they are supposed to be leaders on, like privacy and user control.

Whenever something is critiqued and/or taken down it makes me feel curious like might be really worth a closer look. Fortunately we have the Internet Wayback Machine: https://web.archive.org/web/20181201131617/https://blog.mozi...

I think it was well intentioned, and given the size of their audience/reach, I hope they revise it and provide a new version with solid advice. I think the general population could really do with more modern understandings of security like using very long passwords, a basic understanding of using 2FA/MFA methods, and obscuring their identity by using temporary/throwaway emails and phone numbers.

Reply on news.ycombinator.com