Hacker News Reader

Comment by gorgoiler | Hacker News Reader

This doesn’t talk about real world adversaries, only hypothetical countermeasures. It would be more useful to know how I’m likely to be attacked, not how to protect against every threat the author could possibly think of.

For example, I want to know where the villains actually go when they want to dox someone. Then I can dox myself and do something about it. I have no idea where to start and wouldn’t want to pay money to criminals to get it.

View on HN

Assuming you are a US citizen, you likely have no need to worry about FVEY [1] targeting you unless a judge has been convinced you are a very bad person and issues a warrant.

You do have to protect against cyber-criminals and potentially other nation state actors like Russia, China, Iran and North Korea. These groups do not control infrastructure (like FVEY) and have a harder time targeting you. BTW, this is why FVEY are so determined to keep China out of 5G networks (they don't want to share).

To gain access to your things, these attackers typically rely on phishing emails and social engineering attacks. They try to convince your bank or cellular provider, etc. that they are you and then do bad things with, or to, your accounts.

The best protection against this is 2FA (Yubikeys and TOTP) and process isolation. Run a reasonably secure operating system (such as Qubes) to isolate your digital life. Be sure to do your online banking in a qube of its own separate from your email qube and your random web browsing qube. And avoid phone or email based 2FA when you can.

That's about it. If you do that, you'll probably be fine.

[1] - https://en.wikipedia.org/wiki/Five_Eyes

> Assuming you are a US citizen, you likely have no need to worry about FVEY [1] targeting you unless a judge has been convinced you are a very bad person and issues a warrant.

IIRC part of the snowden leaks was that US intelligence agencies used data gathered about US citizens by GCHQ (and the other five eyes members) and occasionally asked for more targeted gathering. I don't think it's as easy or straightforward as you make it out to be.

This. Browser based password saving is only a threat of device theft is a concern. The GitHub repo clearly doesn’t understand threat models or convencience-to-risk ratios.

This is a great instinct and I recommend everyone do this.

There’s a ton of resources on this, unfortunately subject to this predictable effect where spam proliferation easily overwhelms your ability to discover useful resources in reasonable time period.

Michael Bazzell has a book on OSINT (and a blog/podcast) which I can recommend for an initial dive. Good starting point for action would be his data broker checklist.

The real villains will have access via gov agencies to make emergency data requests to tech companies.

Maltego can also be used to pivot on any info you already have to collect more. I'd say the best you can reasonably do is to use this to find your trails and remove them or worst case obfuscate it with noise.

> The real villains will have access via gov agencies to make emergency data requests to tech companies.

The real villains are those entities which are not you. Survival of the fittest.

Reply on news.ycombinator.com