The Personal Security Checklist
security-list.js.org
security-list.js.org
I'm sure this list has some valuable tips but it just jumps into a bunch of "do this, don't do that" action items without contextualizing recommendations for what an individual is trying to protect themselves against, or what they don't care about.
For example, it's unlikely a lay person would even know that they should be checking that they're looking at https versions of sites and they probably shouldn't have to know that. We as the tech community could easily just recommend them the HTTPS everywhere extension and call it a day.
So just tell them "here, do backups THIS way, use THIS password manager, I've installed an ad/script-blocker in your browser, now you're in better shape".
> there are numerous ways to fool it and gain access to the device, through digital photos and reconstructions from CCTV footage.
The words "fool it" link to a four year old Forbes article that doesn't actually describe any successful attacks in detail. I'm not saying that there aren't successful attacks (there are, particularly for devices that rely entirely on a front-facing camera), but I find the lack of nuance here to be unhelpful.
A cheap smartphone that just uses its front-facing camera for facial recognition is not the same thing as a high-end smartphone that incorporates a depth sensor, and this list should communicate that clearly and link to more relevant information. (Like actual, successful attacks on facial recognition systems.)
If they're standing directly over your shoulder sure, but you show your face to far more people. You may also be able to have your phone scramble the order of the numbers to make it harder for people to know your pin, or use gestures to unlock your device. You can also reset you pin far easier than you can reset your face.
face recognition can work even if you're asleep, unconscious, or dead too, but nobody can ask you for a pin in that situation.
Great point, but where could one/should one start trying to work out the answer to that question, both at a personal level and in a business setting?
1) How rich are you
2) Which governments want to lock you up for your beliefs/endeavors?
I’m wondering if there are other big topics or any interesting nuance
My elderly mother is likely to be attacked but those attackers are unskilled low rent scammers and chase lots of leads.
A well known author is likely to be attacked by singular focused attackers who will do research and stalk their victims.
An activist is more likely to face Government level attackers than my elderly mother.
By reading with understanding - threat model for this list is average Joe that is using internet on daily basis, but is not too technical maybe decent at using computers, so recommended for me seems like good baseline for everyone.
Optional is for showing what are other options that someone might try out, but mostly are not that important.
Advanced is for showing off that author knows more than basics, hence implementing any of it would be security larping most of the time.
Well maybe author should add more context but from what I see, someone can still infer context of recommendations, without stating it explicitly.
So, instead of trying to come up with a threat model, just use best practices. Backups, password manager, blockers in browser, software updating, firewalls, etc.
Now, if you're the 1 person in 100 or 1000 who has a stalker or who is ordering drugs over the internet, trying to create a specific threat model is appropriate.
https://ssd.eff.org - the Electronic Frontier Foundation's "Surveillance Self Defense"
The fallback to “Loading…” is worse than merely missing content as it’s actively misleading.
My problem with KeePassXC is that it won't work on Android. It looks like BitWarden will work.
Currently I use LastPass, but now it you must pay to use it in Desktop and mobile.
is BitWarden a better alternative?
If I had to pick between LastPass and BitWarden, I would go with Bitwarden.
I personally use KeePassXC and Keepass2Android with the pw files synced across 3 phones and 3 laptop/desktops using syncthings and have had no problems.
Also depressing how this is so far beyond what the majority of people are aware of / are willing to do. I worry what this means for Cybersecurity in general.
For example, operating systems should be aware of and support third-party encryption such as VeraCrypt. Today, a VC volume may be reported as "unformatted" by the OS. Opportunity to enable VC encryption on system disk should be right in the Windows Home installer.
Browsers should default to having ad/tracker-blockers either built-in, or an extension such as uBlock Origin installed by default. Default to having location services disabled, or extension such as Location Guard installed.
When you install an OS, the installer should ask "okay, what password manager do you want to use ?". It's okay for the user to say "none", but there should be subtle pressure. Same with VPN, same with firewall, same with backup software. OS should have built-in anti-virus (as Windows does), but also prompt up front for which anti-virus user wants ("none" is a choice).
Browsers need to push back somehow against web sites that want to know all the details of a device. Maybe default to display size and OS type and other details not revealed to JS.
Software updating should default to "automatic" (user can change it), and include all apps (including third-party apps) as well as OS.
Lastpass is tied to a third party service too, which seems like an odd compromise for the security of secrets. It also bundles a lot of trackers. I'd suggest people move away from a proprietary security tool that bundles spyware.
What's special about Google Auth? Why would you ever recommend that over any other alternative?