Security

Security is a broad term covering everything from stopping your mother from finding your porn folder to stopping the NSA from breaking into your nuclear power plant.

In our post Snowden world it's easy to fall into security nihilism (i.e. "'they' know everything so why bother?") or to think you have nothing to hide.

The worst thing you can have is a false sense of security.

This page cannot possibly define every attack and mitigation strategy available. Instead it aims to provide a decent overview of basic security principles and techniques.

Define Your Adversary

Who/What do you want to have security from? Who/What is a threat to you? Who/What do you want to keep things private from?

• You mother?
• Thieves?
• Hackers, Viruses, Malware and Phishing?
• Advertisers/Marketing companies who build profiles on you to sell you garbage?
• Rivals and rival businesses?
• Government policies you don't agree with and wish to legally avoid?
• Foreign government policies you don't agree with?
• Copyright trolls?
• Local Law Enforcement Agencies (LEA)?
• National Law Enforcement Agencies?

or perhaps you wish to:

• Publish anonymously?
• Keep journalistic sources safe?
• Participate in whistleblowing?

or are you under attack from:

• Psycho ex-partners/family members?
• Internet trolls/doxxers?

or maybe you just want to:

• Be as secure as possible as a fun experiment?

Knowing your "enemy" is important. Thinking in terms of NSA technology is depressing, but narrowing your threat down to advertising trackers makes the battle seem much more practical and winnable.

Security Tools and Practices

Against Your Mother

Your mother can:

• Physically access your computer.
• Physically access your computer when you're not there.
• Spy over your shoulder.

These can be serious security implications, however your mother is unlinkely to either:

• Have the technical knowledge to perform an attack.
• Have the motivation to perform an attack.

All your mother is likely to do is walk past when you're masturbating, or perform a Windows Search for her cat photos and accidentally turn up your hentai.

In response, you can:

• Lock the door to your basement.
• Zip/rar/7z your porn with a password.
• Encrypt your home directory.
• Put a password on your bios and deny her booting your computer.

Against Thieves

Thieves can:

• Physically steal your computer and deny you access to your data.
• Remove the storage drive from your computer and recover data.

While common burglars are unlikely to have the technical knowledge to remove your storage devices and run tools against them, they are likely to give your hardware to their "nerd" friend, or ebay/pawn your hardware off. Where it ends up from there is anyone's guess and whatever nudes you've taken will likely end up on a chan.

In reponse you can:

• Encrypt your home directory.
• Use Full Disk Encryption.
• Backup your data and phsyically hide it.

Against Hackers, Viruses, Malware and Phishing

Assuming hackers here are your run of the mill script kiddies and not nation states, hackers can:

• Use Remote Exploits to access your computer (hacking your computer).
• Trick you into running exploits on your computer (viruses, malware).
• Trick you into disclosing the credentials to your computer or web services (phishing).
• Guess the credentials to your computer or web services (cracking).
• Break into web services and determine your credentials (hacking web services).

While hackers will always know about security problems before everyone else, they are less likely to use their brand new exploits against random people. High value targets (whether they be financial (paypal?), political (fbi website?) or lulzy (the fappening)) are much more likely to be their focus.

Day to day attacks will be from relatively unskilled hackers (script kiddies) and deployed against ip address on the internet.

Occasionally a large internet service will lose it's password database to hackers e.g. twitch.tv. Sooner or later one of these headline hacks will affect you.

In response you can:

• Keep your operating system and software up to date to cut down on remote exploits.
• Use anti-virus and anti-malware scanning software.
• Be wary about running unknown software or logging into untrusted sites (common sense 2015).
• Run a restrictive firewall to allow only certain applications access to the network.
• Use a password manager to generate random, secure passwords for your local computer accounts and web services.
• Use a password manager to have different passwords on every web service you use.
• Only use trusted web services, and give them as little sensitive data as possible.
• Use Two Factor Authentication (2FA) for higher value web services (banking, email).

Advertisers/Marketing Companies

Advertisers can:

• Collect information when you login to them.
• Track you across different websites you visit without logging into them.
• Track you via GPS on your phone.
• Track you online and offline via WiFi on your phone.
• Track you offline via credit/debit cards.
• Track you offline via reward/membership cards.