free security advice.md

Simple Security Guidelines

Using an iDevice? (Best option)

• Use an iPod or an iPad without a SIM card
• Use an iPhone
• Do not jailbreak
• Always upgrade to new iOS versions
• Use Brave browser

Need Secure chat?

• Use Signal (iOS + Android)
• Use Wire (iOS + Android)
• Avoid desktop versions
  • Optional: use an iPad [Pro] with a smart keyboard
    • register Signal w/ a phone (burner, anonymous SIM, etc)
    • register Wire w/ an email address (ProtonMail is free)
• Use Conversations w/ OMEMO (Android, unfortunately the only implementation of OMEMO for general use right now)
• Use Coy.im on desktops
• Do not use: Telegram, LINE, Kaokao, WeChat, Viber, Hangouts, etc.
• WhatsApp, Facebook Messenger (Private chat), are acceptible (high security, high surveillance)

Using Android?

• Do not root your device
• Do not enable Developer Mode
• Use a Nexus or Pixel (gets latest patches w/o carrier/vendor barrier)
  • Run the latest version, always
  • Optional: run CopperheadOS
• Optional: use a flagship Samsung (or Nokia) purchased direct, not through a telco
  • These devices tend to get timely security updates
• Don't have a Nexus or Pixel? Install LineageOS (official builds only)
  • Run the latest version, always
• Use Brave browser

Using a ChromeBook?

• Do not enable developer mode
• Use Termux for a console environment

Using Windows?

• Use 10 or 8.1, nothing earlier.
• Use EMET

Using Office?

• Do not enable macros. Ever.
• Find and disable Flash

Using macOS?

• Install patches and updates immediately
• Enable the firewall
  • Disable "signed apps"
  • Enable "block inbound"
  • Optional: enable "stealth"
• Install Objective-see tools
  • Do Not Disturb
  • BlockBlock
  • KnockKnock
  • RandsomWhere
  • Oversight

All:

• Enable full disk encryption (FDE)
  • Use a special encrypted vault for sensitive files
    • VeraCrypt cross platform
    • CryFS (Linux, sorta macOS)
    • Encrypted disk image (macOS)
• Require a password to unlock
• Apply patches
• Use backups. Secure your backups, they contain your secrets.

Use a password manager!

• Use KeePass, free, cross platform, but clunky UI/UX
• Use 1Password, not free, iOS/macOS, good UI/UX
• Never use a cloud based password manager
• Never enable integration between your browser and password manager

2FA

• Enable two factor authentication whenever possible
  • OTPauth iOS/macOS only
  • Authy
  • FIDO (YubiKeys)
  • Duo
  • SMS (last resort, but better than nothing)

Web Browser

• Use Chrome
• Use Edge
• Do not use Safari
• Do not use IE
• Do not use Firefox, yet (until they enable sandbox by default)

Use an ad blocker

• Install uBlock Origin

• Install HTTPS Everywhere

• Install uBlock Origin Extra

• Optional: Install Privacy Badger

• Disable Flash (on Chrome you can still right click to play)

Use a VPN

• (Self hosted option: algo) - Best
• ProtonVPN offers free VPN service - Ok
• CryptoStorm has a privacy preserving business model - OK
• Use WireGuard, self hosted, still new but very promising - Good
• Use Freedome (iOS, Android, macOS), not free, trivial to use - OK

This:
https://techsolidarity.org/resources/basic_security.htm
Basically there is no need to add anything.

I use bitwarden as my password manager, and it's quite good and secure.

Don't root but install a custom ROM. How? You need to do the first to do the second.
Also Samsung custom ROMs do not allow FDE.
Recommending chrome over Firefox....

Install the custom ROM and don’t root it. Samsung supports FDE. It is a requirement for KNOX.

…

On Fri, 30 Aug 2019 at 12:21, Sandro ***@***.***> wrote: Don't root but install a custom ROM. How? You need to do the first to do the second. Also Samsung custom ROMs do not allow FDE. Recommending chrome over Firefox.... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://gist.github.com/353b6fc9b094d5700c70?email_source=notifications&email_token=AAAQMVPBLBTVH4JTXBVRIRTQHCU65A5CNFSM4IR6B6I2YY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAFX3VC#gistcomment-3012433>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAQMVKJC5PUHJ6QEFX3Y5DQHCU65ANCNFSM4IR6B6IQ> .

Then you have TWRP anyway and you are vurnabile then.
Samsung supports FDE only on official stock firmware. Knox gets completely disabled when you root or flash custom firmware.

You don’t need twrp.

…

On Fri, 30 Aug 2019 at 13:22, Sandro ***@***.***> wrote: Then you have TWRP anyway and you are vurnabile then. Samsung supports FDE only on official stock firmware. Knox gets completely disabled when you root or flash custom firmware. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://gist.github.com/353b6fc9b094d5700c70?email_source=notifications&email_token=AAAQMVK7CKGQVA4ANDPFHWLQHC4DVA5CNFSM4IR6B6I2YY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAFX3YM#gistcomment-3012486>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAQMVNLDSH4OZ7HHY3FXMDQHC4DVANCNFSM4IR6B6IQ> .

It is free security advice on the internet. It is worth what you paid for it. ¯\_(ツ)_/¯

…

On Fri, 30 Aug 2019 at 18:25, the grugq ***@***.***> wrote: You don’t need twrp. On Fri, 30 Aug 2019 at 13:22, Sandro ***@***.***> wrote: > Then you have TWRP anyway and you are vurnabile then. > Samsung supports FDE only on official stock firmware. Knox gets > completely disabled when you root or flash custom firmware. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <https://gist.github.com/353b6fc9b094d5700c70?email_source=notifications&email_token=AAAQMVK7CKGQVA4ANDPFHWLQHC4DVA5CNFSM4IR6B6I2YY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAFX3YM#gistcomment-3012486>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAAQMVNLDSH4OZ7HHY3FXMDQHC4DVANCNFSM4IR6B6IQ> > . >

On Samsung you do.

Again. Free security advice on the internet. You want something more tailored, you probably don’t want to read free security advice off the internet. It is what it is. A document that was written years ago, moderately updated over the years, and hasn’t been modified in over a year. If you have a threat model that it doesn’t address then you already know more than this guide was ever intended to cover.

…

On Fri, 30 Aug 2019 at 18:27, Sandro ***@***.***> wrote: On Samsung you do. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://gist.github.com/353b6fc9b094d5700c70?email_source=notifications&email_token=AAAQMVOXTLWKLD4MVAQQX3LQHD727A5CNFSM4IR6B6I2YY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAFX4GM#gistcomment-3012710>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAQMVNLHVAZI6ENI63XZALQHD727ANCNFSM4IR6B6IQ> .

I'm 100% sure that Signal is not about privacy. It's the same as Telegram/Viber. Also guys, never use Brave. It's advertised everywhere only because of money and there affiliate program. My own fresh list of privacy tools available at https://privacytoolslist.com (only free tools, open source, and I try to give the choice of what tool to use. By this way not everyone will be affected if some tool will be compromised.

CopperheadOS developer has left that company and the most secure android ROM now is GrapheneOS by same developer. Seems to mainly support Google Pixels but massive security improvements.