TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: Online Security Tips for Newbie Freedom Activists?

197 点作者 tokenadult超过 8 年前
I&#x27;m becoming active in a local group of citizens (constituents of one electoral district here in the United States) who are trying to promote protection of civil liberties. Many are quite new to any kind of political activism and quite a few are very new to participation in online networks. What are your recommendations for sources of advice on best online security practices, easy for beginners to understand? The local group includes some technology professionals familiar with online security and administration of websites and mailing lists. The group plans to build a public-facing website, an internal use website, a mailing list for group participants, and other online channels of communication. It already operates a Twitter account and Facebook group (which is becoming quite active) and hosts in-person meetings. I would appreciate tips to pass on to new members about personal Internet security best practices and resources for nonprofit organizations or political action organizations to maintain secure communications in a possibly hostile environment.<p>Thanks for any suggestions you have.

22 条评论

tptacek超过 8 年前
These answers are unlikely to make much of HN happy, but they are the correct answers.<p>1. Get an iPhone and use it in preference to your computer.<p>2. Enable &quot;code-generating&quot; or &quot;authenticator app&quot; 2FA on all your accounts, particularly email (this is called &quot;TOTP&quot;).<p>3. Disable SMS 2FA on any account wherever you&#x27;re using real 2FA.<p>4. Switch to Google Chrome, which is significantly more resilient against vulnerabilities than either Safari, Firefox, or IE.<p>5. Don&#x27;t use Dropbox.<p>6. Enable your OS&#x27;s built-in full-disk encryption (this is FileVault on a Mac, BitLocker on Windows).<p>7. Disable cloud-based keychain backups (OS X will ask you to opt-in when you configure your phone or laptop the first time; Windows will make you go out of your way to do it).<p>8. Install Signal and either WhatsApp or Wire on your iPhone. Use Signal when you can, and fall back to the less strict alternative app when you can&#x27;t.<p>9. Don&#x27;t use email to send sensitive information, full stop.<p>10. Install a password management application that doesn&#x27;t store your secrets in the cloud. I recommend 1Password. Better though to rely on 2FA than on a password manager.<p>11. Do not use antivirus software, other than Microsoft&#x27;s own antivirus software on Windows.<p>12. Turn off cloud photo backups and location sharing for your camera.<p>13. Don&#x27;t accept or click on email attachments, or allow your peers to send email attachments.
评论 #13517642 未加载
评论 #13517137 未加载
评论 #13517314 未加载
评论 #13517044 未加载
评论 #13517079 未加载
评论 #13518357 未加载
评论 #13518224 未加载
评论 #13518013 未加载
评论 #13517942 未加载
评论 #13517290 未加载
评论 #13517902 未加载
评论 #13520124 未加载
评论 #13518838 未加载
评论 #13517217 未加载
评论 #13518417 未加载
评论 #13517482 未加载
评论 #13517744 未加载
评论 #13517230 未加载
评论 #13518404 未加载
gus_massa超过 8 年前
Beware of the guy that has too much free time, too many contacts and want to scale up the protest to more violent methods. He is probably an FBI informant. It was common during the previous administration, I don&#x27;t expect it to have finished.<p>I&#x27;m too pessimistic about the security situation since a long time ago. Just email your Gmail&#x2F;Hotmail&#x2F;Facebook&#x2F;Tweeter password to the NSA&#x2F;CIA&#x2F;FBI chief, so you don&#x27;t get a false sensation of privacy.<p>Perhaps someone can try to keep some conversation private, like a journalist-whistleblower conversation, but it&#x27;s too difficult to scale it up to bigger groups.
评论 #13516975 未加载
danso超过 8 年前
I like these guides by AP journalist Jonathan Stray:<p><a href="https:&#x2F;&#x2F;source.opennews.org&#x2F;en-US&#x2F;learning&#x2F;security-journalists-part-one-basics&#x2F;" rel="nofollow">https:&#x2F;&#x2F;source.opennews.org&#x2F;en-US&#x2F;learning&#x2F;security-journali...</a><p><a href="https:&#x2F;&#x2F;source.opennews.org&#x2F;en-US&#x2F;learning&#x2F;security-journalists-part-two-threat-modeling&#x2F;" rel="nofollow">https:&#x2F;&#x2F;source.opennews.org&#x2F;en-US&#x2F;learning&#x2F;security-journali...</a><p>In general, I think the two things that activists and journalists need to do that they often don&#x27;t do, yet is a very common attack vector:<p>1. Enable two-factor auth on all accounts, especially their email.<p>2. Care about proper access control.<p>#2 is something I see violated quite frequently by tech novices, as it is a fairly mundane detail. Such as giving everyone admin level access to the org&#x27;s Wordpress installation, and someone inevitably gets phished. And then there&#x27;s the even more common problem of not revoking access when a member leaves.<p>And of course, phishing seems by far the most common way that groups get hacked. The recent U.S. election is the new canonical example, but I believe it&#x27;s been the downfall of many other high profile orgs, such as the Associated Press and HBGary.
评论 #13516830 未加载
评论 #13517925 未加载
wheelerwj超过 8 年前
the eff guide is really solid for most people [0] but i think its a little laymen for most people. Especially when you get into the activism side of things. Here are the rules i follow.<p>Rule #1. No phones. If this can&#x27;t be avoided. burner phones without linked accounts. they cost $30-50, plus some for minutes&#x2F;sms&#x2F;basic data. This is good for using maps and visiting forums etc. Burner phones should be able to remove batteries. keep them fully powered down anytime you are near home or in your neighborhood. Major companies and governments are incredibly good at connecting profiles based on ancillary meta-data that you don&#x27;t even think about.<p>Rule #2. see rule #1. Your phone isn&#x27;t secure, get used to it.<p>rule #3. encrypt everything, use tails and TOR.<p>[0] <a href="https:&#x2F;&#x2F;ssd.eff.org&#x2F;en" rel="nofollow">https:&#x2F;&#x2F;ssd.eff.org&#x2F;en</a>
评论 #13517443 未加载
评论 #13516709 未加载
tokenadult超过 8 年前
Thank you very much to all for the detailed comments. I appreciate you keeping advice simple enough for someone like me, who decades ago counted as a &quot;power user&quot; of PCs, but who has no particular technical training or computer-related work experience. I will have to digest some of this advice for women (they are mostly women in the local group) who are barely comfortable using Facebook. And I&#x27;ll pass on other tips to the women and men who have actual technical backgrounds and will be implementing the different online projects of the local group.<p>Advice that especially fits our situation is having an appropriate level of security for an intentionally PUBLIC organization whose members will be identifiable by multiple in-person activities in public places over the next few years. We are not afraid to be known as people who support the cause that we support. We are resolutely sticking to peaceful, legal means to reach our goals. Many group members are VERY wary of new group members--plenty of them are wary of me--so we will have to build mutual trust as we build mutual communication and public-facing communication. I like mz&#x27;s advice to remind members that anything they say in an online group--even in our internal online groups for members only--might show up in mass media or in propaganda spread by opponents, so I try to model careful speaking and writing.<p>I&#x27;ll link here to a document about the bad-case scenario of living under an actual dictatorship with a secret police force that kills political opponents. That&#x27;s something I&#x27;ve actually done (in Taiwan, in the 1980s). The good news is that nonviolent popular movements can even overthrow dictators and establish democratic republics with full protection of civil liberties. That takes mental toughness, but it can be done. I&#x27;ve seen it done. You may be inspired by the document linked here and the other documents (in numerous languages) posted at the same website.<p><a href="http:&#x2F;&#x2F;www.aeinstein.org&#x2F;wp-content&#x2F;uploads&#x2F;2013&#x2F;09&#x2F;FDTD.pdf" rel="nofollow">http:&#x2F;&#x2F;www.aeinstein.org&#x2F;wp-content&#x2F;uploads&#x2F;2013&#x2F;09&#x2F;FDTD.pdf</a>
评论 #13517608 未加载
评论 #13518739 未加载
hackuser超过 8 年前
The new social activists are shockingly ignorant of security. Most that I know of are organizing over Facebook. When someone mentions security to them, the activists say that there is no risk to them.<p>Education is even more urgently needed than tools.
gsch超过 8 年前
I would absolutely start by running a threat modeling exercise, as that will help you focus on the important things and tune out unnecessary FUD (e.g. do you really need to PGP-encrypt everything and run TAILS if you&#x27;re not being targeted by the NSA?).<p>Once you have an understanding of what you need to protect and who your main adversaries are, choosing the right tools should become more straightforward.<p>My favorite guide to threat modeling for activists comes from WITNESS: <a href="https:&#x2F;&#x2F;blog.witness.org&#x2F;2016&#x2F;11&#x2F;getting-started-digital-security&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.witness.org&#x2F;2016&#x2F;11&#x2F;getting-started-digital-sec...</a><p>EFF Surveillance Self-Defense (mentioned elsewhere in this thread) also has a guide to threat modeling, as well as a lot of good resources around how to use various tools.<p>But my advice: don&#x27;t choose the tools first, or the non-techies won&#x27;t understand why they have to use them and may become discouraged by the friction and poor usability they encounter.
评论 #13516870 未加载
Mz超过 8 年前
Years ago on an email list, we were advised to not say anything on list that we wouldn&#x27;t want posted to the front page of the local newspaper. I still find this to be a good rule of thumb.<p>Humans are incredibly, horribly bad about writing stuff online like it is confidential, just between you and me -- even when it is a public forum that anyone can read, like Hacker News. Thinking of it in terms of published to the front page of the local paper can help people keep some of their worst, stupidest impulses down to a dull roar.
评论 #13516940 未加载
pmoriarty超过 8 年前
If you are seriously concerned about your security and safety, I would avoid electronic communication completely.
评论 #13516992 未加载
helpfulanon超过 8 年前
In addition to the EFF Security Self Defense (<a href="https:&#x2F;&#x2F;ssd.eff.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ssd.eff.org&#x2F;</a> ) I&#x27;ve also seen this circulated: <a href="https:&#x2F;&#x2F;securityinabox.org&#x2F;en&#x2F;" rel="nofollow">https:&#x2F;&#x2F;securityinabox.org&#x2F;en&#x2F;</a><p>Personally I don&#x27;t think these resources go far enough, and some of the methods recommended have obvious exploits, or are too complicated for the less tech literate. Lot&#x27;s of work to be done in this area for sure
joeclark77超过 8 年前
My one tip is this: get to know each other in real life, and make sure you know how to find and contact each other if Facebook, Twitter, Google or whatever big left-wing internet service decides to silence, shadow-ban, or delete your account.
maxerickson超过 8 年前
They should think long and hard about the downsides to each presence that they establish and not establish anything until they think they have a really good understanding of those downsides.<p>This may involve drastic steps like not using email.
x0rz超过 8 年前
<a href="https:&#x2F;&#x2F;ssd.eff.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ssd.eff.org&#x2F;</a>
greenwalls超过 8 年前
Twitter Personality @SwiftOnSecurity has a guide <a href="https:&#x2F;&#x2F;decentsecurity.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;decentsecurity.com&#x2F;</a> that is reasonable for non-techies to understand and follow.
评论 #13517130 未加载
mschuster91超过 8 年前
I&#x27;m an active German antifascist. Here&#x27;s something I do:<p>0) Get a lawyer. If you&#x27;re arrested and you don&#x27;t know a lawyer, you&#x27;re screwed. And learn your rights: what do you have to tell the cops, and what you can refuse to tell them. Always carry a valid ID card with you.<p>1) When publishing pictures, especially on Twitter: place stickers over people&#x27;s faces, or better: pixelate using ObscuraCam. The best thing is of course to not take pictures or video at all.<p>2) Get a &quot;burner dumbphone&quot;, best are used, old Nokias and a burner sim-card when going to demonstrations. Do not activate or use the phone at your home or at meeting points.<p>3) If you insist on carrying a smartphone, get a recent Android phone with support for FDE and an exchangeable battery. Enable FDE, also on your SD card, and in case you&#x27;re about to get arrested, take out the battery or drop the phone to the ground so that the battery falls out and the cops cannot use imaging devices. Use a strong passphrase. iOS devices may be secure, too, but they have the disadvantage that you can&#x27;t pull out their battery or switch them off in a hurry. If you care about your device, get an IP68-proof&#x2F;rugged device - cops don&#x27;t care if they damage your property when pushing you around, and it&#x27;s easy to e.g. fall on your phone when you&#x27;re pushed to the ground. Android: disable USB debugging, or if possible with your model, the entire USB stack. On a rooted Android phone, you can do so via an adb shell command.<p>4) When browsing around the web researching political stuff, use TOR. Do not download unneccessary stuff onto your computer.<p>5) Securely encrypt your computers and all external media devices (USB sticks). OS X can use Filevault, Windows can use Bitlocker. USB sticks are best protected by VeraCrypt (as it is a cross-platform solution). If you have a NAS that doesn&#x27;t support encryption, ditch it and buy one that does.<p>5) If you receive sensitive information, delete it as soon as in any way possible. Insist on communicating via GPG-secured emails, and password-protect your key. Written information should be shredded to as tiny pieces as possible - don&#x27;t burn the paper, ash flakes or incompletely burned paper can be restored (as evidenced after 9&#x2F;11).<p>6) Enable 2FA, preferrably via a token generator app on your phone, on any service that supports it. Store the backup keys (you will need them e.g. if your phone gets damaged!) somewhere safe that is NOT your home (e.g. at your parents&#x27; house). Do not label the sheets with a cleartext name of the service&#x2F;account associated with them. SMS 2FA is the &quot;last measure&quot; as you&#x27;ll be vulnerable to government attacks, but better SMS 2FA than simple password protection.<p>7) Handle sensitive information on a strict need-to-know basis. And for heaven&#x27;s sake, don&#x27;t talk about planned actions in public. Or brag about things you&#x2F;your friends did or plan to do - while bars etc. usually aren&#x27;t crowded with agents, someone may decide to rat you out to the cops.<p>8) Before going to any demonstration, write down the name and phone number of your attorney with waterproof ink on your arm. That way you don&#x27;t have to rely on the cops finding your attorney or delaying calling him by taking their sweet time to do the search.<p>9) Inform close relatives&#x2F;roommates that you&#x27;re away, especially if you have pets, children etc. that need to be taken care of. Have enough cash on your bank account (or have a relative) to pay rent if you end up arrested.<p>10) don&#x27;t ditch fares, or if you have a car, always take care that it&#x27;s up to code, legally registered, and taxes&#x2F;insurance are paid. Nothing sucks more than getting arrested for petty stuff, and pulling people over for broken lights is a common excuse of cops to search the vehicle. Do not carry huge amounts of cash in your vehicle (google for &quot;asset forfeiture&quot;, it&#x27;s really gross what cops can legally do).<p>11) don&#x27;t ever go drunk, intoxicated or not well-rested to any political event. Do not take drugs of any kind with you, except medicine that you need (and for these, best take the original prescription or a copy with you, so the cops can&#x27;t bother you with drug charges). Preferrably use plastic glasses (glass lenses can cause grave eye injury when damaged), contact lenses and cosmetics of any kind tend to aggregate nasty stuff like pepper spray.<p>12) Always take sufficient supplies of water, food and a small pack of glucose tablets (in Germany, we know them as Dextro Energy) with you. If you can, take a couple small adhesive bandages with you, and go to a First Responder education (this is useful anyway, even if you&#x27;re not &quot;actionist&quot; - you can save lives!)<p>13) Connect with other political groups both in your area and state&#x2F;nationwide: ACLU, antifa groups, civil rights movements. Political parties (liberals, greens) may also be of interest to you, depending on your focus.<p>14) Beware of snitches or agents provocateurs that try to incite you to violence. When you want to go the &quot;actionist&quot; route, be aware of the potential consequences if you get caught and don&#x27;t do anything you&#x27;re not comfortable with.<p>15) Do NOT go on political demonstrations with firearms, knives or other weaponry. In most jurisdictions it&#x27;s illegal, and even if it&#x27;s legal to assemble with arms, it&#x27;s not sane to do so. When you see armed protestors, or a demonstration turns violent, GTFO as fast as you can.
评论 #13517573 未加载
Jaepa超过 8 年前
I&#x27;d like to suggest taking some time to read through some off the EFF&#x27;s collection on this.<p><a href="https:&#x2F;&#x2F;ssd.eff.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ssd.eff.org&#x2F;</a><p>If you are worried about more national level threats<p>While it is more dense PrivacyTools.io has pretty good material.<p><a href="https:&#x2F;&#x2F;www.privacytools.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.privacytools.io&#x2F;</a>
figureoutwho超过 8 年前
This is the EFF&#x27;s turf.<p><a href="https:&#x2F;&#x2F;www.eff.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;</a>
joatmon-snoo超过 8 年前
Since this is coming up: I&#x27;ve seen recommendations for encrypted file drops when similar topics have come up before, but for some reason I can&#x27;t find any of the mentions that I&#x27;ve seen on HN before. Anyone have services they plug?
figureoutwho超过 8 年前
The &quot;get an iPhone&quot; comments remind me of Steve Martin&#x27;s advice on how get rich... &quot;First... Get a million dollars&quot; Unless, theoretical bs.
b01t超过 8 年前
privacytools.io - plain and simple
Cozumel超过 8 年前
It&#x27;s already too late, if you have an active Facebook group where you&#x27;re discussing this stuff then you&#x27;re already all tagged and profiled.
评论 #13516663 未加载
评论 #13516674 未加载
fleitz超过 8 年前
Exactly what prevents the hostile actors you are ostensibly protecting against from joining your group?<p>Privacy is the antithesis of public advocacy.