Hi - want to talk about Security and the Internet
I think the recent hack brought out the need to talk security and your safety on the Internet. This is an extremely broad topic which can get very complicated even for experts.
Caveat: I am a full stack software developer/architect which means I'm a jack of all trades when it comes to anything other than code.
My hopes are that people will share good practices and suggestions they've found.
Ok, that aside, here are a few general best practices which I think helpful. I'm going to keep mine focused on those things an average person can do.
1) Keep your software upgraded - many of the common hacks utilize weaknesses discovered in your software. This includes desktop and mobile software such as your Browsers, MS Office, etc.
2) Assume you've got no privacy. Your browsers, your software, your very internet connection, your phone, your friend's social connections all give you a "fingerprint" which can be traced and more importantly stored in a database to track you. Assume that after the large data leaks with Target, HomeDepot, Yahoo and others (who have not done the ethical thing and reported the leak), your personal information is already out there and ready to be used against you.
3a) Trust nothing. This is easier said than done. Be aware most "hacking" is done thru "social hacks" where hackers try and fool you into thinking you are doing something other than you want. So many psychological and technical tricks. This is made worse where people use the information lost (see item #2 above) When in doubt, do not click the link or make assumptions. Send an email to the person who forwarded something, open the website directly (not the link), etc. Do not download *anything* unless you know *exactly* what you are doing. Channel the ghost of Nancy Reagan - "Just Say No". BTW, the tricks that are used are the same type of indirection used by A-class magicians.
3b) In a related piece, use least trust/privilege. This means only use what you need to get the job done. In Internet terms, this means do not run Flash, Java or any plugin. In some cases, this means turning off of Javascript and using extensions which block ads. Do not run extensions/add-ons/plugins unless you know exactly what they do. For Facebook and other apps, it means not allowing permission. Many of the Facebook and Mobile Phone apps demand far more privilege than they need. For Desktop items such as MS Office, it means not running Macros and VBA code (if you don't know what that is, just say "no"
.
When running Windows, I never use an administrator account for day to day activities. Create and use a regular user for the day to day activities which does not have permissions to install or make major modifications. Use the administrator only for those updates you know you are wanting to do. Macs and Linux have this model already.
4) Don't assume antivirus and malware programs will always help you. They suffer from all of the issues noted above. If you don't keep them current they won't help. If you let the program install because it tricked you - then it will have issues helping you.
5) Never, ever reuse passwords between sites. Use a tool such as LastPass, Keepass/KeepassX, and others to generate and store the password in a safe manner. Reuse allows hackers the opportunity to comprise you on multiple sites. LastPass has had issues, but it's still better than reusing passwords.
Now for specific things - I do run a custom firewall on my Mac (Little Snitch) as it lets me know when I hit a website I was not expecting. I also use PayPal and Amazon to pay for things instead of using a credit card. (Yes, PayPal supported Trump - it's on my things to look at).
And on leaving - this is a major, major topic. No way I can do it justice given the complexities. Hoping other tech-savvy people of DU will chime in with their thoughts and suggestions.
= new reply since forum marked as read
