💾 Archived View for zaibatsu.circumlunar.space › ~solderpunk › phlog › data-security-ratings.txt captured on 2020-09-24 at 02:01:25.
-=-=-=-=-=-=-
Data security ratings --------------------- I had an interesting conversation on Mastodon last night with my fellow sundog Christina, who opened with: "#infosec and #privacy enthusiasts of all levels of knowledge and ability, three questions for you! 1. On a scale of 1 to 10, where do you rate your personal infosec practices? Name three practices you do to define that level. 2. If you rated yourself above 6, name two practices someone at levels 2 through 5 could do to raise her level. 3. If you rated yourself below 6, name two practices of yours that most people should do but don't. What would you like to learn." Some good conversation followed from this, which she has summarised at her phlog[1]. I liked these questions, but what I liked even more was exploring this notion of ratings. Christina said "I wish I had enough knowledge and textbox space to personally define the levels 1 to 10, the rebuttals & corrections would be illuminating", and I quite agree! I actually don't think this is a super productive way to think about security (more on that in a later post, I promise, but basically a ranking scale like this is no substitute for the concept of threat models), but I will readily admit that it's a heck of a lot of fun. I reluctantly rated myself a 7, but based on some of my practices, zelbrium was astonished I ranked myself so low and wondered what it would take to hit a 10. So, just for fun, here are my ideas on what the endpoints of this scale look like. A "0" user is never out of reach of their smartphone, which runs stock software with all features enabled and has an unlimited data plan which is always on. They use a Windows PC without any antivirus software, and browse the web using a stock browser. They are daily, enthusiastic users of Facebook, Twitter and Google, never log out of them, and all of their account names are first_m_last. A "10" user does not own a cellphone and has no home internet connection. If they use more than one computer at home, they are either not networked or are networked only via ethernet. This person accesses the internet via their dedicated internet computer, which is a laptop they purchased second hand, with cash. The laptop is either old enough that it never had a built in camera or microphone, or if it had them they have been permanently destroyed, e.g. cables cut, chips desoldered, whatever. The laptop has a wireless device but no hard drive. It boots an OS from a USB stick or, better yet, a non-rewritable CD. To get online, a "10" user takes this machine to a local library, cafe, or somewhere else with free wifi. They connect to that free wifi, and then route everything through Tor, or perhaps a VPN account paid for with carefully obtained bitcoins. Their browser is fully pimped out with all the requisite privacy enhancing plugins. Once on the internet in this manner, they never, ever do anything involving their real name, real address or real date of birth. No internet banking, no online paying of bills, no shopping at Amazon or eBay. Strictly passive content consumption, or posting under a pseudonym on some services *not* run by surveillance countries. This might sound super extreme, but in this way you could easily follow world news, educate yourself with Wikipedia, operate an SDF account (pay for all membership tiers in mailed cash!) or a Mastodon account, send encrypted emails to penpals, etc. An online life lived this way would be extremely difficult to tie to your real world identity. Surely not impossible, but the time, energy and money involved in doing so means nobody is going to bother just for the sake of advertising. Unless you manage to piss off a nation state, you're probably pretty safe. [1] gopher://circumlunar.space:70/0/~christina/InfosecAndDataPrivacy.txt