1 21d-PracticalPersonal

Previous: 21c-AppArmorSELinux.html

This is a common pattern:
https://www.reddit.com/r/ProgrammerHumor/comments/aloi5v/programmers_know_the_risks_involved/

1.1 Screencasts

Password for the Vimeo videos is in Zulip chat.
SP21: https://vimeo.com/545190785
FS20: https://vimeo.com/416093158
Tip: If anyone wants to speed up the lecture videos a little, inspect the page, go to the browser console, and paste this in: document.querySelector('video').playbackRate = 1.2

1.2 How to set up a small business or personal computer securely

Review the semester, current assignment
Not an academic lecture today!
A sample practical activity in setting up a personal computing environment for Confidentiality, Integrity, and Availability (the basic CIA of textbook security), for common tasks.

From the bottom up, hardware to high level:

1.3 Computer hardware, firmware, crypto-keys

Hardware in security arms race?
Hardware and higher level compromise?

Computer hardware (open, secure)
- Lists of open, and thus at least verifiable, if not trustworthy, hardware:
  - https://www.gnu.org/philosophy/free-hardware-designs.en.html
  - https://www.fsf.org/resources/hw
- Actually open:
  - https://en.wikipedia.org/wiki/OpenPOWER_Foundation
  - https://www.raptorcs.com/TALOSII/
- Partially:
  - https://puri.sm/
- A newcomer in 2019, not mature yet
  - https://en.wikipedia.org/wiki/OpenRISC
Hardware key tokens: manage passwords, 2-factor, etc.

1.4 BIOS, firmware-level

BIOS firmware
- https://en.wikipedia.org/wiki/Libreboot
Set up a BIOS password
Disable booting from USB sticks (other than at your first install)
Secure boot enabled (perhaps…): https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_boot
https://www.qubes-os.org/doc/anti-evil-maid/

1.5 Choose your computer operating system

https://en.wikipedia.org/wiki/List_of_Linux_distributions
- General purpose, with decent security emphasis
- https://en.wikipedia.org/wiki/Security-focused_operating_system
  - Offensive
  - Defensive
    - Server-focus and special purpose (e.g., banking, email server)
      - https://www.openbsd.org/
        
        https://en.wikipedia.org/wiki/OpenBSD
      - https://www.centos.org/ (changing focus now)
        
        https://en.wikipedia.org/wiki/CentOS
    - Broad or personal computing, anonymity
      - Persistent
        
        https://www.whonix.org/
        
        https://en.wikipedia.org/wiki/Whonix
        
        https://www.whonix.org/wiki/Computer_Security_Education
        
        https://www.qubes-os.org/
        
        https://en.wikipedia.org/wiki/Qubes_OS
        
        https://subgraph.com/ (dead, insecure)
        
        https://en.wikipedia.org/wiki/Subgraph_(operating_system)
      - Not persistent (live)
        
        https://tails.boum.org/
        
        https://en.wikipedia.org/wiki/Tails_(operating_system)

1.6 Securely obtain the image file for your distribution

Verify the signature
- https://help.ubuntu.com/community/HowToSHA256SUM
- https://en.opensuse.org/<SDB:Download_help#Checksums>
  - https://en.opensuse.org/<SDB:Live_USB_stick#Using_commandline_tools>
- https://www.whonix.org/wiki/VirtualBox/Verify_the_virtual_machine_images_using_the_command_line
- https://tails.boum.org/install/download/openpgp/index.en.html#command-line
- https://www.kali.org/downloads/
If you are installing on your hard drive, make sure you have a clean USB stick

1.7 Install

Encrypt the whole disk
- Choose a very long good password
Encrypt your user directory
- Choose a very long good password
Create a user account with sudo access, so you don’t need to use the root account much if at all
Configure firewall settings (if not connected to a safe network, before updates)
- Either use an easy GUI (gufw, fedora firewall, etc) or iptables

1.8 Update all software (if not already done)

1.9 Post-install system OS hardening and configuration

Set up screen lock!
Elements / basics
Whole-system / detailed:
Networking (more to come later!)
- How to set up secure remote access to your computer
  - https://wiki.centos.org/HowTos/Network/SecuringSSH
- https://wiki.centos.org/HowTos/Network/IPTables
Enable advanced sandboxing and access controls via 21c-AppArmorSELinux.html

1.10 Software

General survey of secure and/or privacy-friendly applications for personal use:
VirtualBox, KVM, virtual machines
- Use snapshots to keep the updated state clean!
Web browsing
- Browser choice
- JavaScript: https://noscript.net/
- Fingerprinting:
- HTTPS
- Browse in a virtual machine, and refresh snapshots!
Communications:
- Text/data
  - Comparison tables
  - Email can be secure?
    - gnupg (good, but not PFS: https://en.wikipedia.org/wiki/Forward_secrecy)
  - Chat-compatible encryption with perfect forward secrecy
  - p2p for A in CIA, (cryptography for the C and I)
    - Bote: https://en.wikipedia.org/wiki/I2P
    - Tox:
      - https://en.wikipedia.org/wiki/Tox_(protocol)
      - https://tox.chat/
- Voice/video: https://en.wikipedia.org/wiki/Comparison_of_VoIP_software#Secure_VoIP_software
  - https://tox.chat/
  - https://en.wikipedia.org/wiki/ZRTP
    - https://linphone.org/
  - https://wire.com/
  - http://retroshare.net/ (and file sharing, email, etc.)
    Password managers: https://en.wikipedia.org/wiki/Comparison_of_password_managers
- (not Linux/Unix exclusive)
- A password manager assists in generating and retrieving complex passwords, potentially storing such passwords in an encrypted database or calculating them on demand. Types of password managers include:
- locally installed software applications
- online services accessed through website portals
- locally accessed hardware devices that serve as keys
- Remote versus Local
  - Remote, for example: https://lastpass.com
  - Local, for example: https://keepassxc.org/
Hosting / server for C, I, and A in CIA triad
- Tor hidden services:
  - Example: https://en.wikipedia.org/wiki/Sci-Hub (scihub22266oqcxt.onion) can only be visited using Tor browser, and can’t easily be located or taken down forcibly (availability)
- Eepsites: https://geti2p.net/en/
  - https://en.wikipedia.org/wiki/I2P
File-sharing/transfer:
- see general links above for secure p2p/direct file transfer methods
- securing basic rsync
  - https://www.upguard.com/articles/secure-rsync
- https://syncthing.net/
- https://onionshare.org/
- http://retroshare.net/ (and file sharing, email, etc.)
Remote access:
- ssh hardening
- ssh on hidden service server
Collaboration: see general links above

1.11 Privacy

Personal privacy tools:

1.12 Operational Security (OpSec)

The most important thing on this list: STFU…

A fun note on modern interent op-sec: https://sive.rs/anon

1.13 Tangent: Phone

21d-PracticalPersonal/hippa.jpg
Are there any fully open/transparent phones? Not really, but some laudable efforts: