Hot answers tagged

133

A good option is to harden your Content Security Policy. It allows you to fine-tune which resources the browser will load/run, and is supported by most browsers. Consider the following header: Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; This tells the browser to disable scripts, frames, connections and any other objects/...


92

Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (also strong password). Enable the BIOS password option. Every time you power on your computer, the bios itself will ask you for a password before even booting on. It will also prevent everyone from applying changes to the ...


85

Summary: There's probably some BS marketing going on, but on the whole they probably are making the more privacy-respecting laptop they can. Other answers mention other brands of privacy-focused laptops that avoid Intel chips in favour of 100% libre hardware, but you take a big performance and cost hit for doing it, because, well, Intel is the market leader ...


85

I hate to be this guy, but Law 3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. You are asking how to best lock a plywood door. People are giving you very good suggestions for locks, but none of them matter since your system is physically vulnerable and your attackers are competent. They will just ...


66

Depending on the performance you require and money you are willing to expend, a removable "Live USB" or completely bootable normal system on a USB "hard drive" (a small ssd would work great) might be an ideal solution considering your "unique" constraints of needing high security against local attackers. It would allow you to just leave the compromised ...


24

Yes, binary blobs are a security risk, as any other proprietary software that you cannot audit. I wouldn't call all systems using proprietary software "compromised", but you can only trust such systems as much as you trust people selling them. Regarding that Purism thing, I wouldn't trust them more than I would any other laptop. Their FAQ states: Purism ...


20

Here is an all inclusive solution since you stated you were not worried about hardware/USB/physical attacks. Install Virtualbox/VMWare/Other on your desktop. Go about creating your guest and put that guest on a removable USB key. When you're done with your work, power off the virtual machine, remove the key, and it's a wrap. There are plenty of other ...


20

There's some things to consider that differ from all the answers previously given: what you're looking for is privacy, not security. While they seem very similar, the goals of each are different, and the ways to implement each are different. If you were looking to implement security, you would remove other users' admin access, lock down each users' ...


15

Do binary blobs pose a potential security threat? In short: yes. Binary blobs are by definition not auditable (barring extended reverse-engineering). You don't know exactly what they do, and whether they have backdoors. One particular binary blob I'd like to highlight is the one in the Intel Management Engine (and the AMD equivalent, the Platform Security ...


12

I like the answers that suggest you run Linux from removable media. It hides the fact that you're taking precautions from your not-so-nice house mates. There's a few problems with it, though, from a practical standpoint. You're sacrificing drive speed and space, but what's more important is that carrying your whole operating system around with you is ...


10

You can not secure the system under the conditions in your question. No matter what, with physical access to your machine there is no security. With the exception of the bios password every counter measure on this page could be circumvented by booting into rescue mode (in one form or another). The BIOS password is easy to reset. It's usually a jumper or ...


9

You better ignore that commenter entirely. Joey Spinosa is either royally confused or is trolling. There are many totally inaccurate statements in his comments; mainly from conflating Server Certificate with Certificate Authority Certificate. Claim 1: downloading files ... install these certificates of authority. Browsers never silently install a ...


9

Just buy a notebook and carry it around with you. If you don't want other people to check your data, don't leave your data near them. If any part of your machine is compromised, everything on your machine is compromised. Hacking hardware is not necessarily expensive and you don't really know how far would this person go to get access to your data. The ...


8

Binary blobs are code that you have to send to a device to make it work, but that you can't inspect or modify. They are more of a threat to your legal freedoms than your privacy. In the case of Intel chips, you can't write a free-software BIOS, because it must include the non-free binary blobs. Binary blobs let chips outsource storage of code to software. ...


8

Not sure why nobody has mentioned this yet (maybe I don't understand the site that well). Put a camera in your room (one WITHOUT wifi capabilities). Get your linux system set up, casually mention it to your housemates in passing conversation. Record them breaking into your personal computer and reading your information. Have them arrested and fined, use the ...


6

Claim to "not log" is not the same as "not monitor connections". First is saving traces, second is analyzing activity when it happens, that does not necessary generates logs. However, while not totally clear, I understand they claim to not monitor too: NordVPN does not monitor, store or record logs for any VPN user. They do not monitor logs (since ...


6

I see two possible uses for this even with logging disabled: A user violates some other part of the ToS, for example by paying for their account using a stolen credit card. An operator of a website which is targeted by a user's illegal activities contacts the VPN provider, and the VPN provider sees that the connection to that website is still open so it ...


6

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like notifying the user in case you identify multiple IPs are connected at the same time, block consecutive attempts, etc. But for your specific example, I think you ...


6

Figuring out if any device has been hacked is an extremely complex subject. In most cases, unless you know precisely what to look for or have weird side-effects of the hack, you may never notice it. Duct tape on camera lens will most definitely prevent anyone from seeing you. You'd obviously need to cover both cameras on a mobile phone. Other than that, ...


5

I would get two USB sticks. The first would have the capability to be set as read-only at the hardware level with password protection, and the second would be either a normal stick or a PIN-enabled stick (but these tend to self-destruct if the wrong PIN is entered a few times, so beware...). Install your operating system on to the first stick, and configure ...


4

This would be my plan of action: Lock down the BIOS by adding a BIOS password to the setup. I would not add a startup password to allow users to use the computer without my supervision. Disable automatic booting from USB, CD and network. Force boot from USB/CD and install Linux with an encrypted home folder and encrypted swap on the hard disk. If possible, ...


4

Privacy and confidentiality are different things... A Zip file, even encrypted, is still there, and onlookers may observe not only the archive presence, name and size, but also the individual names and sizes of files within the archive, because these are not encrypted. Traditional Zip encryption is weak and can be broken within a few minutes, regardless of ...


4

Given that you're attempting to defend against a Google "all-seeing-eye" attack, (and not the NSA), this is a good start. I've added a couple suggestions below. Your search engine activity will be trackable through the generation of unique links. Consider using a privacy-oriented search engine, like DuckDuckGo. You have their word they aren't trying to ...


4

I want to begin my answer by saying I work in IT Audit / Security and this answer derives from my profession. I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. This is not only a good idea but essential to protecting your workplace. The benefits for implementing a ...


3

does rotating proxy increase the difficulty to find your real IP? No. Your "real IP" is either disclosed in some way, or it is not. If it is not, it does not matter how many proxies you pass through. Multiple proxies may make more difficult to track your activity, i.e. establish that actions A and B were both performed by the same entity (for that, see ...


3

Also, I forgot to mention. If you want to set a BIOS password, and depending on how much hassle you want to go through, you could invest in a case that has a lock for the side. While that wouldn't entirely prevent intrusion, it would prevent people from tampering with it if they didn't want to be detected. That way they can't just remove the CMOS or access ...


3

Other folks had some great ideas. I didn't read down to determine whether or not this was already mentioned, so I apologize if it has been. I know you mentioned you cannot physically lock the door to your room, but how about working solely off of an external hard drive, encrypting it, and locking that up elsewhere, in a lockbox or safe or something like that?...


3

I did some admin-work in the past in a company where past admins didn't leave many notes. But there was hardware that was vital, connected to the networks, and not trustworthy. From that experience I can tell you that the old saying is right: if you have physical access and are determined, game over is only a question of time investment. You can make it ...


3

I see lots of people mentioning that physical access is game over. While this is true given a well resourced attacker, there is a defence against less well resourced ones: Qubes OS and antievilmaid. https://www.qubes-os.org/ Qubes is essentially Xen running Fedora VMs (you can have other VMs, including Debian and Windows). antievilmaid is a program which ...


3

I encountered the following ages ago from somebody who was excessively paranoid: Full disk encryption where /boot was on removable media and the master password had to be entered from a grid display so that the keystrokes that corresponded to the letters of the master password changed every time the computer booted. My personal recommendation involved here ...



Only top voted, non community-wiki answers of a minimum length are eligible