As more people flock over to the fediverse from reddit, twitter and other centralised proprietary networks it is important that you keep your e-mail and other important accounts safe from hijacking attempts. Since anyone can simply spin up an instance and host users and communities it is important that you don’t divulge your internet personal details to anyone as these can be harvested by the instance owner and by any instance you erroneously try to login to or simply the instance could be hacked and the user data harvasted. With this in mind here are some suggestions for good OPSEC (Operation Security):
- Don’t use your main e-mail address. Either create a new one or better sign up for an e-mail forwarding service and set-up forwarding addresses for each instance you sign up to. Since these are throw away addresses, if it gets leaked you can just delete the address and create a new one without compromising your main e-mail address. (Bonus: this can also be used to use unique addresses for traditional web services and make it easy to know how and from where an address got leaked)
Here is a nice article with some e-mail forwarding providers to get you started
- Use a password manager and generate strong and unique passwords for any and all instances and services you use, this way you won’t divulge a password used on another account to the instance owner, or if the address used (especially if you used your main e-mail address)/got leaked your account will still be safe from hijacking by attempting to use password dictionaries to guess the password.
Some passvault suggestions:
- Passbolt (self hosted)
- Bitwarden (self hosted and hosted options)
- Vaultwarden (unlocked self hosted alternative to bitwarden)
These are my main security suggestions for all you new and existing lemmings. Feel free to suggest other security considerations to have and other services beyond those mentioned. Stay safe and have fun posting and commenting.
You could add keepassxc as an option for those who don’t want a hosted service at all. You can still exchange the storage file with other computers if you have to (via USB stick, mail, nextcloud etc)
I second this option. I use it because there’s an app that supports the file format for pretty much every platform.
Check out Strongbox. I can’t say I’ve used it, I’m on Android, but it seems good.
You can also add to that pass which names istelf the “standard UNIX password manager”, altough it’s just a nice frontend for gpg.
Do you know of a “keepass for dummies”? I’ve tried to figure out how to use it, but reading the readme on GitHub just makes me feel like an idiot.
Was there anything particularly confusing? I can try and clear it up.
You can go on the KeePass downloads page and find a client that works for you. I like using Keepassium on my iPhone and KeePassXC on my laptop.
I finally figured it out. I’m using KeepassXD on Android and it’s not very user friendly. I still haven’t figured out what the unlabeled teardrops are that can be “enabled” or disabled.
I feel like this option is honestly worse for most people. You have the new security problem of having to transfer the file everywhere, but now the huge inconvenience of potentially losing it or not having it on a new device.
I don’t think transferring the file is a security problem, with hosted services you need to transfer the secrets somehow as well. And cannot choose how they are synced and must rely on the server being secured (in case that component is not hosted by you). Since it is synced to all devices, you are basically having a distributed backup of it already. But I agree, initial setup is a slight bit more work.
It’s not very open-sourcey, but Apple include a email forwarding service called Hide My Email in their iCloud+ plans. So, you may already have access to that service.
duckduckgo.com offer that service too. Using a browser plug in it can generate @duck.com email addresses when signing up to sites and forward them to your standard email address.
Firefox also offers their Relay service, which is hosted by the Mozilla foundation, although I don’t believe that the service is open source.
Speaking of which, stuff that frequently comes up in privacy related forums:
Differentiate between your professional accounts (it has your real name attached) and your non-professional ones (you use it to discuss pooping methods for example). Don’t mix them up. I know many will say “so what if people in the fediverse know where I live and how I poop, I got nothing to hide” a lot, but that’s how people got doxxed or swatted.
Even if you don’t feel the need to, it’s good to sit down and identify the potential threats given certain problems. Do you recycle passwords for email and social media accounts? What about banking? If a malicious coworker or an immature family member got access to your social media profile and posted reputation-damaging content, how bad can things get? Identify the outcomes you can mitigate or must prevent, and plan accordingly.
There is no “100%” when it comes to privacy. It’s a process, not an “all-or-nothing” switch. Beginners often ask if “program X and Y will protect me 100%”, and the answer usually boils down to “there isn’t a single magic pill”.
Privacy ≠ Security ≠ Anonymity. A VPN subscription can secure your connection (content secret in transit), but does not make you anonymous (sender known to middle node). You could leave an anonymous message (sender unknown) on a public forum, but the message itself isn’t private (content not secret). And so on.
Encryption is a useful tool, but don’t fall for the “military grade encryption” speech. They often mean “we just slapped whatever shit it came up with”, nothing extraordinary.
There are many more but I will stop for now. No, I am not in Guantanamo.
Also, do not post personal information here ever. Once you posted a comment, there are no guarantee you can fully delete them later. If you post a personal information, there is a chance that it might still up in some instance somewhere even if you attempt to delete it. Some instance might not receive the activitypub push about the deletion due to federation issue/lags, getting blocked from the original instance, bugs or random internet connection issues. Use other channel if you need to share personal info to fellow lemmings so you can be sure to purge them if needed later (e.g a link to pastebin, discord, etc)
If there are not already people running fediverse nodes that exist specifically to harvest potentially ‘interesting’ data, there will be.
You edited it? That’s maybe interesting. You deleted it? Same deal, maybe interesting.
It looks like an email address? Definitely might be interesting. A phone number? Yep.
An address? Definitely could be interesting.
If you posted it, assume that it will always be available to the exact people that you don’t want to see it.
I wouldn’t say don’t post personal information at all. But rather don’t post information that you’re not comfortable with everyone knowing, while being identified and never being able to delete it.
IMO it’s best to assume that if you post enough online, someone dedicated enough will be able to identify you, especially people who already know you in real life. It’s difficult to post without revealing small details about yourself that can be combined to piece together who you are. Eg, you might never say where you work, but your city, field, an offhand comment about a coworker, a mention of a conference, and such might let someone narrow it down. Similarly, you might never mention what city you’re in, but it might be narrowed down from mentions of things like traffic, weather, events near you, remarks of things being close by, etc. And that’s not even getting into devious things like trying to trick someone into clicking a link to a domain you control so that you can get their IP.
I’m of the opinion you should generally act as if you’re talking to people face to face with a name tag saying your full name and address. I think that approach also just plain makes the internet a better place. Anonymity seems to make a lot of people more comfortable being aggressive assholes.
I say “generally” because there’s plenty of valid reasons to want to post things you would want to post things that you’d never say if identified. But in that case, you should strongly consider using an absolutely minimal throwaway account, while being extremely careful with details. And even then, you should at least consider that you might still get identified. In particular, I think a lot of users of throwaways only consider strangers not being able to identify them. Sometimes that’s all you care about, but your family, friends, and coworkers are going to have a lot easier time identifying you.
I totally agree with using strong unique password manager generated passwords for every server (as everyone should do for every service they use regardless) but my email has been leaked so many times by so many breaches I’m not sure I really care about that part at this point…
I use + addresses for stuff.
Well, since I run my own mail server, I tend to use _ instead of + as the separator, simply because more places will consider it a valid address.
But it’s amazing how useful it is to include the name of whoever you’re giving the email address to in the email address. It lets you keep getting email for stuff like password recovery. And when an address is leaked, not only can you block that one, but you also get to know who leaked it.
Which is awesome for knowing which businesses to never use again.
