Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/157 Thanks!
And I think
I got one of these guys to do it.
I'm surrounded by nothing
because I knew he is OK.
He said, Do you know?
And.
I mean, if.
Yes.
I think you're right.
And people.
And if you read.
Going to be translated into German, I
would have.
You're not doing that.
No, no.
I I'll step away.
Why?
So.
Oh, there's been.
For a minute.
OK, our next speaker.
Well, she doesn't need much of
an introduction.
She's a senior policy
analyst at the Electronic Frontier
Foundation and former sysadmin.
She's here to talk about something a lot
of us have some ideas on, and that
is security
frameworks. So.
Heather?
Thank you so much for coming.
I know that a lot of you would like to
be, I don't know, eating dinner,
but you've put it off for me, which I
think is is very sweet.
I'm Eva Galperin.
I work for the Electronic Frontier
Foundation. Some of you may have heard of
it. Raise your hand if you've heard of
the Electronic Frontier Foundation.
Oh, I love a world in which I don't have
to explain who I work for.
So this is this is my talk.
It is called The internet doesn't need
another security guide, except
the internet needs another security
guide.
If you have questions about my talk
afterwards that don't fit into question
time or comments about how incredibly
wrong I am about everything.
Please email me at UVA at
f forg.
If you wish to vent your fury upon
Twitter, you can reach
me at UVA side.
That's even a c
i d e and
the f f Twitter feed is
e f f.
So that's not too terribly difficult.
So let's get started.
Why are you here instead
of eating dinner if you're in this room
right now?
Chances are you're some kind of security
trainer or security professional just
in case I'm really wrong.
Raise your hand if you are a security
trainer.
Oh, very few.
Very few.
Raise your hand if you're some form of
security professional.
Oh, we got a lot of those.
All right. I'm not surprised.
So if you are one of these things, you
probably field a lot of questions about
security and privacy, sometimes
from your family or your friends
or large scale enterprises,
or penniless NGOs
or freelance journalists who want to
protect their sources
from activists and authoritarian
regimes.
And these people look at you
as sort of a superhero.
And this is good news because you get to
wear cape and this
is bad news because it actually means
that they don't understand who you are
or really what you do.
And of course, with great power comes
great responsibility, and
you have to count them two
major responsibilities as
a security professional giving privacy or
security advice, and they are
number one to get it right.
I can't even believe that I have to bring
this up, but just
as a person giving privacy and security
advice.
You need to get it right.
You need to give people advice that is
not factually wrong.
And the second is to communicate
your advice in a way that is understood
by your audience.
And part of that involves understanding
who your audience is
coming to, sort of where they are in
terms of what they're capable of
understanding and what they're capable of
doing.
And and this part can get a little bit
difficult.
How many of you were at Glenn Greenwald's
keynote?
Lots of you were there, so
many of you may remember
Glenn talking about
his experiences, sort of getting to
know the security world
before, you know, getting his hands on
the Snowden documents.
And he nearly lost out on the opportunity
to do this because he found p-gp
just enormously difficult to use.
In addition to finding TGP enormously
difficult to use.
Finally, he says that
Snowden and Laura Poitras
said, All right, we have we have
a tool we're pretty sure we can teach
you. And it's called TrueCrypt.
So they show him how
to use TrueCrypt.
He installs it on his machine.
He plays around with it on the weekend.
He comes to Hong Kong and he's really,
really proud of himself for having
mastered TrueCrypt.
And he turns to Edward Snowden
and Laura Poitras and says, Look what I
can do isn't this awesome?
And he's very surprised when he doesn't
see that look of parental pride
on the on the face of his coconspirators.
And instead, Edward Snowden tells him.
TrueCrypt is kind of designed so that
even your kid brother can use it.
And this tells us two very important
things, which is that
you do have to sort of pitch your
pitch advice that the audience that
you've got.
But hopefully this is also a reminder to
all of us to not be jerks about it.
What are we going to do here?
We're going to take a look at the at the
landscape of guides.
We're going to zoom in on a
few specific projects,
including IFS, surveillance,
self-defense, the security
ladder and how HTTPS
and Tor work together.
We're going to draw some lessons
from this experience.
And then finally, I will issue a rousing
call to arms, after which you guys will
all go out and get security guards.
What am I not going to do here?
I'm not going to troll.
I am not going to give you a
long list of specific
instances in which I think other people's
security guides suck or
got it wrong because I don't think
that's going to help.
I'm not here to embarrass anyone.
I'm not here to sneer at anyone.
I'm not here to look down on anyone
because I don't think this actually adds
anything to the conversation.
So no trolling here.
We I'm also not
going to talk specifically about
what ESF thinks are privacy
and security best practices
in effect, giving you our own security
guide right here in 45 minutes
because this is really
much more of a meta talk.
If you want to get into the weeds of
what the EFF thinks is a good idea or a
bad idea in terms of advice that we might
give out.
We can get into that and question and
answer time, assuming that not everybody
in the audience finds that too incredibly
tedious.
So you want to write
a guide?
If you've already written a guide, let's
take a quick look at the landscape.
The first thing that we should probably
start with is Tactical Tech, because
Tactical Tech is a nonprofit organization
that is designed mostly
to write guides, and they have
three things that were going to take a
look at.
One of them is security in a box,
which you can get to add security in a
box, dawg.
We also have printed copies of security
in a box available at the
ISAF table over in Noisey Square.
There are also lots of people from
Tactical Tech here who I'm fairly certain
carry around copies of security in a
box, in various languages on their person
at all times.
The second project, also from Tactical
Tech, is called a quick guide to
Alternatives, which is sort of a
best of tools which
Tactical Tech recommends.
And the final thing is a
project called Me and My Shadow, which is
available at my
Shadow Dawg.
So here's security in a box.
And this is a guide which is both
printed and online, written by
a collaboration of tactical tech and
frontline defenders.
It's aimed at beginning users.
It includes a How-To booklet
is translated into 13.
Count them 13 languages.
It includes hands on guides and
also a glossary.
The various sections can be
remixed depending
on, you know, sort of who
who you're talking to or who you're
training. So in some ways, in addition to
being aimed at beginners, this is also
aimed at trainers.
And one such example is security
and context, which is
a selection from security
at a box of tools and tactics
for the LGBT community in the Arabic
region.
This is a quick guide to alternatives.
It's again, not a survey of all
the tools that are out there, but sort of
a best-of.
Here's what tactical tech thinks that you
should be using for a browser
or search or email provider
or a client in
the browser section they recommend.
Mozilla and the Tor
browser bundle under search.
They recommend DuckDuckGo under
email. They recommend rise up and
under a video chat, for example.
They recommend Gizzi now.
Different people here will have different
opinions about whether or not these are
the right recommendations that they
should be making.
But I really want to talk
about sort of the framework that they're
using.
And finally, there's a
project called Me and My Shadow,
which has fantastic graphics,
and it uses the shadow metaphor
to help beginning users understand their
digital shadow or what we usually refer
to as a digital footprint.
It includes an interactive, interactive
tool called Trace My Shadow, which lets
you investigate the traces you have left
through the use of your applications and
devices.
And it gives tips for taking control
of your information and turning
the tables on governments
and companies.
So this project is also particularly
interesting to me, and
we'll talk a little bit about sort of the
the importance of metaphors later.
So speaking of of the gamification
approach to teaching people about privacy
and surveillance, which I didn't so.
And then there's the gamification
approach to
teaching people about privacy and
surveillance.
There's Data Dealer, which is an online
game about collecting and selling
personal data, which aims to
raise awareness about privacy in
a new fun way.
The English version was released in
May of 2013.
It's also available on Facebook
for maximum irony.
And if you will give me a moment here,
I will.
Play.
The data dealer video.
Presumably at the end of the game, when
you become an enormous media mogul,
you discover that the government has been
tapping all of your communications using
undersea cables.
So we at the other end
of the spectrum,
we have a couple of other items
on the landscape, including the
Crypto Party Handbook,
which is a fairly
straightforward text
based guide and also a guide
from the freedom of Press Foundation
called Encryption Works.
And these are sort of aimed a more
middling audience.
The original things that we were looking
at were really aimed at beginners
who are still trying to grasp
the whole notion of privacy and security
online.
And it's very easy when
you're talking to people like that to
just overwhelm them with jargon
and end with scary stories,
which can make it so that they
don't really want to play at all.
And they decide, well, if the government
has everything all the time anyway, why
should I even bother using any of
these tools? This is something that we
refer to as security and
privacy nihilism.
So the crypto party handbook
is low tech, it requires
a background in technology, and it's
generally used in tandem with
crypto parties where people show each
other how to use Tor, Otbr
and P-gp.
This can be useful,
and I've been to a number of
crypto parties in the Bay Area,
but I found that the greatest
stumbling block of crypto party
has been that while it is aimed at
beginners, it usually
lands somewhere
around professionals.
And so you get a group of people, all
of whom already know how to use all of
these tools, talking to each other about
how they use all of these tools.
Your mileage may vary.
And just to let that one sink in, so
the Freedom of Press Foundation, whose
CTO is the wonderful Michael Lee,
also put out a guide guide called
Encryption Works, which is about a
30 page PDF.
And interestingly enough, it starts
with a discussion of threat modeling, and
it's very explicit about the sort of
threat that is designed
to give you advice to
counter. And that is how
to protect your data and your
communications against surveillance
by the NSA.
And they do point out that by protecting
your communications from the NSA, you
this does.
This advice kind of also applies
to other governments, but primarily
they're talking about the NSA as
their threat model.
As far as I can tell, a lot
of the assumption is that you're dealing
with sort of NSA mass surveillance
rather than targeted surveillance,
because as we all know, preventing
or, you know, fighting
sort of very targeted surveillance by
the NSA or indeed any sort of government
adversary is much, much
harder.
And finally, there are some more
specialized guides,
what I have here is a link to the
journalist's security guide put
out by the Committee to Protect
Journalists.
The Journalists Security Guide has
a whole, whole bunch of really
interesting information
about physical security
and maintaining your mental
wellbeing in the face of really, really
scary stuff.
But it also has an entire section
on Internet Security written
by Danny O'Brien, who is now the
international director for the Electronic
Frontier Foundation.
Because nepotism also works
and it talks about protecting your
data threat modeling, it
suggests some tools.
It talks about choosing passwords, and
it also explicitly talks about
avoiding phishing and malware.
This guide is composed largely of big
blocks of text, which I assume
is not really a problem because it is
aimed at journalists who produce big
blocks of text.
And finally, there is a
guide called Better Crypto, which is
largely aimed at
systems administrators, and you can get
there at WW Dot Better
Crypto dot org.
They are actively soliciting
comment right now, and the whole idea
behind this guide is that they're
they're providing a whole bunch of how
tos about, you
know, sort of best practices in
setting up SSL h or
SSL or your web server or
your mail server, or whatever else it
is that you need to to
set up in order to protect your users.
What they do not provide
is sort of a set of
talking points for trying to justify
all of this extra time and
effort to your boss, who probably doesn't
want to spend a whole lot of extra money.
So I think there's there's some room
there.
So let's talk a little bit about the
about the landscape and
what if thought was missing when
we looked out at it?
Probably the biggest aspect
that we thought was was missing.
The biggest aspect that we thought was
was missing. When we when we looked at
this stuff was a discussion of threat
modeling.
We found that most of these guides, when
they talked about threat modeling
at all, usually said This
is the threat model that we are
building this guide for, and
we have nothing to say about other
threat models because that's all very
complicated. In fact, most discussions
of threat modeling will begin with
the words. Well, it
depends on your threat model,
and it's complicated.
And then usually they stop, which is
kind of a problem.
So we definitely wanted to talk
some more about threat modeling and sort
of how to come up with a threat model.
Because when you're dealing with a
vulnerable population or a group
that that knows that they're being
watched, they instinctively
know threat modeling. They have a fairly
good idea of what it is that they want to
protect and who they want to protect it
against. And what they don't have
is quite enough information
about what tools they should be using
or what kind of practices they should be
using and what their
adversaries capabilities are.
So we definitely wanted to talk about
that.
We also felt that there
wasn't enough talk
to sort of that middle ground.
Tactical Tech builds really fantastic
tools for beginners,
for people to really start thinking about
the issues of of privacy
and security, whereas
guides like
like the Crypto Party Handbook are really
aimed at people who kind of understand
the stuff to begin with.
And the
Encryption Works Guide is also sort
of aimed at people who already have a
general idea of how this goes.
Probably the most the most common
criticism of the
encryption works guide the I
have heard from non-technical people is
that they find it scary and cipher
punkish.
I think scary and so punkish is a
good thing.
But you, you have to go to
where the people are, not where you think
that they should be.
And finally,
we we definitely felt the
there were not enough people who are
interested in creating
resources to help train trainers.
So much of training depends
on metaphors because
the map is not the territory,
and I think it was the statistician
George P.
Box, who once said that essentially
all models are wrong, except some models
are useful.
And what you want to do is you want to
build useful models, so you need to make
sure that you are jettisoning the stuff
that's just going to confuse the people
that you're talking to, but you're also
keeping all of the elements that they
need in order to draw useful conclusions
about what they should and should not be
doing. And as it turns out, that's very
hard.
So I am going to talk a little bit now
about a very small project,
the Jeff did called
how TAU and TDPs
work together to protect your privacy
and security.
And to some extent, this falls into
that kind of middle ground that we were
talking about.
We found that a lot of people understood
that Tau was a good tool,
and the TDPs was
a great thing that they should be using.
And indeed, they suggested that people
download HTTPS everywhere,
which is a browser extension that
Jeffs writes and is available
for Chrome, Firefox
and now Opera.
So we're trying to explain to people why
they needed to use these things together
to protect their privacy and anonymity
instead of just sort of one or the other.
And we created a model.
And at the beginning of the model, you
can see we're trying to explain what
happens to your data.
We're
in a case in which you are using neither
Tor nor HTTPS.
So you can see the little
the little blogger are a little user,
then you can see his Wi-Fi.
You could see the hacker who's sitting on
his Wi-Fi being evil
as hackers do.
You can see the people at the ISP,
such as a lawyer who can show up with
the subpoenas or the sysadmin
who can pretty much see everything or the
police who can show up with a warrant.
And these are the things that they can
see when you're using another Tor nor
HTTPS.
We have a we have two
little blue NSA guys
who are also trying to spy on everything
in the original version of
of this project.
My colleague Seth Seth Schoen
really wanted to include
a tiny image of NSA guys
in an underwater submarine
tapping cables.
But we decided that, and
it's just kind of farfetched.
Who's going to believe it?
And anyway, it's just going to confuse
the issue.
So I owe my colleagues from submarines.
And then finally, you get to the to the
ISP, which runs the site you're going to.
And a little explanation of what they can
see and the site itself,
which we have called sitcom.
And here are the things that they can
see, as well as the people who can show
up and get that information, including a
lawyer, a systems administrator
and a policeman.
So as you can see in the version in which
a user is using neither Tor nor
TDPs, everybody can see
everything. And that's very bad.
So they can see things like your password
and your content and where
you're coming from and where you're
going.
Hmm.
There we go. Here we have the
Virgin, the version of the same situation
in which the user is using HTTPS
and when they are using
HTTPS, they have
transport layer encryption, which means
that the hacker who is sitting on the
Wi-Fi using fire sheep can't see
what their can't see what they're doing,
but they can still see a couple of other
things.
The people who are at the ISP, they
still see some information, but they
don't actually get the content of the
message.
Even the NSA, not the content of the
message, because this was before
the Snowden revelations and we didn't
know whether this information was going
to Google or something.
And finally, at the
site, you can see that at the site.
Of course, they have all the information
about the content to that that the user
is trying to get to, because that's
how it works.
Yes, that's my explanation.
And here we here we have our our little
explanation of what happens when the user
is just using Tor.
And I think that the the most important
thing to keep in mind in
in our little little graph
here is that
Tor grants you anonymity
from the
people at the site. Maybe the people at
the ISP and maybe to a certain extent,
the hackers sitting on your Wi-Fi.
But it does not protect
the the content of the data
that you are sending out.
And the reason why we thought
it was especially important to make this
point is because in
tech reporting and indeed among
most people who have, you know, some
technical background, but not a whole
lot. This is a mistake that they very
frequently make, they say.
But Tor is encrypted, and if Tor
is encrypted, then everything must be
safe, right?
And that's simply not true.
So finally, we have
our little illustration of what happens
when you use both Tor and
HTTPS to protect your data,
and as you can see, this protects
a lot about your content and
a lot about your location from
from certain types of actors, but not
everything and not from everybody.
We also include our two NSA
guys and our
our three little gray Tor nodes.
And we use the tour nodes to sort of
explain what you what you can and cannot
see from, you know, an entrance node or a
middle node or an exit
node. And then we have our two
NSA guys who are trying to do
a sort of timing attack.
The next project that I'm going to talk
about really quickly is called the
security ladder.
And again, my
colleagues and I have found that people
were having great difficulty
distinguishing between end
to end encryption and
transport layer encryption when
they were trying to decide what tools
they should be using in order to protect
their data. Again, people just sort
of shrug and they say it's encrypted,
so everything must be fine.
They say it has military grade
encryption.
It must be great.
We should use that.
So my colleague Seth
Schoen and I once more teamed up in order
to come up with an explanation for why
that certainly is not the case and also
a way of sort of figuring out whether the
tool that you are using is
is providing you with a transport
layer encryption or with end end
encryption and sort of what you gain in
either case.
Our actors here are properly
internationalized.
We have named them Boris and
Akiko.
And, you know, here is what happens to
to your message when you're not using any
encryption.
You know, you're Akiko gets the message.
The message is totally readable.
It is open. It goes to the ISP.
It's still open and readable.
It gets to the service, open and
readable. It goes to the other ISP, still
open, still readable.
It gets to Boris open and readable.
So, you know, not terribly exciting,
but kind of scary.
This is a situation in which
Boris and Akiko are using
transport layer encryption.
So Akiko has her
her message. She takes her key.
She has.
She has encrypted the message.
She sends it to the ISP.
The ISP cannot open the little packet
it gets to the service.
The service has the key.
You can tell the key is read and
they can open it, and therefore they can
see it. It goes to another ISP
before it gets to Boris ISP.
Can't read it.
It gets to Boris.
Boris again has the red key
and therefore can read it.
And finally, we get to end to end
encryption.
And you can see the Akiko is actually
encrypting her message using the blue
key, the message, the key that belongs
to Boris.
And because the service the red service
does not have the blue key, they cannot
see it. So we feel that this
very succinctly explains
why it is that you would want to use end
to end encryption instead of transport
layer encryption or in addition to
transport layer encryption.
If you are concerned about the service
being able to to read your messages
or if you're concerned about the ISP or
some other, you know, intervening factor
being able to read your message.
Here are a couple of the other tools and
documents the IMF has
been working on, most
recently, I went to The
Hague, where I had a meeting with
a bunch of people who are interested in
doing rapid response.
So these are the people who are
constantly being contacted by
terrified activists and journalists
saying things like I think I've been
owned or somebody has
taken over my Facebook account or my
Twitter account.
Somebody has installed a
remote access tool on my computer and
taken all my files and put them up on a
website. This actually did happen to a
journalist in the Ukraine.
So we we thought a little bit about
how to process these people and how to do
triage so that the people who
say reverse malware for a living aren't
stuck there asking questions like, So
did you plug it in?
And our our answer to this
problem was to make a sort of
questionnaire that people at the
various organizations who are being
contacted by terrified activists and
journalists can can use
to question them about the exact
nature of the problem and only
kick it up to, you know, sort of level
level three
professionals.
If it turns out that their skills are
necessary and it is our hope that
in doing so, we can do a whole lot to
prevent burnout.
We also wrote a white
paper a couple of years ago, which
describes your rights at the border with
your electronic devices.
This was a combination of
one of our one of our lawyers.
Marcia Hofmann, and are
the staff technologist, Seth Schoen.
And this was a fantastic
paper, even though it mostly gave very
bad news, which is that it turns out that
at the U.S. border, you don't have a
whole lot in the way of rights, and
so you should be especially careful when
you're carrying your electronic devices.
We also wrote a quick guide
sort of at the height of the of the
Occupy and anonymous protests
to taking your device to a protest
because it was our understanding that
many people were taking their phones to
protests, mostly in the United States,
and they were having their phones
confiscated, and that this had the
potential to
essentially implicate everybody else that
this person whose contact information
this person was keeping in their phones.
So we talked a little bit about, you
know, take a burner phone.
Be very careful about the information on
there. Have, you know, no contact
list on this phone, that
sort of thing.
We also wrote a guide called Keeping
Your Site Alive, which is sort of a
guide to surviving deeds.
It has a couple of different sections,
including a section on choosing
a good web host and
doing backups and on
mirroring. And we talk a little bit about
the different, about the different
services that are available that do
divorce mitigation.
This is a really major problem
in some parts of the world, including
most of the post-Soviet states, where
$d happens a whole lot and people are
very, very concerned about it.
And this site has been
fully translated into eight different
languages. Count them eight,
and it includes a whole bunch of
little instructional videos, which we
made in in partnership
with Tactical Tech.
And then finally, there was sort of
my attempt at gamifying
security issues was
Crypto Bot, which is
a project that we have not yet launched.
And the goal of Crypto Buy is
to teach users how
to set up p-gp correctly.
Obviously, there are about a million
different walkthroughs for how to
combine, you know, an email in
Thunderbird or Melville
ope or whatever in order to use P-gp.
But we wanted to make a little
interactive bot that would
receive a p-gp encrypted
email from you and send one back
to make absolutely sure that you can in
fact, use this thing properly.
So we expect that to be launching
probably sometime in January
as part of a much larger project, which
will include, you know, sort of several
such challenges for people who have
never set up BGP before.
And now we're going to talk about
what we have learned as a result of
looking out of looking at this landscape.
The most important thing, I think,
is don't reinvent the wheel.
There are a lot of guides out there
and in.
As I said, the internet doesn't need
another security guide.
So if you find yourself writing exactly
what somebody else has written before.
Rethink, rethink your project.
The second point is know your
audience who's going to read your guide?
How are they going to use it?
How are they going to get to it?
How much time do they have?
All these things should really inform
your your project.
A third translation is
hard but necessary if
you really want to be able to reach
people all over the world and not just
sort of the English speaking and reading
elite, you need to translate your guide
and you need to translate it into a whole
bunch of languages.
The major languages that Jeff has
has translated some of its works
into include French,
Spanish, Russian,
Chinese, both simplified
and traditional,
also Vietnamese Burmese,
which has a terrible, terrible font.
So there are there are a lot of people
who simply will not be able to read what
you have written unless you bother to
translate it.
One of the other things that you should
keep in mind, if you're going to be
translating your your guide
into a whole bunch of different languages,
is that keeping your information
up to date is hard.
The world changes, tools change,
walk throughs, change the facts
on the ground change and the best advice
and best practices change over time.
And if you are going to be changing
the advice that you give, you have to
change the advice not just in the English
version of your guide or the German
version of your guide, but also in the
Spanish, French, Vietnamese, Burmese,
Russian. And that means the work of a
whole lot of translators.
One of the things that Jeff has found
really helpful in our experience has
been to sort of divide your
guide up into tiny, little bite
sized chunks, which makes it
a lot easier to hand over to your
translator.
Furthermore, if you cannot keep your
information up to date, I strongly
recommend as a best practice to
put a warning up at the top of
of your advice, saying this advice
was good as of this date, which is
the last time that we checked.
And finally, incorporate feedback,
I am not that smart.
I am not the smartest person I know.
I'm not the smartest person in this room.
If you should find yourself thinking that
you are the smartest person in the room.
Go to another room.
You might know an awful lot about
training, and you might know an awful lot
about security, but chances are
that there's somebody who knows more
about the culture that you're trying to
reach or knows more about
graphic design or user interface
or pedagogy.
These are all things that you find
incredibly useful in building a guide.
Use their feedback because it is
incredibly valuable.
This is what keeps us from writing the
same thing over and over and
over again.
And finally, framing
matters, metaphors matter
being right, matters, being
understood, matters, you
are the people out there who are giving
advice and you are
our last best hope.
I say you going all over again on you.
In a world where surveillance is not only
getting more pervasive, but people
are more and more confused about what to
do about it, and they
rely on you to keep them from falling
into security and privacy nihilism
and deciding that they're simply going to
do nothing.
And they rely on you to choose the right
tools and to choose the right practices
and to think about these things
in a way that you think about them every
day. And that might be second nature to
you, but is completely foreign to them.
And so what
I would really like is
for four thousand guides to
bloom, just as
long as they're all
different
and they're all right
and everybody understands their audience
and everybody is very careful with their
metaphors.
I also am sorry,
I also some thinks
the most important person that I think I
really need to think is if staff
technologist Seth Chauhan,
who has made a career out of very
slowly and carefully explaining
very difficult things to people
who are not security professionals.
Thank you so much, Seth.
Second, I would like to thank my
colleague, also a former chief
technologist, now gone off to work
for Freedom of Press Foundation.
Bigger, better, brighter things.
Danny O'Brien, our international
director. Also the writer of the
CPJ's guide.
Hugh Dendrite, who is Jeff's
chief illustrator and artist in residence
without whom I would not have a security
letter or Boris or Akiko.
And finally, tactical tech,
because I have really enjoyed
collaborating with them and they do such
wonderful work.
Thank you so much.
I wouldn't be able to do any of this
stuff without you.
OK, we now have quite
a bit of time for questions,
if you would like to line up at the
microphones, we have
scattered throughout the room.
Also, we're taking questions from the
internet. Please
line up at the microphones and we'll
get started.
Let's start with one from the internet.
So a question who's playing the part of
the internet,
it's up here.
Internet lives here,
do you right?
Even if your users or even if users
are brought to awareness regarding
crypto, who takes care of the content
providers, the E.F.
Tactical Tech, who?
I'm sorry, can you repeat the question I
had? So right here at the same time, sir?
Sure. Sorry.
So even if the users are brought to
awareness, who takes care of the
content providers when it comes to
securing transmissions?
Well, I think that the content providers
actually have a
have a reason to look after the
security of of their
users, and
that is that the users are now
demanding it now.
So more than ever.
And I think that the probably the best
illustration of that is the
way in which so many companies have gone
over to using
HTTPS by default
on their sites just over the last
few years. You've seen that at
Facebook and Google and Twitter
companies that used
to think that HTTPS was just for
protecting your login information or
for protecting
your credit card information.
Now, really understand that they
need to protect you.
You know all the way across the site.
I don't think that we've really quite
made it to our, you know, dream
state of HTTPS everywhere.
I'm looking at you, Wikimedia Foundation,
but I think that
we've made a really good start and that
it's primarily because
users have demanded it and because
they've seen how easy it is to eavesdrop
on content
that's not encrypted in the transport
layer.
OK.
Microphone number four.
All right, thanks for the talk.
You mentioned the phenomenon of
security nihilism.
How do you deal with this kind of zombie?
So how do we get users back into the
area where they are considering using
security methods?
Well, there are a couple of things that I
do. Usually, if I'm talking
to an audience that I see is starting
to kind of glaze over and have that
despairing expression,
I try to make them understand
that, yeah, I can't get you
to 100 percent privacy or security,
and anybody who tells you that they
can is lying to you.
But what I can do is I can make a couple
of suggestions of about, you know, maybe
five or six things that you should do
that I will be happy to go over with you
that will get you most of the way there.
And how far you need to go really
depends on your threat model.
But for the most part, there are a couple
of things that people can do that will
vastly increase their
security and privacy online.
And when you give them just a couple of
things that they can do that will get the
most of the way there, they will usually
perk up and do it.
So sorry to have
a second question, but
this to people.
I mean, I'm talking about people who
really gave up who are too lazy to occupy
it with some sort of security.
How can you get them to at least have a
minimum level of security?
I think it really depends on whether this
is coming from a place of laziness or a
place of despair.
I'm not sure that I can do a whole lot
about laziness, but I can do
a little bit about despair and I can
do a little something about bravado.
I very commonly talk to
activists and journalists who tell me
things like I
am putting my life on the line every day,
just walking out into the street in
Damascus.
I am very brave.
And if the government wants me, come
at me, bro.
And usually what I tell them is,
Well, that's nice.
I'm glad you're brave.
Are all your contacts brave?
Are all your sources?
Brave is everybody that you talk to
online and share information with brave?
Are your parents brave?
Are your children? Brave is, you know,
is your family brave because you're
essentially making this decision
for them, and they're not able to make
an informed decision on their own when
they exchange information with you when
you're engaging in these kinds of
practices.
And as a general rule, even security
and privacy nihilists care about the
security and privacy of, say, their
children.
OK. Microphone one,
Hey. So say
you have some kind of expertize
specific branch of crypto, a specific
kind of threat model.
How do you identify your audience
to write something sort of passionately
directed at them?
And how do you reach them?
Well, there are a couple of different
things that you can do.
The the one that I've really found
to be the most useful is
start with an audience that you want to
reach and not not with your area of
expertize, but with who you think could
benefit from this particular expertize
that you have.
And, you know, work from there, work
backwards. And the second is
to partner with people who already
are engaged in this sort of outreach and
training again.
Groups like Tactical Tech
or contributing to the
Crypto Party Handbook or
working with if there
are a lot of sort of different ways in
which you can go about this.
I am a big fan of collaborating
with
with non-security people.
I find that the combination of a security
or crypto person and a non-security
non-crypto person who knows something
about, say, design or
designing a curriculum or,
you know, is
able to draw is
a really strong kind of meeting
of the minds and can really produce some
some fantastic results.
Thank you.
OK, another question from the internet.
The internet would like to know if
using a phone with no contact lists
makes you even more suspicious than
somebody who has a blinked
or has a contact list.
I'm going to do that thing now.
Well, it depends on
your threat model,
and it's complicated.
Yeah, if you're if you're looking if
you expect for your phone to be grabbed
by somebody who is looking to go over
your contact list and it is possible
that they will, you know, you will be in
a situation where you will be detained
because you have no contact lists and
they find that suspicious.
But think about the other option, your
other options there are.
Don't bring a phone which is legit
or have a fake
contact list or have your real contact
list and risk, you know, sort of exposing
all that to an attacker.
So, yeah, depends
on your threat model.
OK, let's take another question from for.
I would like to bring up licenses
because, for example, when writing the
script about event book and also
when reading the guide from
my colleague, there is
a really good comic
on passwords, for example, but it's
licensed under Creative Commons and
noncommercial.
And this is incompatible with, like
the Creative Commons share like
which we use, for example,
or other people use.
And I would like just to bring up the
awareness, like when people write stuff
that they make it as compatible
with other stuff as possible.
So we don't duplicate like
I don't know how to install Thunderbird,
for example.
Yes, please. I think that this is a fine
point to make now is probably a good time
to tell everybody that all of the content
on EFS website is available
under a Creative Commons license.
You can pretty much do whatever you want
with it, including use
it for financial gain
and you don't even have to credit us.
We are much more interested in seeing
this information get out there than we
are in taking credit for having written
it.
OK, microphone to.
However, thanks for that.
My name is Maya Ganesh, I'm one
of those tactical tech people, but I'm
not one of those people who walks around
with a copy of Save in their bags.
I have, however, had to pay
excess baggage at many airports
for transporting, say, up to two
workshops. So I don't work on the
security or privacy program at Tactical
Tech, and I don't know if that's
fortunate or unfortunate, considering the
last six seven months have been really
hectic. I know for people working in this
field, so
I don't sort of like come to this as as
an expert or even as a trainer, but as
somebody who's part of this organization
and part of this discussion.
And I think it's
I mean, I really appreciate this because
I know I've been seeing a lot of
questions and debates within our
organization about how best to pitch
things and understand audiences and look
at things like threat models.
And I mean, there are enough people that
you know who you know you will be talking
to about this and are in touch with.
So this is actually more a comment.
And maybe there's a question at the end,
but I thought that maybe I just
kind of give a little bit of background
to how these things are used differently,
the resources you mentioned.
So I think alternatives
was actually something that went up in 24
hours in the wake of the Snowden
revelations.
And my shadow, I think, has been
around for about a year and a half now.
And it's really sort of, you
know that that introductory first
look at the idea of digital traces, and I
think that's also kind of in transition
as to where it's going.
And while security in the boxes
is online and, you know, accessible in
all of these languages, there is
sort of like a large network of trainers
and training. And you know, it's one of
those things that's also used in
training. So there's different ways
in which people can can access
the materials that we're putting out
there and and we are kind of looking at
how they fit together and who they talk
to. And I know it's an interesting
conversation. So I think.
I mean, the feeling that I get at
this point is like, wow, maybe we need to
be actually thinking about
this in terms of, you
know, a guide to choosing the best
security guide for your needs
and getting a little bit better because I
am actually curious about what you've
learned about what different audiences
are saying. So activists or journalists
about how do they approach our materials
because it's difficult to see from the
inside out sometimes.
So I'm just wondering if you have any,
you know, evaluations or testing or you
know what users are saying about how to
negotiate this landscape?
Well, there are a couple of different
things that I discovered as a result of
doing this sort of landscape assessment.
And I think probably the most important
one is that
the people these nonprofit
organizations, including my own who write
security guides and privacy guides, are
terrible at ASCO.
Because if you look up
the words privacy guide or security
guide on DuckDuckGo or Google or
the search engine of your choice, none
of our stuff comes up.
What comes up largely our guides.
Quick tips that have
been written not by security specialists,
but by journalists, and
are usually aimed at maintaining a
certain level of consumer privacy and
never, ever
explicitly address the threat model in
any way, much less talk about threat
modeling on a on a meta level.
And I think that's extremely problematic
because the sort of people who are
looking for privacy and security advice
that aren't necessarily part of our
community are going to go to a search
engine and these are the words that
they're going to enter.
They don't know to look for security
in a box. They don't know to look for
surveillance self-defense,
but they do know that they're looking for
a guide. And if they're looking for
it that way, we're not there for them.
I think that's really problematic.
The other thing that I think
is an enormous problem is that we
have not given nearly enough advice
to users who are accessing
the internet using their smartphones.
And this is because the smartphone
is both a threat and a menace
to your privacy and security.
And so there's almost no good news.
But I think that simply pretending that
it's not there is
is extremely problematic and that we
really need to start looking at this
from a harm reduction
approach, which is that you tell your
users, don't use your smartphone
and what are you going to do once they
use their smartphones?
So I think we've we've got a lot of work
cut out ahead of us.
And the very last point that I
think is is really important is
that we absolutely need to talk to
the people in the field because
a lot of the times are assumptions.
And I'm speaking from from my personal
experience, my assumptions about what my
users would be doing and what kind of
technologies they rely on have
sometimes turned out to be wrong.
I spend a lot of time talking about
security and privacy to
users who are located in the Middle East,
specifically in Syria, where almost
everybody uses a cracked
copy of Windows.
And how many of you would recommend that
you engage in any kind of,
you know.
He had communication that needs to be
secure or private on a cracked copy of
Windows. It might as well be,
you know, written on,
you know, in the sky using some sort of
plane.
It's it's not very secure.
So but you've got to go with what you've
got and you need to go to where your
users are and trying
to come up with some sort of harm
reduction approach, given that
very alarming limitation is
is something that we absolutely need to
work with.
OK, we have another question from the
internet.
The internet noticed that there aren't
that many women in crypto and
the internet's concern that we're missing
out on at least 50 percent of the
potential expertize.
So the question is how do we motivate
more women to attend crypto parties and
participate in the field?
I'm not sure that the problem is a lack
of motivation.
I mean, I'll start off by saying that I
really enjoy CCC.
And there is a larger proportion
of women in this audience than
most security or privacy conferences
that I speak at or go to.
I can think of a couple of of conferences
which I will not call out by name,
where it is really common to see
no female speakers at all
or very, very few female attendees.
And I certainly don't appreciate showing
up these conferences and being asked
where my boyfriend is.
But I think that if you want
more women in crypto and more women
in insecurity, the
best thing to do is simply to make them
feel welcome to find the ones that exist
and mentor them and help them
because we all got started somewhere.
OK, another question from a microphone
for.
I'm going to use Skype as an example,
just an example, but my problem
is that all my friends
are hopeless windows users,
gamers, rich people.
And even though I, you know, like we
talk about this security stuff and
especially after the Snowden stuff
happened, and you can
even sometimes convince them to, like,
come along to a protest or whatever I
I find it impossible
to change their habits, which
is basically what this thing is about.
And I feel like I'm in a
position that I have to either choose
either security where I uninstall
Skype and, you know, use
a secure system or
my friends.
Do you have any kind of advice for
this kind of situation?
Well, I have a couple of different pieces
of advice.
The first is this sort
of kind of an
air gapping approach, which is that
if you're a gamer, you should
just have a box that is specifically
devoted to gaming that doesn't touch any
of your other content.
And this is one way to sort of,
again, the harm reduction approach
you're going to game anyway.
So let's just keep it from overlapping
with, you know, your personal data
or the personal data of the people that
you're talking to.
As for getting your friends to use
security and privacy tools or
communication tools that are more secure,
more private, usually
what I do is I will walk my friends
through installing them and then I will
use them with them.
My primary form of sort of everyday
communication to touch base with my
friends tends to be,
you know, instant messaging using
otbr.
And if I
can get somebody talking to me using
instant messaging, using Otbr,
I can get them doing that all the time
and they're in the habit of doing it, and
they have a method of secure
communication with me.
And they know where to find me.
So that's how I do it.
Your mileage may vary,
but like how they do that
since if I make them do it, I'll
be their only contact on
otir or whatever.
You do it with more than one friend.
And then you have your friends talk to
each other using this method, and
eventually it becomes sort of that
primary form of communication.
Usually the way that I start is
if if I get people who are Facebook
messaging me all the time, I try to sort
of, you know, wean them off of it onto
Otere. Just the moment they Facebook
message me. Sorry, I'm not available.
Can you get me on otbr?
OK. Microphone three.
Yeah, actually, I came to this talk
because from the title, I expected
that the internet needs a new security
guide because of what we know from
Edward Snowden.
And you only mentioned briefly the
threat model issue.
You didn't really go into it too
much. So I just wonder if you have any
comment on on.
I mean, is there any way to really
write security guides still
now in the situation where we
are now and what we know now or also will
always, if we do a security guard, say
this only helps against a certain threat.
But the NSA will still get everything
for how do we deal with this?
Well, I think that there are really a
couple of questions that need to be
teased apart here.
The first is, I don't think that Edward
Snowden changed everything.
I think that we know a whole lot more
about what the NSA is up to.
And as a result of learning this,
we have learned that the NSA doesn't know
everything all the time.
So in that sense, the facts on the ground
are actually not that different.
The main difference is that there are a
lot more people who care.
And there are a lot more people who are
confused.
And that's really where a
sort of profusion of
of internet guides could really step
in and help clarify these things.
OK. I'm afraid we're out of
time now.
Once again, it was
mentioned that you can contact her
offline or after the program
for more questions.
I would like to ask you to pick up
your trash as you leave and make
sure you leave the place.
Nice for the next group so the angels
don't have to pick up after you because
we're all just like you and just kind of
doing it for fun anyway.
So keep it fun.
OK, great.
Thank you.
You.
OK.
I guess the structure was quickly
management.
I love work. I'm not busy inside.
Typekit.
Everyone.