Based purely on the number of citizens that would use facebook, I feel various topics of secure use of digital technology should become a focus. The intent of this thread is to store posts of best practices in order that Asgardians who do not naturally think in terms of security can be prevented from making simple, avoidable errors in procedure that would endanger their digital security, and by extension, the nation as a whole.

I heavily encourage to read carefully this post, and any others, and reaching the end of the thread. I will try to avoid technical jargon where possible, and keep information and concepts easy to digest.

True, an opponent of enough skill given enough time will ultimately prevail as the defensive role in this game is the more difficult of the two sides to play, but that doesn't mean this should be made easy for them. Like encryption, the idea isn't to make it impossible, simply that difficult or take that long it isn't even attempted.

Clearly, an important topic in such a realm is that of usernames and passwords. Both of these can commonly leak more information than is warrented, care should be taken to avoid this wherever possible, even more important when a service is "public facing", but that's a privacy issue more than security. The security part is obviously the password - and commonly the human element is a critical failing here. Despite numerous warnings from "security advisers" in multiple locations, for a very long time, people still attempt to use their spouses pets birthday and other rediculously easy to guess(to anyone with any access to various details, the sort of details that litter social, I mean docile media) passwords. The common cause for this is they find it "easier to remember". Even worse, some use dictionary words - and feeding a list of words into a computer to attempt is about as simple as things can get. To combat this I personally augment the system dictionaries with known password lists ensuring that users cannot set themselves a password that will be commonly attempted in a brute force assault. About here I should mention the problem of password recycling. Effectively this is the incredibly poor practice of using a password to one service for another service. Breach of one service, then leads to breach of multiple. Even if you've set a secure password that would survive some intense assault just one of the places losing their user DataBase will result in multiple additional breaches in unreleated services. Again, the reason for this is due to memory issues. A technique I commonly reference when discussing the subject of setting secure passwords is the "XKCD method" (https://xkcd.com/936/). Effectively, it's to combine multiple words, like the example "CorrectHorseBatteryStaple" - I would personally suggest an additional layer, by intersecting numbers/symbols between the words: "£Correct$Horse€Battery⅝Staple" which would drastically increase entropy. It's even more cunning when you use symbols that don't actually appear on the keyboard. These words must be selected at random. Selecting anything with any significance or connection to you, even a few degrees removed, will assuredly fail against anyone with intent of you as a target, and reasonable research skills. There's software that will collect this information, then make "educated guesses" on password formations based on the data input, and common password syntax. Ofc, trying to remember multiple passwords for multiple services fifty or sixty services can become a little encumbersome. I personally advocate KeepassX, a free open source(code it is built from is publicised for inspection) password manager. The idea is that this encrypts all of your passwords into a secured database, which is then as secure as your passphrase, or keyfile if it's locked to that instead, and your ability to keep people from making copies, or otherwise having access to it. There are other similar tools available, but you want to be able to trust the software author for things like not using backdoors, being able to impliment encryption methods in a sane fashion etc, so when selecting one aim for open source and look for cryptography audits. I like keypass because I can trust it's lack of malware and it's use of encryption - further it can populate forms of browsers with details with a click, or copy fields from the database to the buffer for pasting - and then sanitises the buffer after a few seconds. The user can simply adjust a GUI slider to increase entropy of the passwords it can also generate - equivical to commands like "dd if=/dev/urandom bs=1 count=64 | base64 -w 0 | rev | cut -b 2- | rev" which will output a string like: "mfe5qjYwsPj878dIOg2p2VmLEkpkS9b1Sn3PkfDZy/1kx+yT5rJQm2Ip46AuXN20Ua2rM7PCJGys1ZSAh7jchA=" - this sort of password would be impractical to brute force, rememberable to but a few and pretty impossible to be leaked by "shoulder surfing". Even more secure than that is the use of certificates. X.509 certificates (this is related to SSL/TLS -=- HTTPS that secures most banks traffic, almost any sane online service etc) can be generated locally, giving you a private and public key. The private key, as the name suggests, should be protected from external or third party access. The public key however is safe to be viewed by random public. It's possible to get this key signed by a remote service - without the private key leaving the system - and then the remote system can challenge in a way that only the private key can decode, and thusly respond correctly. To secure the use of the private key further it's possible to lock them with a pasphrase. Accounts secured via certificates are almost impossible to brute force.

As this is a long and complicated subject, keeping your passwords secure is only the tip of the iceberg. The most common way people get hacked/infected, up until the onset of IoT at least, is from clicking shady links in spam emails, or docile media. Right behind office(orrifice) documents with infections attached to emails, is the browser itself. The act of visiting a site by default transfers data - you need to get the text, the pictures etc - and commonly this also includes various code. Much of this is benign and simply is things like the HTML of the page construct, but executing random third party code as a default, IMHO, is insanity. You wouldn't just let any random third party drive your car, not without at least asking where they intend going/what doing with. I fail to see why people allow randoms to execute their code on their computers, but I can't explain a lot of things regarding human behaviours. The obvious solution here would be to not execute code as default, and only allow things from sources that you trust to execute. It's possible to obtain plugins like NoScript for firefox, which as the name implies, prevents scripts. It allows for access to execute on a temporary basis, and allows to create whitelists of services you allow in order to become less obtrusive to the end user. It also has some other interesting features, but the critical point is it will stamp on a lot of shady ventures before it can get further than your browser should you inadvertantly or misguidedly click on a link. Even better use a browser like lynx, or edbrowse - That's far too basic for most malicous code to gain traction on.

Continued here to avoid the 10000 char limit to posts.

For another layer of security, consider Virtual Machines to create a sandbox. VM's are digital copies of hardware that are somewhat insulated from the physical hardware. With common houshold hardware it's possible to replicate entire computers, install complete operating systems etc. If you spin up a VM, and then use that for browsing, should it become compromised then you can instantly nuke it with no loss of primary function to your actual machine. I would personally advocate using a seperate VM for each task you do on a computer, and nothing involved with that one task should be able to impact another. A VM used for browsing picks up a piece of ransomware, instead of waiting a few hours to copy your files from backup after sanitising the machine you can simply laugh, kill the VM and spin up another. If you'd imaged it in a fashion that was acceptable to your uses, the replacement could be operable in about the time it takes a computer to boot. There are other advantages to a VM other than sandboxing, one is "modern" malware now commonly attempts to detect if it's operating in a VM and if it is will fail to execute to aid avoiding detection and to prevent observing how it behaves. There are ways to exploit out of a VM and onto bare metal but these are not common techniques and generally the domain of nation state actors. For now. I personally advocate Xen - but there are other free, open source varients such as VirtualBox - which most users new to the subject are likely to find simplest and OpenVZ.

Another piece of kit that is sensible to employ is VPN - Virtual Private Network. It creates a secured(if done correctly) virtual tunnel through the internet(well, networks) that will behave locally as a local connection. The idea is to create an encrypted connection to another machine, and inside that tunnel your data. Commonly this is used to provide access to secured areas - access from "the internet" can be isolated, but "outside" can still get in via the VPN. As this is acting as a gateway on the remote end, it's also possible to have this set to use the interwebs of the remote end. Any point between the end user and the gateway should be secured by the encryption on the tunnel, and multiple users on the gateway can provide for plausable denyability on traffic leaving the exit node. This is almost essential when you are on a public network shared with randoms - say a coffee shop wifi - as they will have access to all your traffic as it passes. It is equally effective to insulate you from your ISP. For such I advocate OpenVPN for it's open source nature, and inherent trustability combined with it's long term reliability. Naturally this will require remote hardware to power the exit node. If it shows sufficient interest, I may thread up for a how-to with such, or get some crowdfunding aboard for remote hardware in order to deploy a globally distributed Asgardian VPN, acessible only to Asgardians. I can't fit you all on mine, I've got a lot of bandwidth, but not that much - I'd need a lot more hardware in a lot more places(someone open a thread somewhere with a proposal? Ministry of Equity and Resources»Resource Acquisition and Management??). This could be potentially additionally used to grant access to "Asgardian only" areas, as well as provide a secure and unobstructed portal to the interwebs. This would not replace existing authentication/security mechanisms, but layer on top of them.

This subject is nowhere near exhausted, I could rant for hours about the invasive malware built into winhoes10 for example, but the above should lead to generally more secure users. There's still much to be adressed, however, and I'd hope this thread will further populate with other advise.

@EyeR, your comment are true and helpfull a lot of people.

If you will like expand the description, you need include some method of second factor authentication.This is a good method to secure more your access whathever you want.

I think we need thinking the architecture of security (and access) for the asgardians to asgardia services. What do you think?

Thanks

hey @EyeR thanks for the Caution with our data , well man if (only if) we could do the AsgardianVPN what the estimated cost ( well a example of how much we will "pay" for it ) and if its not gonna be overloaded with all our information,s ?? do you think that its viable we do something like a program to acess our forum (like a encrypter , it will go like a Add-On in the browser, and it will encrypt the information in the correct way, to download this people need the link that we send for email after he turn in a true asgardian - activate the profile - )

An Asgardian VPN is a worthwhile venture, IMHO. An Asgardian VPN would be able to isolate various Asgardian services from the "public" interwebs, acessible only to Asgardians, allowing for public and private services. If deployed in a similar manner to which I have deployed mine, then access is able to be removed by simply revoking the offending keys. It would also have the advantage of securing the connection to Asgardian services to the point that not even your ISP would know where you are going. Another advantage is you'd be sitting behind the firewall on the VPN. As well as providing protection from inbound threats, it could protect against a healthy range of outbound threats by preventing the connections to invasive services(say, facebook, google's servers they use to rape chrome users etc). It could allow to link all Asgardian machines as per LAN, over the interwebs - but I honestly think that's a security risk, so that functionality shouldn't be implimented.

Email isn't a sensible method to transport secure information. Even if you run the email server. Commonly this transports in plaintext, and equally commonly this traffic is collected en mass. When secure transport is used, you then have to trust this comapny doesn't share the key with third parties(and can keep them from just taking it) - and almost all will yeild this or direct account access on presentation with legal documents like a warrent. I'd personally just deploy servers in another country, rather than hand over user data, but I've noted few can live up to my moral standards.

Sensibly, this key would be cryptographically stored in the digital portion of your passport - potentially either PKCS11 or X.509 - only able to be utilised on input of passphrase only you know. This methodology would require additional hardware for most users in order to be able to read the key. It's not expensive hardware, but it is another barrier to operations. Lack of experience with unsecure technology leads to me being unsure how viable this is to link to 'tardphones - I would imagine "drivers" from some hardware isn't supported - but for actual computers this represents no particular issue.

As a browser add-on this isn't overly clever as other software may take additional paths and "leak", it'd want to be in place for any traffic leaving the system - if wanting this level of security, you'd possibly want to not be using conventinal DNS resolution, instead having the Asgardian VPN provide lookups(DNS being what turns www.whateverbollox.com that humans easily remember into the IP numbers the interwebs actually uses).

As for actual cost... To assume a 50Mbps line minimal to be provided to all, then to work it out using my most expensive server:bandwidth ratio servers, at current population would cost about £2,292,948/month. That sounds like a lot, but that's only £4/head. Again, this is my most expensive(per Mbps) servers. In reality, things like colocation(your hardware in their datacenter, they just power it and keep it connected to interwebs) and getting wider pipes than the lowly 100mbps of those machines would reduce that drastically as more than two people could use the same node. It would also ideally require multiple nodes in geographically distributed locations, meaning not all nodes would possibly be priced the same. My VPN costs me about £4/month to run, and can provide 20x50Mbps pipes. If all nodes could be obtained for such a bargin, then we're talking more £114,648/month -=- About £0.20/head. A significant improvement. That £2.2Mil is just a "worst case" senario. I should mention that even if the VPN is capped @ 50Mbps, then you still won't actually get any extra speed than your host connection can provide. But US users have reported that accessing the interwebs through my VPN is both faster and more reliable than their ISP raw - and going through me they hop the atlantic twice with every transaction.

This doesn't include one-off setup costs some firms may require, cost of additional hardware (about £5-£10/unit) with regards to card readers etc.

To address the "second factor authentication" then it would depend entirely on what this second factor is. If it's another account on another service, then you rely on them keeping that service secure, as much as your secure use of it. That service becomes breached, or they allow third parties access then connected services will let in hostile entities without question. I do like X.509(related to SSL/TLS - which powers the HTTPS connections used to secure e-commerce and banks etc) certificates for auth, these can be locked to passphrase to prevent use from unauthorised parties, and attempting to brute force an account locked by certificate is nigh on impossible. You'll never guess the password because there isn't one.

To setup a VPN just for connecting to Asgardian services, and no external interwebs traffic, then 50Mbps is likely to be overkill until we are streaming media or xferring multi-GB files. This means you could cram (a lot)more users per node - and reduce per-head costs further.

Recently released is: https://github.com/robertfisk/USG/wiki

Costing about $60(Device is open sourced so can construct it yourself) the intention is it sits betwteen a USB device and your computer preventing infected devices from writing their malware to the firmware of your devices or maybe acting as a keyboard and issuing commands at 20MB/s. It's likely a little late for some of you, but such tactics should be rapidly adopted - Even devices new in the packaging may have infected firmwares, this isn't just for some random USB you found on the train, and it's not just for "data" devices like thumbsticks.

For more information of "BadUSB" attacks, https://opensource.srlabs.de/projects/badusb may be of use.

Of similar intent is the "USB Condom", a device that sits inbetween the USB device and the USB socket in order to assure only power flows past it - the intention being that there's now multiple USB charging sockets available in the public domain - and any one of them could be malicous and begin attacking the devices placed into for charge.

A device I've been meaning to develop for some time would be a "Power condom" - Similar to the USB condom it should sit in between your devices and the power socket to ensure only power flows past, not data. Something surely to be of use once the smartmeter epidemic ensures even the power supply cannot be trusted.

This subject needs it's own forum section due to the increasingly broad nature of it, and users. It will help to present easy to find nerd and non-nerd threads.

Some recommended resources with guides and tools for privacy and security.

https://ssd.eff.org

https://www.privacytools.io

https://pack.resetthenet.org

https://guardianproject.info

Remote tools are not intelligent solutions - unless you can absolutely trust them. Even the well intentioned can be compromised. But definitely this is too broad of a topic to gain sufficient justice to a single forum thread - or even it's own board. The feature request I dropped for a wiki could nicely cover the area, over time.

But truely in almost every security model the weak point time after time is the human element. Secure is as secure does. Most attention should focus on usage habits although recent initatives have made good progress in assuring it is also the hardware. And the hardware will operate independantly of the user and the operating system.

I agree entirely, though I never mentioned remote tools I also agree there and never use things like Lastpass for a timely example, even though password generators are constantly being recommended. I create my own random strings and copy them to a book and a USB stick that does not stay connected, but never carry around. Inconvenient and long-winded especially as I regularly change my passwords. There are no purple monkeys in my collection.

Yes indeedy education is the best defence, which is why I posted resources with guides and tutorials aimed at a wide audience. Trusted 3rd party tools are often needed by non-nerds or anyone that will get lost navigating the registry. Then there are services like Steve Gibsons' "Shields-up" that are external and not in your control, but I bet you use it every now and then. The EFF did have a handy chart with many Instant Messengers and their known trustability. Hopefully it will be back soon. Other initiatives like that are much in need.

Staying safe online is as much about the things you don't do (maybe more so), as the things you actively do. The first basics obviously being don't use Microsoft browsers, Flash or Java, and especially never together ! If you don't need Adobe or MS productivity software, then you probably don't need Windows. Many new games are now being released on Linux due to the SDKs available. One of the Mint flavoured Linux's may fit most peoples real requirements.

Lastpass wasn't a good example, for the ½ dozen ways that websites have been historically able to gain contents. If using a password manager, being able to trust it is essential. Generating safe passwords, like: yhAjvEyAxKM0t+cCApIJgPHr4iD9wxLFvhE1vcvo6W6McDKWwO1ufCfun74dLvxzVmHTfcJIa2s24UpToRyjOQ commonly prequisites a password manager. Most people won't remember that one password, let alone one hundred and fifty logins deep, across twelve protocols with regular rotations. The advantages a secure password manager has over your book is native encryption assuring lack of third party use. The USB stick is equally compromised with physical access. For backup purposes, think smaller. MicroSD is remarkably resilient and can be secreted in a high number of locations unlikely to be searched. Like the inside of someone else's letterbox, blue-tacked to the underside of a road sign...

I'd not use services like "shields up" personally - knowing how to operate things like nmap, unicorn scan, iptables etc. and would suggest it's equally of use to the average home user which will be likely sitting behind a router which commonly runs iptables meaning to externally map into the internal network requiring explicit "port forwarding" to allow the "right" traffic to be mapped to the "right" internal machine. The internal network should be natively seperated until expressly allowed for. Unless the OS itself is compromised already, then the likes of "netstat"(think that's common across flavours) should be able to produce lists of active and or listening "services" in order to locally asses the machine. Having an "open port" is meaningless without software "listening" to that port, ready to respond. Like a TV channel - transmission is futile if no-one is tuned in, if you suffer from epilepsy the flashing images on a channel you're not watching should be of no concern. And then it'd ideally be safe to be actually expecting third party input - and if it's not safe, one should question why it is even running. Knowing flashing images are a problem, install filters that don't allow them past or just dont let that person watch channels likely to feature flashing images.

3'rd part apps that meerly replicate builtin functionality should be avoided wherever possible, minimally for the multi-megabyte solution that's already been solved in a few KB. For the example of the registry, what needs to be done that regedit cannot? If the user isn't entirely comfortable with playing inside the registry to the point where regedit itself is confusing then this isn't something likely to be suggested for optimum long term functionality. Interaction should be limited to double clicking a registry key to import the contents, and one would have to question why this isn't being handled by the installer. Even if the user is comfortable ½ the time it's not a good idea. With regards to not doing things being more secure, installing(especially on winhoes) things commonly makes the system less secure. Each line of code is another potential bug introduced, another potential leveragble flaw. This is why firms typically don't allow you to install anything on their hardware, the payload restricted to what it requires to be functional. To ignore things like registry decay and clutter, each thing you install tends to decrease operability - a freshly installed OS booting and handling significantly faster than without this clutter. Such is responsible for around 70% of the "performance detriment" that results in users commonly buying new hardware. The hardware should perform on day 200,000 exactly as it performed on day 2, mechanical component failure aside. When it doesn't you should question what it's additionally doing. With just over 3200 packages installed, this 6 year old laptop performs as well as it does when it left the factory. Slightly better as I've added an SSD.

A behavioural feature commonly exhibited amongst winhoes users is the intentional seeking of things they cannot legitimately pay for, and consequentially various ways to mitigate the security attached to these products. From an attacking perspective this represents the easiest way to ensure your malware will be executed, with elevated privliges. Anti-virus "solutions" commonly can only detect things they have previously seen, and the "fingerprint list" of things it has seen does have various things intentionally removed - but distrubingly in an easy 70%+ of cases even if alerted to presence of malware(and many fingerprint things like keygen algorythms, not actually harmful content. This simply suggests you need to find something you can trust to not deliver intentionally false positives, because what else is it being intentionally false about?) simply elect to ignore it, or override the security in place to allow it to infect.

Although I'd definitely suggest Mint for a first forray into linux for someone who's never used *nix before, I'm nowhere near as intimate with that project as I once was. I've only really used Mint myself a long ago for a week when I needed something "clean" to run on a pile of scrap I'd made into a computer to tide me over whilst some real hardware gets delivered. I'd suggest using to get used to the way it handles and to remove the fear of the unknown that inhibits most from the attempt - a live disc is great for this - then consider something else possibly. Most other distributions have adopted and have spins with the Cinnamon interface - else it's trivially installed - if that's all you're really after.