Difference between revisions of "Digital security workshop Les Dégommeuses - Paris"
From Gender and Tech Resources
(Tag: VisualEditor) |
|||
| Line 6: | Line 6: | ||
== So what ? == | == So what ? == | ||
| − | * Holistic security : Physical security + Psycho-social security + digital security | + | * '''Holistic security''' : Physical security + Psycho-social security + digital security |
| − | * A global recipe : Autonomous infrastructures - Free Libre Open Source Softwares - end to end encryption | + | * '''A global recipe''' : Autonomous infrastructures - Free Libre Open Source Softwares - end to end encryption |
| − | * Make some noise ! encrypt to increase the cost of surveillance | + | * '''Make some noise !''' encrypt to increase the cost of surveillance |
== Mapping activities and risks == | == Mapping activities and risks == | ||
| − | ''' | + | '''Cloud of ideas and words related to security''' > questions to establish a baseline of privacy and security knowledge |
== Draw your tech day == | == Draw your tech day == | ||
| − | Draw your interactions with your digital devices, from the morning to the moment you go to bed, including what kind of data you receive, you produce, you transfert and exchange with other people | + | '''Draw your interactions with your digital devices''', from the morning to the moment you go to bed, including what kind of data you receive, you produce, you transfert and exchange with other people |
== Ask yourself good questions == | == Ask yourself good questions == | ||
| Line 24: | Line 24: | ||
# '''Connect safely to the internet''': When going online, especially if you are transmitting personal data and passwords, it is crucial to always use an encrypted connection which ensures that your data cannot be seen by anyone as it travels from your computer to the website you are visiting or to the service you are using. | # '''Connect safely to the internet''': When going online, especially if you are transmitting personal data and passwords, it is crucial to always use an encrypted connection which ensures that your data cannot be seen by anyone as it travels from your computer to the website you are visiting or to the service you are using. | ||
# '''Anonymise your connections''': There are sometimes good reasons to hide your physical location and your internet activities. Tor browser anonymises your connections when you're browsing the internet, by hiding the sites you are visiting from your internet service provider, and hiding your location from the sites you visit. | # '''Anonymise your connections''': There are sometimes good reasons to hide your physical location and your internet activities. Tor browser anonymises your connections when you're browsing the internet, by hiding the sites you are visiting from your internet service provider, and hiding your location from the sites you visit. | ||
| − | # '''Secure your communications''': you might want to consider tools you can use and ways you can change your | + | # '''Secure your communications''': you might want to consider tools you can use and ways you can change your behavior to increase your security when using mobile phones as well as options for email and instant messaging |
# '''Practice self-care''': Nothing is secure if we only think about technology and we neglect our wellbeing. If you are exhausted, stressed or burnt out, you might make mistakes that impair your security. | # '''Practice self-care''': Nothing is secure if we only think about technology and we neglect our wellbeing. If you are exhausted, stressed or burnt out, you might make mistakes that impair your security. | ||
'''You should repeat periodically this exercise of permanent risk analysis so as to update the threat model and the answers you could put into practice''' | '''You should repeat periodically this exercise of permanent risk analysis so as to update the threat model and the answers you could put into practice''' | ||
| − | == Secure your devices and | + | == Secure your devices and data == |
=== Computer === | === Computer === | ||
| − | * Switch your computer to linux ;) | + | * '''Switch your computer to linux''' ;) |
| − | * Protect your computer against malware and virus https://securityinabox.org/en/guide/malware | + | * '''Protect your computer against malware and virus''' https://securityinabox.org/en/guide/malware |
| − | * Protect your information from physical threats https://securityinabox.org/en/guide/physical | + | * '''Protect your information from physical threats''' https://securityinabox.org/en/guide/physical |
| − | * Create and maintain secure passwords https://securityinabox.org/en/guide/passwords | + | * '''Create and maintain secure passwords''' https://securityinabox.org/en/guide/passwords |
| − | * Destroy sensitive information https://securityinabox.org/en/guide/destroy-sensitive-information | + | * '''Destroy sensitive information''' https://securityinabox.org/en/guide/destroy-sensitive-information |
=== Mobile phone / tablet === | === Mobile phone / tablet === | ||
| − | *Use mobile phones as securely as possible https://securityinabox.org/en/guide/mobile-phones | + | *'''Use mobile phones as securely as possible''' https://securityinabox.org/en/guide/mobile-phones |
| − | *Use smartphones as securely as possible https://securityinabox.org/en/guide/smartphones | + | *'''Use smartphones as securely as possible''' https://securityinabox.org/en/guide/smartphones |
| − | *Encrypt your mobile phone, basic Android security setup guide https://securityinabox.org/en/guide/basic-setup/android | + | *'''Encrypt your mobile phone''', basic Android security setup guide https://securityinabox.org/en/guide/basic-setup/android |
== What is Internet ? == | == What is Internet ? == | ||
| − | A network of networks of computers : Your computer > Internet Service Provider > router > gateway > backbone > sever serveur / routeur | + | '''A network of networks of computers''' : Your computer > Internet Service Provider > router > gateway > backbone > sever serveur / routeur |
* http://maps.level3.com/default/ ou http://www.submarinecablemap.com/#/landing-point/marseille-france | * http://maps.level3.com/default/ ou http://www.submarinecablemap.com/#/landing-point/marseille-france | ||
* http://www.teliasoneraicmap.com/ | * http://www.teliasoneraicmap.com/ | ||
| Line 51: | Line 51: | ||
=== What is an IP address ? === | === What is an IP address ? === | ||
| − | An IP address identify your computer inside a local network (it is a private IP, for example 192.168.1.101), then your internet box provide you a public IP address connected to Internet (for example 82.239.0.211). Each network devices is identfied by a unique physical address called the MAC address (for example f4:6d:04:3a:ef:55) | + | '''An IP address identify your computer inside a local network''' (it is a private IP, for example 192.168.1.101), then your internet box provide you '''a public IP address''' connected to Internet (for example 82.239.0.211). Each network devices is identfied by a unique physical address called the MAC address (for example f4:6d:04:3a:ef:55) |
* visualize your ip address and the geolocalization of your computer http://whatismyipaddress.com/ | * visualize your ip address and the geolocalization of your computer http://whatismyipaddress.com/ | ||
* demo traceroute : visualize where your traffic is going http://www.yougetsignal.com/tools/visual-tracert/ | * demo traceroute : visualize where your traffic is going http://www.yougetsignal.com/tools/visual-tracert/ | ||
| − | == How the | + | == How the data are circulating in the network == |
If you tried the previous link, you can see that your request reach a server that can be on the other side if the world. But there are third parties that collect informations and datas on your navigation, most of the time to gather informations about you and to sell it for commercial purposes (we call them data brokers), so in function of the website, one single request can be tracked by up to more than twenty other companies ... | If you tried the previous link, you can see that your request reach a server that can be on the other side if the world. But there are third parties that collect informations and datas on your navigation, most of the time to gather informations about you and to sell it for commercial purposes (we call them data brokers), so in function of the website, one single request can be tracked by up to more than twenty other companies ... | ||
* https://trackography.org/ > Choose a country and a newspaper and see who is collecting data when you go to this website | * https://trackography.org/ > Choose a country and a newspaper and see who is collecting data when you go to this website | ||
| − | === | + | === Internet role play === |
| − | ''' | + | '''Each person become an element of the network :''' |
| − | + | * Computer A | |
| − | + | * ISP box at home | |
| − | + | * Gateway to Internet | |
| − | + | * Backbone | |
| + | * Trans-oceanic cable | ||
| + | * Gmail server | ||
| + | * Autonomous Tchat server | ||
| + | * Public wifi access point | ||
| + | * Computer B | ||
| + | '''Now, let's send a "normal" e-mail from computer A to computer B and let's see who can read what between metadatas and the content of the mail. Repeat the exercise with an encrypted e-mail, with a normal tchat and an encrypted tchat''' | ||
| − | + | == Reduce your digital shadow == | |
| + | === The web - Browser and plug-ins === | ||
| + | * To remove adds : ublock origin https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ | ||
| + | * To prevent tracking : betterprivacy https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/ | ||
| + | * To reduce our digital shadow : Privacy Badger https://www.eff.org/privacybadger | ||
| + | * To use as much as possible encrypted communication between our computer and the server : HTTP'''S''' everywhere https://www.eff.org/https-everywhere | ||
| + | * To avoid viruses from web pages and javascript https://noscript.net/ | ||
| + | * To avoid viruses from Flash content : flashblock https://addons.mozilla.org/en-US/firefox/addon/flashblock/ | ||
| − | = | + | === Alternative search engines === |
| − | == | + | '''To add a new search engine to Firefox''', see https://support.mozilla.org/en-US/kb/add-or-remove-search-engine-firefox |
| − | + | * https://duckduckgo.com/ see also the bangs https://duckduckgo.com/bang : if you add "!w" to your request, it will search directly on wikipedia | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
| − | * https://duckduckgo.com/ | + | |
* https://www.qwant.com/ | * https://www.qwant.com/ | ||
* https://startpage.com/ | * https://startpage.com/ | ||
| − | * https:// | + | * https://searx.laquadrature.net/ meta hackable search engine |
[[File:framabee.png|900px|centré]] | [[File:framabee.png|900px|centré]] | ||
| − | == Evaluer la traçabilité de sa configuration navigateur + OS == | + | === Evaluer la traçabilité de sa configuration navigateur + OS === |
le "fingerprinting" permet de nous identifier à partir de la combinaison : système d'exploitation, navigateur et ses configurations et extensions, taille de l'écran ... | le "fingerprinting" permet de nous identifier à partir de la combinaison : système d'exploitation, navigateur et ses configurations et extensions, taille de l'écran ... | ||
* tester l'unicité de sa config : Panopticlick http://panopticlick.eff.org/ | * tester l'unicité de sa config : Panopticlick http://panopticlick.eff.org/ | ||
| − | == Supprimer les métadonnées des fichiers== | + | === Supprimer les métadonnées des fichiers=== |
Les métadonnées sont des données associées au fichier lui-même, une pĥoto peut par exemple intégrer des données de géolocalisation, le nom de l'auteur, le logiciel utilisé pour la traiter, la définition de l'appareil photo, ... voir https://blog.mathiasblanchemanche.ch/2015/10/21/Anonymiser%20les%20m%C3%A9tadonn%C3%A9es%20d'un%20fichier.html | Les métadonnées sont des données associées au fichier lui-même, une pĥoto peut par exemple intégrer des données de géolocalisation, le nom de l'auteur, le logiciel utilisé pour la traiter, la définition de l'appareil photo, ... voir https://blog.mathiasblanchemanche.ch/2015/10/21/Anonymiser%20les%20m%C3%A9tadonn%C3%A9es%20d'un%20fichier.html | ||
* utilisation de l'outil [http://sourceforge.net/projects/exiftool/ Exiftool] : | * utilisation de l'outil [http://sourceforge.net/projects/exiftool/ Exiftool] : | ||
Revision as of 10:32, 21 June 2016
Contents
- 1 Issues about Security, Privacy, Anonymity
- 2 So what ?
- 3 Mapping activities and risks
- 4 Draw your tech day
- 5 Ask yourself good questions
- 6 Secure your devices and data
- 7 What is Internet ?
- 8 How the data are circulating in the network
- 9 Reduce your digital shadow
- 10 Utiliser les emails de façon plus sure
- 11 Discuter en direct en texte > chat
- 12 Discuter en direct en texte, audio, vidéo
- 13 Préserver son anonymat, contourner la censure
- 14 Installer, administrer son propre serveur pour garder le contrôle sur ses données=
- 15 Utiliser des réseaux sociaux
- 16 Téléphone mobile / intelligent
- 17 Libérer son téléphone
- 18 Synthèse des bonnes pratiques
- 19 Identifying good resources
Issues about Security, Privacy, Anonymity
- Datas and states
- Datas and companies
- Datas and citizens
- Datas and art
So what ?
- Holistic security : Physical security + Psycho-social security + digital security
- A global recipe : Autonomous infrastructures - Free Libre Open Source Softwares - end to end encryption
- Make some noise ! encrypt to increase the cost of surveillance
Mapping activities and risks
Cloud of ideas and words related to security > questions to establish a baseline of privacy and security knowledge
Draw your tech day
Draw your interactions with your digital devices, from the morning to the moment you go to bed, including what kind of data you receive, you produce, you transfert and exchange with other people
Ask yourself good questions
- Read up and educate yourself about your country's internet laws and policies. Some security technologies such as encryption are illegal in some countries, for example.
- Inform yourself about your country's laws and policies in relation to freedom of expression, right to privacy and against online and offline harassment. Those laws do not exist in all countries, and when they exist they are not framed and applied in the same way.
- Keep your computer and devices clean and healthy: Updating your software, running a firewall, and protecting yourself from virus infection are fundamental to the security of your data
- Map your data: What kind of data do you produce and/or manage? With whom? Where is this data stored? Which devices or online platforms hold your data? Most importantly, how sensitive is your data and what would happen if this particular data suddenly disappeared or was seen and copied by a third party?
- Secure your data: Especially where our data is stored online, it is crucial to choose strong passwords, or better passphrases, and to use a different one for each of our accounts.
- Connect safely to the internet: When going online, especially if you are transmitting personal data and passwords, it is crucial to always use an encrypted connection which ensures that your data cannot be seen by anyone as it travels from your computer to the website you are visiting or to the service you are using.
- Anonymise your connections: There are sometimes good reasons to hide your physical location and your internet activities. Tor browser anonymises your connections when you're browsing the internet, by hiding the sites you are visiting from your internet service provider, and hiding your location from the sites you visit.
- Secure your communications: you might want to consider tools you can use and ways you can change your behavior to increase your security when using mobile phones as well as options for email and instant messaging
- Practice self-care: Nothing is secure if we only think about technology and we neglect our wellbeing. If you are exhausted, stressed or burnt out, you might make mistakes that impair your security.
You should repeat periodically this exercise of permanent risk analysis so as to update the threat model and the answers you could put into practice
Secure your devices and data
Computer
- Switch your computer to linux ;)
- Protect your computer against malware and virus https://securityinabox.org/en/guide/malware
- Protect your information from physical threats https://securityinabox.org/en/guide/physical
- Create and maintain secure passwords https://securityinabox.org/en/guide/passwords
- Destroy sensitive information https://securityinabox.org/en/guide/destroy-sensitive-information
Mobile phone / tablet
- Use mobile phones as securely as possible https://securityinabox.org/en/guide/mobile-phones
- Use smartphones as securely as possible https://securityinabox.org/en/guide/smartphones
- Encrypt your mobile phone, basic Android security setup guide https://securityinabox.org/en/guide/basic-setup/android
What is Internet ?
A network of networks of computers : Your computer > Internet Service Provider > router > gateway > backbone > sever serveur / routeur
- http://maps.level3.com/default/ ou http://www.submarinecablemap.com/#/landing-point/marseille-france
- http://www.teliasoneraicmap.com/
- http://www.vox.com/a/internet-maps 40 maps that explain the internet
- https://www.sprint.net/images/network_maps/full/Global-Global-IP.png
What is an IP address ?
An IP address identify your computer inside a local network (it is a private IP, for example 192.168.1.101), then your internet box provide you a public IP address connected to Internet (for example 82.239.0.211). Each network devices is identfied by a unique physical address called the MAC address (for example f4:6d:04:3a:ef:55)
- visualize your ip address and the geolocalization of your computer http://whatismyipaddress.com/
- demo traceroute : visualize where your traffic is going http://www.yougetsignal.com/tools/visual-tracert/
How the data are circulating in the network
If you tried the previous link, you can see that your request reach a server that can be on the other side if the world. But there are third parties that collect informations and datas on your navigation, most of the time to gather informations about you and to sell it for commercial purposes (we call them data brokers), so in function of the website, one single request can be tracked by up to more than twenty other companies ...
- https://trackography.org/ > Choose a country and a newspaper and see who is collecting data when you go to this website
Internet role play
Each person become an element of the network :
- Computer A
- ISP box at home
- Gateway to Internet
- Backbone
- Trans-oceanic cable
- Gmail server
- Autonomous Tchat server
- Public wifi access point
- Computer B
Now, let's send a "normal" e-mail from computer A to computer B and let's see who can read what between metadatas and the content of the mail. Repeat the exercise with an encrypted e-mail, with a normal tchat and an encrypted tchat
Reduce your digital shadow
The web - Browser and plug-ins
- To remove adds : ublock origin https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
- To prevent tracking : betterprivacy https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/
- To reduce our digital shadow : Privacy Badger https://www.eff.org/privacybadger
- To use as much as possible encrypted communication between our computer and the server : HTTPS everywhere https://www.eff.org/https-everywhere
- To avoid viruses from web pages and javascript https://noscript.net/
- To avoid viruses from Flash content : flashblock https://addons.mozilla.org/en-US/firefox/addon/flashblock/
Alternative search engines
To add a new search engine to Firefox, see https://support.mozilla.org/en-US/kb/add-or-remove-search-engine-firefox
- https://duckduckgo.com/ see also the bangs https://duckduckgo.com/bang : if you add "!w" to your request, it will search directly on wikipedia
- https://www.qwant.com/
- https://startpage.com/
- https://searx.laquadrature.net/ meta hackable search engine
le "fingerprinting" permet de nous identifier à partir de la combinaison : système d'exploitation, navigateur et ses configurations et extensions, taille de l'écran ...
- tester l'unicité de sa config : Panopticlick http://panopticlick.eff.org/
Supprimer les métadonnées des fichiers
Les métadonnées sont des données associées au fichier lui-même, une pĥoto peut par exemple intégrer des données de géolocalisation, le nom de l'auteur, le logiciel utilisé pour la traiter, la définition de l'appareil photo, ... voir https://blog.mathiasblanchemanche.ch/2015/10/21/Anonymiser%20les%20m%C3%A9tadonn%C3%A9es%20d'un%20fichier.html
- utilisation de l'outil Exiftool :
Pour demander au logiciel de remplacer toutes les informations contenues dans les métadonnées par “petit chaton” (remarquez l’originalité) tout en écrasant la donnée originale :
exiftool "-all:all=petit chaton" -overwrite_original *.ogg
Utiliser les emails de façon plus sure
Fournisseurs de courriels sympathiques
- https://help.riseup.net/
- http://no-log.org/
- http://autistici.org
- https://www.openmailbox.org/
- https://protonmail.ch/ too fresh ?
- https://mailinabox.email/
- https://tutanota.com/fr/ too fresh ?
- https://whiteout.io too fresh ?
- https://eu.ixquick.com/startmail/c/ mail encrypté facile à mettre en oeuvre (payant)
- https://www.newmanity.com/ une boite française, gratuit pour les particuliers
Utiliser des mails jetables
- https://www.guerrillamail.com/
- https://www.sharklasers.com/
- http://maildrop.cc/
- http://throwawaymail.com/
- http://yopmail.com/
- http://clipmail.eu
- https://addons.mozilla.org/fr/firefox/addon/bloody-vikings/
Chiffrer ses mails avec PGP
Il convient de combiner un client mail type Thunderbird et le plug-in enigmail :
- PGP avec enigmail et thunderbird https://securityinabox.org/fr/thunderbird_utiliserenigmail
- Tutoriel pour chiffrer ses mails de la FSF https://emailselfdefense.fsf.org/fr/
- https://securityinabox.org/fr/thunderbird_utiliserenigmail
- http://lehollandaisvolant.net/tuto/gpg/
Ressources PGP :
- https://futureboy.us/pgp.html
- expiration http://www.g-loaded.eu/2010/11/01/change-expiration-date-gpg-key/
- compléments http://rys.io/en/147
- 15 reasons not to start using PGP http://secushare.org/PGP
Services de communication et d’échange
Utiliser des services alternatifs aux services commerciaux, idéalement FLOSS (Free/Libre Open Source → Logiciels Libres), afin de remplacer skype, dropbox, doodle, google doc, ... :
- Dégoogleisons Internet : https://framasoft.org/ voir les services proposés https://degooglisons-internet.org/list
Discuter en direct en texte > chat
- pidgin associé à OTR https://otr.cypherpunks.ca/
- https://crypto.cat/
- https://pond.imperialviolet.org/
- https://ricochet.im/
- https://blog.torproject.org/blog/tor-messenger-beta-chat-over-tor-easily
Discuter en direct en texte, audio, vidéo
- chat et visioconférence avec jit.si https://jitsi.org/Main/Download / installation : https://jitsi.org/Documentation/SetUpJitsiAccount / ouvrir un compte https://jit.si/
- ou directement dans le navigateur : https://meet.jit.si/ ou https://www.mozilla.org/fr/firefox/hello/
- voir également Tox qui est supposé remplacer skype https://tox.im/fr
Préserver son anonymat, contourner la censure
En utilisant Tor (The Onion Router, outil pour anonymiser certaines connexions), Tails (Système Linux orienté anonymat), un VPN (connexion chiffrée entre 2 points : soi-même et son founisseur de VPN)
- Pour utiliser TOR : https://www.torproject.org/projects/torbrowser.html.en
- Pour utiliser TAILS : https://tails.boum.org/install/index.fr.html
- Pour utiliser un VPN : http://fr.flossmanuals.net/comment-contourner-la-censure-sur-internet/services-vpn/ ou via Riseup https://help.riseup.net/fr/vpn
Comprendre la différence entre anonymisation et chiffrement
- video gpg tactical tech https://tacticaltech.org/projects/decrypting-encryption https://vimeo.com/132517596
- tor browser : explique comment Tor peut vous permettre de cacher votre géolocalisation https://www.youtube.com/user/TheTorProject
Questionner la limite de ces outils : qui possède les serveurs ? qui développe les algo de cryptage ? qui a inventé ssh ?
Installer, administrer son propre serveur pour garder le contrôle sur ses données=
- en louant un serveur http://ovh.com ou mutualiser un serveur associatif http://www.marsnet.org (Marseille)
- Liste des hébergeurs associatif/alternatif en France voir http://www.hebergeurslibres.net
- en s'autohébergeant https://freedomboxfoundation.org/
- Yunohost : Serveur in a box ou comment avoir un serveur de mail, de blog et autres outils facilement sur Raspberry Pi et + https://yunohost.org
- A compléter avec le projet "La brique Internet" qui permet d'avoir différents points d'accès sans fils chez soi passant par Tor, un VPN ou en direct http://labriqueinter.net/
Utiliser des réseaux sociaux
Se poser les bonnes questions
Quel est le modèle économique du site sur lequel je m'inscris ? Qu'est-ce qui lui permet d'exister ?
Réglages des paramètres de confidentialité, mots de passe sûrs à changer, utilisation d'https
Bien déterminer quel type d’informations on publie, obtenir l’accord de tiers :
- qui peut voir l’information que je mets en ligne
- qui est le propriétaire de l’information que je publie sur le site de réseautage social
- quels renseignements à mon sujet mes contacts peuvent-ils transférer à d’autres parties
- Est-ce que mes contacts sont à l’aide avec le fait que je partage leurs renseignements avec d’autres
- Fais-je bien confiance à toutes les personnes avec qui je suis en réseau ?
Même en ne s'inscrivant pas, des plateformes (Facebook, linkdin) créent des "shadow profiles" à notre insu
Gare à la création de comptes sur d’autres plateforme avec son compte facebook, google
Choisir entre 4 types d’identité
- ton nom réel : plus facilement identifiable mais génére de la crédibilité et influence
- anonymat : permet des expressions d'opinion sur des questions mal vues et sensibles, option la plus difficle à maintenir, peu d'opportunité de générer un réseau de solidarité
- identité pseudonymique : risque d'identification dans le monde réel, mais possible
- pseudonymat collectif : identité collective anonymous guerilla girl, risque si un membre du collectif fait des bêtises, nourrir les imaginaires et les actions avec cette identité collective
4 stratégies pour altérer son ombre digitale
Les différents niveaux stratégiques : installation de programme et d'appli, génération de contenus et de meta-données (explication de la différence), utilisation de dispositifs matériels (comment on se connecte au net)
- fortification : créer des barrières, restreindre l'accès et la visibilité, monitorer qui te suit qui tente de compromettre, creer des comptes ds tous les medias sociaux pour baliser le terrain, antivirus et spyware à jour, quarantaine, chiffrer, cacher ta webcam, migrer vers os plus surs comme gnu/linux
- réduction : moins c'est mieux, combiner tactiques pour générer un manque de données sur soi : nettoyer et éliminer comptes et profils non-utilisés, ignorer et bloquer des applications et services digitaux non nécessaires, résister à la publication d'images et d'infos sur soi et son collectif, utiliser des vieux devices
- obfuscation ou camouflage : plus de données tu génère, c'est le mieux : dévaluer la valeur de l'info, rompre les routine de navigation (apps et plug in), générer du bruit avec son identité (ouvrir différents comptes avec x identités), se cahcer dans la mutlitude ou ds identité collective (bien lire le zen manual), ne pas contaminer, créer des personnages crédibles (voir fakena ds zen manual pr créa id crédibles
- compartimentation : bien compartimenter tes données, tes identités : bien déterminer ses domaines sociaux et bien les compartimenter, maintenir séparés, isoler la surface d'attaque
Téléphone mobile / intelligent
Fonctionnement de la téléphonie, triangulation, autorisation des applications, metadonnées, OS alternatifs, applications signées, rooting et jailbreaking
Chiffrer son téléphone, mot de passe sur, utiliser des applications libres
Logiciels à recommander pour la communication et l’échange
- Voir le magasin d'applications libres de droits http://f-droid.org/
- Voir particulièrement les applications proposées par https://guardianproject.info/
Logiciels mobiles réputés sures (au 06 2016)
- SMSSecure
- Signal
- Telegraph et Snapchat qui ne sont pas libres mais chiffrent de bout en bout
- Orbot + Orweb (naviteur type Tor bundle)
- keepassDroid
- Android Privacy Guard (chiffrement d'emails)
- Obscuracam pour occulter les visages
Libérer son téléphone
- Libérer son Android : http://fsfe.org/campaigns/android/liberate.fr.html + http://www.gnu.org/philosophy/android-and-users-freedom.html
Synthèse des bonnes pratiques
Backup, phrases de passes solides, utilisation de logiciels FLOSS, Infrastructure autonome sympathique (Yunohost, services non commerciaux), sécurité holistique, actualisation de l’évaluation des risques, réseau de confiance, Safe spaces
Qu'est que l'on commence, qu'est que l'on arrête, qu'est-ce que l'on continue de faire ?
- Start
- Stop
- Keep
Évaluation de l’atelier
Identifying good resources
- Security in a box https://securityinabox.org/ tools revised by a pool of digital security trainers, download the software from there
- Me and my shadow https://myshadow.org/ tips for mobile phone and browser
- Zen manual https://gendersec.tacticaltech.org/wiki/index.php/Complete_manual focused on the gender and tech question : on-line identities, safe spaces, ...
- Holistic security : Physical security, Psycho-social security, digital security https://holistic-security.tacticaltech.org/
- About Dating apps : https://www.eff.org/deeplinks/2012/02/comparing-privacy-and-security-online-dating-sites http://www.forbrukerradet.no/appfail-en/ https://grindrmap.neocities.org/overview.html
- A webserie about privacy, big data, surveillance ... "Do not track me" https://donottrack-doc.com/en/episodes/