Difference between revisions of "Digital security workshop Les Dégommeuses - Paris"

From Gender and Tech Resources

(Let's ask some good questions)
Line 150: Line 150:
 
== Social network ==
 
== Social network ==
 
=== Let's ask some good questions ===
 
=== Let's ask some good questions ===
'''Quel est le modèle économique du site sur lequel je m'inscris ? Qu'est-ce qui lui permet d'exister ? '''
+
'''How is the web service on which I'm willing to sign in is earning money ? What is its economical model ? '''
  
'''Réglages des paramètres de confidentialité''', mots de passe sûrs à changer, utilisation d'https
+
'''Set up the privacy settings of your account''', strong passwords, use d'https
  
'''Bien déterminer quel type d’informations on publie''', obtenir l’accord de tiers :
+
'''Define which kind of information you are publishing''', did everybody agreed ?  :
*qui peut voir l’information que je mets en ligne
+
*who can see the informations I published
*qui est le propriétaire de l’information que je publie sur le site de réseautage social
+
*Who is the owner of the information I published
*quels renseignements à mon sujet mes contacts peuvent-ils transférer à d’autres parties
+
*What kind of personal informations can I transfer to other people
*Est-ce que mes contacts sont à l’aide avec le fait que je partage leurs renseignements avec d’autres
+
*Are my contacts ok with the fact that I share informations about them with others ?
*Fais-je bien confiance à toutes les personnes avec qui je suis en réseau ?
+
*Do I trust all the persons with which I'm in contact ?
 
+
Consider that event if you are not inscribed on Facebook, Facebook will build a shadow profile about you (Friends inviting me on facebook ...), be careful when using your Facebook or google account to sign in another web service
Même en ne s'inscrivant pas, des plateformes (Facebook, linkdin) créent des "shadow profiles" à notre insu
+
 
+
Gare à la création de comptes sur d’autres plateforme avec son compte facebook, google
+
  
 
=== Choisir entre 4 types d’identité ===
 
=== Choisir entre 4 types d’identité ===

Revision as of 11:13, 21 June 2016

Issues about Security, Privacy, Anonymity

  • Datas and states
  • Datas and companies
  • Datas and citizens
  • Datas and art

So what ?

  • Holistic security : Physical security + Psycho-social security + digital security
  • A global recipe : Autonomous infrastructures - Free Libre Open Source Softwares - end to end encryption
  • Make some noise ! encrypt to increase the cost of surveillance

Mapping activities and risks

Cloud of ideas and words related to security > questions to establish a baseline of privacy and security knowledge

Draw your tech day

Draw your interactions with your digital devices, from the morning to the moment you go to bed, including what kind of data you receive, you produce, you transfert and exchange with other people

Ask yourself good questions

  1. Read up and educate yourself about your country's internet laws and policies. Some security technologies such as encryption are illegal in some countries, for example.
  2. Inform yourself about your country's laws and policies in relation to freedom of expression, right to privacy and against online and offline harassment. Those laws do not exist in all countries, and when they exist they are not framed and applied in the same way.
  3. Keep your computer and devices clean and healthy: Updating your software, running a firewall, and protecting yourself from virus infection are fundamental to the security of your data
  4. Map your data: What kind of data do you produce and/or manage? With whom? Where is this data stored? Which devices or online platforms hold your data? Most importantly, how sensitive is your data and what would happen if this particular data suddenly disappeared or was seen and copied by a third party?
  5. Secure your data: Especially where our data is stored online, it is crucial to choose strong passwords, or better passphrases, and to use a different one for each of our accounts.
  6. Connect safely to the internet: When going online, especially if you are transmitting personal data and passwords, it is crucial to always use an encrypted connection which ensures that your data cannot be seen by anyone as it travels from your computer to the website you are visiting or to the service you are using.
  7. Anonymise your connections: There are sometimes good reasons to hide your physical location and your internet activities. Tor browser anonymises your connections when you're browsing the internet, by hiding the sites you are visiting from your internet service provider, and hiding your location from the sites you visit.
  8. Secure your communications: you might want to consider tools you can use and ways you can change your behavior to increase your security when using mobile phones as well as options for email and instant messaging
  9. Practice self-care: Nothing is secure if we only think about technology and we neglect our wellbeing. If you are exhausted, stressed or burnt out, you might make mistakes that impair your security.

You should repeat periodically this exercise of permanent risk analysis so as to update the threat model and the answers you could put into practice

Secure your devices and data

Computer

Mobile phone / tablet

What is Internet ?

A network of networks of computers : Your computer > Internet Service Provider > router > gateway > backbone > sever serveur / routeur

900px|centré

What is an IP address ?

An IP address identify your computer inside a local network (it is a private IP, for example 192.168.1.101), then your internet box provide you a public IP address connected to Internet (for example 82.239.0.211). Each network devices is identfied by a unique physical address called the MAC address (for example f4:6d:04:3a:ef:55)

How the data are circulating in the network

If you tried the previous link, you can see that your request reach a server that can be on the other side if the world. But there are third parties that collect informations and datas on your navigation, most of the time to gather informations about you and to sell it for commercial purposes (we call them data brokers), so in function of the website, one single request can be tracked by up to more than twenty other companies ...

Internet role play

Each person become an element of the network :

  • Computer A
  • ISP box at home
  • Gateway to Internet
  • Backbone
  • Trans-oceanic cable
  • Gmail server
  • Autonomous Tchat server
  • Public wifi access point
  • Computer B

Now, let's send a "normal" e-mail from computer A to computer B and let's see who can read what between metadatas and the content of the mail. Repeat the exercise with an encrypted e-mail, with a normal tchat and an encrypted tchat

Reduce your digital shadow

The web - Browser and plug-ins

Alternative search engines

To add a new search engine to Firefox, see https://support.mozilla.org/en-US/kb/add-or-remove-search-engine-firefox

centré

Evaluate the traceability of your system and browser

the "fingerprinting" allow one to identify us in function of our configuration : operating system, browser configuration, plug-ins, size of our screen, ...

Remove metadata from files

Metadata are included in pictures, text documents, videos, and can include geolocalization, the name of the autor and many more informations

To remove metadata :

exiftool "-all:all=petit chaton" -overwrite_original *.ogg

Use emails in a safer way

Alternative email providers

Disposable emails

Encrypt mails with PGP

With a combination of thunderbird and enigmail plug-in  :

Communication and exchange services

Let's use alternative services without any commercial purposes FLOSS (Free/Libre Open Source), to replace skype, dropbox, doodle, google doc, ... :

500px|centré

Tchat

centré

Visioconference

Preserve your anonymity, circumvent censorship

Use Tor (The Onion Router), Tails (Live Linux amnesic operating system), a VPN (create a tunnel between you and your vpn provider)

Understand the difference between encryption and anonymity

Social network

Let's ask some good questions

How is the web service on which I'm willing to sign in is earning money ? What is its economical model ?

Set up the privacy settings of your account, strong passwords, use d'https

Define which kind of information you are publishing, did everybody agreed ?  :

  • who can see the informations I published
  • Who is the owner of the information I published
  • What kind of personal informations can I transfer to other people
  • Are my contacts ok with the fact that I share informations about them with others ?
  • Do I trust all the persons with which I'm in contact ?

Consider that event if you are not inscribed on Facebook, Facebook will build a shadow profile about you (Friends inviting me on facebook ...), be careful when using your Facebook or google account to sign in another web service

Choisir entre 4 types d’identité

  • ton nom réel : plus facilement identifiable mais génére de la crédibilité et influence
  • anonymat : permet des expressions d'opinion sur des questions mal vues et sensibles, option la plus difficle à maintenir, peu d'opportunité de générer un réseau de solidarité
  • identité pseudonymique : risque d'identification dans le monde réel, mais possible
  • pseudonymat collectif : identité collective anonymous guerilla girl, risque si un membre du collectif fait des bêtises, nourrir les imaginaires et les actions avec cette identité collective

4 stratégies pour altérer son ombre digitale

Les différents niveaux stratégiques : installation de programme et d'appli, génération de contenus et de meta-données (explication de la différence), utilisation de dispositifs matériels (comment on se connecte au net)

  • fortification : créer des barrières, restreindre l'accès et la visibilité, monitorer qui te suit qui tente de compromettre, creer des comptes ds tous les medias sociaux pour baliser le terrain, antivirus et spyware à jour, quarantaine, chiffrer, cacher ta webcam, migrer vers os plus surs comme gnu/linux
  • réduction : moins c'est mieux, combiner tactiques pour générer un manque de données sur soi : nettoyer et éliminer comptes et profils non-utilisés, ignorer et bloquer des applications et services digitaux non nécessaires, résister à la publication d'images et d'infos sur soi et son collectif, utiliser des vieux devices
  • obfuscation ou camouflage : plus de données tu génère, c'est le mieux : dévaluer la valeur de l'info, rompre les routine de navigation (apps et plug in), générer du bruit avec son identité (ouvrir différents comptes avec x identités), se cahcer dans la mutlitude ou ds identité collective (bien lire le zen manual), ne pas contaminer, créer des personnages crédibles (voir fakena ds zen manual pr créa id crédibles
  • compartimentation : bien compartimenter tes données, tes identités : bien déterminer ses domaines sociaux et bien les compartimenter, maintenir séparés, isoler la surface d'attaque

Téléphone mobile / intelligent

Fonctionnement de la téléphonie, triangulation, autorisation des applications, metadonnées, OS alternatifs, applications signées, rooting et jailbreaking

Chiffrer son téléphone, mot de passe sur, utiliser des applications libres

Logiciels à recommander pour la communication et l’échange

Logiciels mobiles réputés sures (au 06 2016)

  • SMSSecure
  • Signal
  • Telegraph et Snapchat qui ne sont pas libres mais chiffrent de bout en bout
  • Orbot + Orweb (naviteur type Tor bundle)
  • keepassDroid
  • Android Privacy Guard (chiffrement d'emails)
  • Obscuracam pour occulter les visages

Libérer son téléphone

900px|centré

Synthèse des bonnes pratiques

Backup, phrases de passes solides, utilisation de logiciels FLOSS, Infrastructure autonome sympathique (Yunohost, services non commerciaux), sécurité holistique, actualisation de l’évaluation des risques, réseau de confiance, Safe spaces

Qu'est que l'on commence, qu'est que l'on arrête, qu'est-ce que l'on continue de faire ?

  • Start
  • Stop
  • Keep

Évaluation de l’atelier

900px|centré


Identifying good resources