LRC posts quite a few articles on how the government is doing this and doing that to invade everyone’s privacy. Well, one of the strategies the State uses to try to keep people from protecting themselves is to use disinformation to make people feel it’s useless to try.
Rather than worrying about what the government is doing to violate your privacy, you should understand the bare minimum about security - especially information security - that you need to know to keep your data secure.
This post is here as a quick tour of the high points, I recommend you read a professional like Bruce Schneier for more thorough discussion of information security.
-
Remember that the government is not your only enemy. There are many, many more private hackers who command, in sum, far greater computational and expert resources than the government does. But it’s a lot easier to keep your data safe from small-time hackers than from a determined attempt by the NSA to get your secrets. A deadbolt on your front door won’t keep the government out, but it will keep the teen hoodlums from kicking in your door while you’re out on vacation, or force them to make enough noise to rouse your dog, etc. To apply this to information security, it’s better to have some level of security than no security at all, just so long as that security doesn’t lull you into complacency.
-
Assess what you need to keep private. Are you storing stolen nuclear launch codes? I doubt it, so you probably don’t really need military-grade encryption. That doesn’t mean you shouldn’t opt for the strongest encryption that conforms to your day-to-day needs. All things equal, always choose stronger over weaker. But all things are usually not equal… stronger encryption and infosec policies require more compute time, or less-user-friendly interfaces or whatever.
-
Remember that security is holistic… and your information is only as secure as the weakest link. We tend to think of information as a Platonic abstraction but any particular information exists as a physical pattern stored on a physical medium, somewhere. Physical security is paramount to information security. You cannot have information security without physical security. If you use the best open source encryption available, it is not likely the NSA can crack it. But they don’t have to crack it if they can get the FBI to install a key-logger on your computer.
-
Understand electromagnetic (EM) radiation. Any electronic device you use emits EM radiation in all directions. Wood and sheetrock do not stop EM radiation. The spook industry has developed astoundingly sophisticated methods for spying on electronic equipment which is not shielded and decoupled from the outside world. I have read that standard-operating procedure for organized crime types is to simply not have any cellular phone or other mic-equipped electronic device even in the room when discussing sensitive subjects. To give you an idea of just how tricky managing EM radiation can be, there are methods for determining keystrokes just by monitoring the electrical line outside your house. Each time you press a key, it causes a series of electrical signals to be generated and these signals, however small, create a slight variation in the electrical power consumed by your machine. This shows up as noise on the outside electrical line, if properly filtered. It is possible in this way to recover at least some portion of what is being typed. The movie Enemy of the State dramatizes some of this electronic warfare wizardry.
-
Ask yourself: Where’s the secret? Let’s say you encrypt files on your hard drive. But you leave the key on your hard drive, too. Well, that’s silly. Anyone can then use the key to unlock the “encrypted” files on your hard drive. It is only by separating the encrypted text from the key that encryption is possible. This separation must be physical, that is, the secret must be stored in a different physical medium than the encrypted text. In the case of passwords, the physical medium storing the secret key is your brain.
Once you divulge a secret, it is no longer secret. That means, if you go to a friend’s house or to the library and log in to your web-email, your email password is no longer secret. You just typed it into a physical device over which you have no control. Change your password.
Likewise, whenever you type your password into your laptop or your home machine, that password is potentially compromised. There could be key-logging malware installed on the machine. Or, someone could steal the machine and use special utilities to find the password in RAM or stored in the page file on your hard drive.
-
Remember that passwords are an essential ingredient of information security. Don’t ever let anyone tell you that biometric will one day “replace” passwords. This is clap-trap and anyone who says this has just revoked any claim to being a security expert. Biometrics can solve some security problems but the information security problem - keeping a secret - can only be solved by… keeping a secret. There is no short-cut. There is no “plug and play” method.
-
Use a good password policy that fits your needs. I will share my password policy, use it if you like.
-
For “crap” logins, I use a single, worthless, easy-to-guess password so that I don’t have to waste any memory cells on things that are not intended to be secure to begin with. My login to the Mises forum is an example… there is no personal information or anything that I need to keep secure on the Mises forum.
-
For email, bank login, etc. I use a strong, randomly-generated pronounceable password. Since I do not trust machines, I do not use any kind of software or electronic hardware. The way I generate my passwords is as follows:
a) I roll a 20-sided and a 6-sided die together (get the 20-sided die from any board-game store)
b) The 20-sided die selects from the consonants of the alphabet: bcdfghjklmnpqrstvwxz and the 6-sided die selects from the vowels of the alphabet: aeiouy. This creates a consonant-vowel pair. I write this down and repeat a total of 5 times to give a 10-letter password. There are 120 possible consonant-vowel pairs, which works out to 6.9 bits per pair. There are 5 pairs in each password, yielding 34.5 bits of information per password. This means there are roughly 20 billion possible passwords of this length, so the odds of guessing the password randomly are about 1 in 20 billion.
c) I keep the piece of paper for a few days until I have “absorbed” the password. It usually only takes 4 or 5 uses for the password to “stick” because it is pronounceable by construction. Then I dispose of the written password.
d) If the password policy requires special characters, numbers, etc. I have some biolerplate thing I add at the end, this is irrelevant to the password’s security.
e) I change my password about twice a year or as-needed (i.e. if I log in from a friend’s computer, I immediately change the password once I get home).
- For data stored on hard drive which I want to keep more secure and which I access only on occasion, I use a very long two-piece password, part written and part memorized. This provides the benefit of making the password secure enough that even the NSA couldn’t break it yet if someone broke in and stole the written portion of the password along with my computer, the memorized portion would almost certainly still keep the data safe.
- Above all, use common sense!
Clayton -