Online Safety

Jersey Library Lunchtime Talks

11th October 2016 · Tom Brossman

Priorities?

Money

Your bank has security professionals

Your bank can spot patterns of fraud

Your Money Is Protected

Files

You can restore from backups

Much of your data is stored remotely

Your Data Can Be Protected

Privacy

How do you get your privacy back?

(you don't)

"Surveillance" Capitalism

Disclosure

Data Breaches Are Frequent

informationisbeautiful.net

UK Data Breaches

“Service providers are required to notify the ICO if a ‘personal data breach’ occurs. They must also notify customers if the breach is likely to adversely affect customers’ privacy, and keep a breach log.”

Jersey Data Breaches

“Organisations have no legal obligation to notify the Commissioner of a security breach, however the circumstances of the breach may lead you towards issuing a notification.”

Have I Been Pwned?

Check if you have an account that has been compromised in a data breach

haveibeenpwned.com

1,485,000,000+ accounts to date

Account Security

Regular Users

  1. Use Anti-virus software
  2. Use strong passwords
  3. Change passwords frequently
  4. Only visit websites they know
  5. Don’t share personal info

Security Experts

  1. Install software updates
  2. Use unique passwords
  3. Use two-factor authentication
  4. Use strong passwords
  5. Use a password manager

Always Protect Email

Fraudsters can quickly build a profile on you

"Forgot password" option gives them your other accounts

After a compromise, double-check recovery settings

Passwords

Every site gets a unique password, no exceptions

Start using a password manager immediately

Password Managers

Default: Your Web Browser!

KeePass (Windows, macOS, Linux, Android, iOS) Free

LastPass (Windows, macOS, Linux, Android, iOS) $12/year

Dashlane (Windows, macOS, Android, iOS) $40/year

Security Questions

Two-factor Authentication

Free Mobile App

Codes change every minute

Protects you if passwords stolen

Mobile Security

Enable Encryption

Use a passcode / fingerprint lock

Set up & test tracking of "lost" device

Mobile Privacy

73% of Android apps shared personal information with third parties

47% of iOS apps shared location data with third parties

"Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps (2015)"

Avoiding Scams

"Phishing"

An attempt to obtain sensitive information such as usernames and passwords under a false pretext.

bankofthewest.com / bankofthevvest.com

paypal.com / paypal.com.fraud-site.com

Who Initiated Contact?

Single most important indicator

Never trust message content

A genuine alert can be handled by calling back

Basic Website Security

“If there is NO padlock in the browser window or ‘https://’ at the beginning of the web address to signify that it is using a secure link, do not enter personal information on the site.” getsafeonline.org

Local websites: insecure.org.je

Adverts

"Malvertising"

Blocking all ads is now a basic security precaution

"Malware-squirting ads appear on websites with 100+ million visitors" - The Register

"Research reports malvertising events rose 375% in 2014 and another 260% in 2015" - Online Trust Alliance

Ad-Blocking Software

Desktop: "uBlock Origin" for Firefox or Chrome

Mobile: "uBlock Origin" for Firefox on Android or "Adblock Plus" for iOS

Browser Add-ons

"Privacy Badger is a browser add-on that stops advertisers and other third-party trackers from secretly tracking where you go and what pages you look at on the web."

WiFi

Home WiFi

OpenDNS "Family Shield"

OpenDNS Home

opendns.com

Public WiFi

HTTPS connections are end-to-end encrypted and secure

HTTP connections are not secure

Best practice - use a VPN service

WiFi Privacy

Internet Of Things

Ever Update This Thing?

Wearables

"Some Fitbit users' sex stats on Google search" - cnet.com

Printer Dots

Image: eff.org

Thank You

Slides: tombrossman.com/jcc

tom@tombrossman.com

brossmanit.com/downloads