Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add additional information #2112

Closed
wants to merge 1 commit into from
Closed

Add additional information #2112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/basics/email-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,8 @@ Email metadata is protected from outside observers with [Opportunistic TLS](http
### Why Can't Metadata be E2EE?

Email metadata is crucial to the most basic functionality of email (where it came from, and where it has to go). E2EE was not built into the email protocols originally, instead requiring add-on software like OpenPGP. Because OpenPGP messages still have to work with traditional email providers, it cannot encrypt email metadata, only the message body itself. That means that even when using OpenPGP, outside observers can see lots of information about your messages, such as who you're emailing, the subject lines, when you're emailing, etc.

## Related Email security Information

- [The PGP Problem](https://latacora.micro.blog/2019/07/16/the-pgp-problem.html)
Copy link
Member

@dngray dngray Apr 8, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really dislike these Latacora articles, because they labor about "email security" and suggest things (Signal), which are not email. This is not helpful when you want email-styled/compatible providers as opposed to a transient instant messenger protocol the other recipient may not even use. We cover enough of that with the warning at the top of the page.

As far as email encryption across multiple providers go, PGP is and remains currently the only option, unless you opt for "form" based emails on the provider's server. I think providers like Proton and clients like Thunderbird have done a lot of work in making that usable for most people.

- [Stop Using Encrypted Email](https://latacora.singles/2020/02/19/stop-using-encrypted.html)
6 changes: 6 additions & 0 deletions docs/basics/multi-factor-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,3 +162,9 @@ SSH MFA can also be set up using TOTP. DigitalOcean has provided a tutorial [How
### KeePass (and KeePassXC)

KeePass and KeePassXC databases can be secured using Challenge-Response or HOTP as a second-factor authentication. Yubico has provided a document for KeePass [Using Your YubiKey with KeePass](https://support.yubico.com/hc/en-us/articles/360013779759-Using-Your-YubiKey-with-KeePass) and there is also one on the [KeePassXC](https://keepassxc.org/docs/#faq-yubikey-2fa) website.

## Related MFA Information

- [SS7 Attacks: Intercepting SMS and Calls As Easy As ABC](https://secure-voice.com/ss7_attacks/)

- [SMS phishing is way too easy](https://www.bejarano.io/sms-phishing/)
5 changes: 5 additions & 0 deletions docs/basics/passwords-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,3 +109,8 @@ There are many good options to choose from, both cloud-based and local. Choose o
### Backups

You should store an [encrypted](../encryption.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.

## Related Passwords Information

- [4 fatal flaws in deterministic password managers](https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't list any of these currently, and they by far are not very popular. IMHO not worth mentioning.

- [(In)Security of the "Pass" password manager](https://rot256.dev/post/pass/)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't recommend pass, but we do recommend gopass. While this does have some of the issues mentioned, its rather obvious. We mention this is still useful as a very cut-down manager for scripting applications.

1 change: 1 addition & 0 deletions docs/basics/vpn-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,3 +75,4 @@ For situations like these, or if you have another compelling reason, the VPN pro
- [Free VPN App Investigation](https://www.top10vpn.com/free-vpn-app-investigation/)
- [Hidden VPN owners unveiled: 101 VPN products run by just 23 companies](https://vpnpro.com/blog/hidden-vpn-owners-unveiled-97-vpns-23-companies/)
- [This Chinese company is secretly behind 24 popular apps seeking dangerous permissions](https://vpnpro.com/blog/chinese-company-secretly-behind-popular-apps-seeking-dangerous-permissions/)
- [Who owns your data? A VPN Relationship Map](https://blog.windscribe.com/the-vpn-relationship-map/)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do think this is one we could incorporate into the page.

6 changes: 6 additions & 0 deletions docs/financial-services.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ Making payments online is one of the biggest challenges to privacy. These servic

## Payment Masking Services

!!! danger "Not for anonymous purchases"

There are a number of services which provide "virtual debit cards" which you can use with online merchants without revealing your actual banking or billing information in most cases. It's important to note that these financial services are **not** anonymous and are subject to "Know Your Customer" (KYC) laws and may require your ID or other identifying information. These services are primarily useful for protecting you from merchant data breaches, less sophisticated tracking or purchase correlation by marketing agencies, and online data theft; and **not** for making a purchase completely anonymously.

!!! tip "Check your current bank"
Expand Down Expand Up @@ -92,3 +94,7 @@ These services allow you to purchase gift cards for a variety of merchants onlin

- Accepts payment in [a recommended cryptocurrency](cryptocurrency.md).
- No ID requirement.

## Related Financial services Information

- [“Privacy”.com–Yeah Right](https://ersei.net/en/blog/privacy-dot-com-yeah-right)