hashman.ca :: A beginner's guide to improving your digital security

In 2017, I led a series of workshops aimed at teaching<br>beginners a better understanding of encryption, how the internet works, and<br>their digital security. Nearly a decade later, there is still a great need to<br>share reliable resources and guides on improving these skills.

I have worked professionally in computer security one way or another for well<br>over a decade, at many major technology companies and in many open source<br>software projects. There are many inaccurate and unreliable resources<br>out there on this subject, put together by well-meaning people without a<br>background in security, which can lead to sharing misinformation, exaggeration<br>and fearmongering.

I hope that I can offer you a trusted, curated list of high impact things that<br>you can do right now, using whichever vetted guide you prefer. In addition, I<br>also include how long it should take, why you should do each task, and any<br>limitations.

This guide is aimed at improving your personal security, and does not apply to<br>your work-owned devices. Always assume your company can monitor all of your<br>messages and activities on work devices.

What can I do to improve my security right away?

I put together this list in order of effort, easiest tasks first. You should be<br>able to complete many of the low effort tasks in a single hour. The medium to<br>high effort tasks are very much worth doing, but may take you a few days or<br>even weeks to complete them.

Low effort (

Upgrade your software to the latest versions

Why? I don't know anyone who hasn't complained about software updates<br>breaking features, introducing bugs, and causing headaches. If it ain't broke,<br>why upgrade, right? Well, alongside all of those annoying bugs and breaking<br>changes, software updates also include security fixes, which will protect your<br>device from being exploited by bad actors. Security issues can be found in<br>software at any time, even software that's been available for many years and<br>thought to be secure. You want to install these as soon as they are available.

Recommendation: Turn on automatic upgrades and always keep your devices as<br>up-to-date as possible. If you have some software you know will not work if you<br>upgrade it, at least be sure to upgrade your laptop and phone operating system<br>(iOS, Android, Windows, etc.) and web browser (Chrome, Safari, Firefox, etc.).<br>Do not use devices that do not receive security support (e.g. old Android or<br>iPhones).

Guides:

Activist Checklist: Install the latest software updates

Consumer Reports: Update your Mac, Windows PC, Chromebook, Android phone, iOS device

Apple: Obsolete products (obsolete<br>devices do not receive security updates)

Google: How long you'll get Pixel updates

Samsung: Devices that receive security updates

Other brands: check the manufacturer's website

Limitations: This will prevent someone from exploiting known security<br>issues on your devices, but it won't help if your device was already<br>compromised. If this is a concern, doing a factory reset, upgrade, and turning<br>on automatic upgrades may help. This also won't protect against all types of<br>attacks, but it is a necessary foundation.

Use Signal

Why? Signal is a trusted, vetted, secure<br>messaging application that allows you to send end-to-end encrypted messages and<br>make video/phone calls. This means that only you and your intended recipient<br>can decrypt the messages and someone cannot intercept and read your messages,<br>in contrast to texting (SMS) and other insecure forms of messaging. Other<br>applications advertise themselves as end-to-end encrypted, but Signal provides<br>the strongest protections.

Recommendation: I recommend installing the Signal app and using it! My mom<br>loves that she can video call me on Wi-Fi on my Android phone. It also supports<br>group chats. I use it as a secure alternative to texting (SMS) and other chat<br>platforms. I also like Signal's "disappearing messages" feature which I enable<br>by default because it automatically deletes messages after a certain period of<br>time. This avoids your messages taking up too much storage.

Guides:

Activist Checklist: Use Signal

Activist Checklist: Turn on disappearing messages

Electronic Frontier Foundation: How to use Signal

Consumer Reports: Communicate privately with Signal

Signal: Enabling Incognito Keyboard (Android) to provide slightly more privacy

Limitations: Signal is only able to protect your messages in transit. If<br>someone has access to your phone or the phone of the person you sent messages<br>to, they will still be able to read them. As a rule of thumb, if you don't want<br>someone to read something, don't write it down! Meet in person or make an<br>encrypted phone call where you will not be overheard. If you are talking to<br>someone you don't know, assume your messages are as public as posting on social<br>media.

Set passwords and turn on device encryption

Why? Passwords ensure that someone else can't unlock your device without<br>your consent or...