From 46a9abedbee939a3b5b41b8618741ab7d02b5972 Mon Sep 17 00:00:00 2001 From: Crowdin Bot Date: Sun, 28 Jul 2024 01:55:36 +0000 Subject: [PATCH] New Crowdin translations by GitHub Action --- i18n/ar/basics/common-threats.md | 2 +- i18n/ar/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/ar/desktop-browsers.md | 44 +++++--- i18n/ar/os/ios-overview.md | 2 +- i18n/ar/os/windows/index.md | 2 +- i18n/bn-IN/basics/common-threats.md | 2 +- i18n/bn-IN/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/bn-IN/desktop-browsers.md | 44 +++++--- i18n/bn-IN/os/ios-overview.md | 2 +- i18n/bn-IN/os/windows/index.md | 2 +- i18n/bn/basics/common-threats.md | 2 +- i18n/bn/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/bn/desktop-browsers.md | 44 +++++--- i18n/bn/os/ios-overview.md | 2 +- i18n/bn/os/windows/index.md | 2 +- i18n/cs/basics/common-threats.md | 2 +- i18n/cs/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/cs/desktop-browsers.md | 44 +++++--- i18n/cs/os/ios-overview.md | 2 +- i18n/cs/os/windows/index.md | 2 +- i18n/de/basics/common-threats.md | 2 +- i18n/de/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/de/desktop-browsers.md | 48 +++++---- i18n/de/os/ios-overview.md | 2 +- i18n/de/os/windows/index.md | 2 +- i18n/el/basics/common-threats.md | 2 +- i18n/el/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/el/desktop-browsers.md | 44 +++++--- i18n/el/os/ios-overview.md | 2 +- i18n/el/os/windows/index.md | 2 +- i18n/eo/basics/common-threats.md | 2 +- i18n/eo/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/eo/desktop-browsers.md | 44 +++++--- i18n/eo/os/ios-overview.md | 2 +- i18n/eo/os/windows/index.md | 2 +- i18n/es/basics/common-threats.md | 2 +- i18n/es/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/es/desktop-browsers.md | 48 +++++---- i18n/es/os/ios-overview.md | 2 +- i18n/es/os/windows/index.md | 2 +- i18n/fa/basics/common-threats.md | 2 +- i18n/fa/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/fa/desktop-browsers.md | 44 +++++--- i18n/fa/os/ios-overview.md | 2 +- i18n/fa/os/windows/index.md | 2 +- i18n/fr/basics/common-threats.md | 2 +- i18n/fr/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/fr/desktop-browsers.md | 48 +++++---- i18n/fr/os/ios-overview.md | 2 +- i18n/fr/os/windows/index.md | 2 +- i18n/he/basics/common-threats.md | 2 +- i18n/he/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/he/desktop-browsers.md | 44 +++++--- i18n/he/os/ios-overview.md | 2 +- i18n/he/os/windows/index.md | 2 +- i18n/hi/basics/common-threats.md | 2 +- i18n/hi/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/hi/desktop-browsers.md | 44 +++++--- i18n/hi/os/ios-overview.md | 2 +- i18n/hi/os/windows/index.md | 2 +- i18n/hu/basics/common-threats.md | 2 +- i18n/hu/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/hu/desktop-browsers.md | 44 +++++--- i18n/hu/os/ios-overview.md | 2 +- i18n/hu/os/windows/index.md | 2 +- i18n/id/basics/common-threats.md | 2 +- i18n/id/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/id/desktop-browsers.md | 44 +++++--- i18n/id/os/ios-overview.md | 2 +- i18n/id/os/windows/index.md | 2 +- i18n/it/basics/common-threats.md | 2 +- i18n/it/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/it/desktop-browsers.md | 48 +++++---- i18n/it/os/ios-overview.md | 2 +- i18n/it/os/windows/index.md | 2 +- i18n/ja/basics/common-threats.md | 2 +- i18n/ja/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/ja/desktop-browsers.md | 44 +++++--- i18n/ja/os/ios-overview.md | 2 +- i18n/ja/os/windows/index.md | 2 +- i18n/ko/basics/common-threats.md | 2 +- i18n/ko/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/ko/desktop-browsers.md | 44 +++++--- i18n/ko/os/ios-overview.md | 2 +- i18n/ko/os/windows/index.md | 2 +- i18n/ku-IQ/basics/common-threats.md | 2 +- i18n/ku-IQ/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/ku-IQ/desktop-browsers.md | 44 +++++--- i18n/ku-IQ/os/ios-overview.md | 2 +- i18n/ku-IQ/os/windows/index.md | 2 +- i18n/nl/basics/common-threats.md | 2 +- i18n/nl/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/nl/desktop-browsers.md | 44 +++++--- i18n/nl/os/ios-overview.md | 2 +- i18n/nl/os/windows/index.md | 2 +- i18n/pl/basics/common-threats.md | 2 +- i18n/pl/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/pl/desktop-browsers.md | 44 +++++--- i18n/pl/os/ios-overview.md | 2 +- i18n/pl/os/windows/index.md | 2 +- i18n/pt-BR/basics/common-threats.md | 2 +- i18n/pt-BR/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/pt-BR/desktop-browsers.md | 44 +++++--- i18n/pt-BR/os/ios-overview.md | 2 +- i18n/pt-BR/os/windows/index.md | 2 +- i18n/pt/basics/common-threats.md | 2 +- i18n/pt/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/pt/desktop-browsers.md | 44 +++++--- i18n/pt/os/ios-overview.md | 2 +- i18n/pt/os/windows/index.md | 2 +- i18n/ru/basics/common-threats.md | 2 +- i18n/ru/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/ru/desktop-browsers.md | 44 +++++--- i18n/ru/os/ios-overview.md | 2 +- i18n/ru/os/windows/index.md | 2 +- i18n/sv/basics/common-threats.md | 2 +- i18n/sv/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/sv/desktop-browsers.md | 44 +++++--- i18n/sv/os/ios-overview.md | 2 +- i18n/sv/os/windows/index.md | 2 +- i18n/tr/basics/common-threats.md | 2 +- i18n/tr/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/tr/desktop-browsers.md | 44 +++++--- i18n/tr/os/ios-overview.md | 2 +- i18n/tr/os/windows/index.md | 2 +- i18n/uk/basics/common-threats.md | 2 +- i18n/uk/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/uk/desktop-browsers.md | 44 +++++--- i18n/uk/os/ios-overview.md | 2 +- i18n/uk/os/windows/index.md | 2 +- i18n/vi/basics/common-threats.md | 2 +- i18n/vi/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/vi/desktop-browsers.md | 44 +++++--- i18n/vi/os/ios-overview.md | 2 +- i18n/vi/os/windows/index.md | 2 +- i18n/zh-Hant/basics/common-threats.md | 2 +- i18n/zh-Hant/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/zh-Hant/desktop-browsers.md | 50 +++++---- i18n/zh-Hant/os/ios-overview.md | 2 +- i18n/zh-Hant/os/windows/index.md | 2 +- i18n/zh/basics/common-threats.md | 2 +- i18n/zh/basics/hardware.md | 146 ++++++++++++++++++++++++++ i18n/zh/desktop-browsers.md | 50 +++++---- i18n/zh/os/ios-overview.md | 2 +- i18n/zh/os/windows/index.md | 2 +- includes/abbreviations.ar.txt | 1 + includes/abbreviations.bn-IN.txt | 1 + includes/abbreviations.bn.txt | 1 + includes/abbreviations.cs.txt | 1 + includes/abbreviations.de.txt | 1 + includes/abbreviations.el.txt | 1 + includes/abbreviations.eo.txt | 1 + includes/abbreviations.es.txt | 1 + includes/abbreviations.fa.txt | 1 + includes/abbreviations.fr.txt | 1 + includes/abbreviations.he.txt | 1 + includes/abbreviations.hi.txt | 1 + includes/abbreviations.hu.txt | 1 + includes/abbreviations.id.txt | 1 + includes/abbreviations.it.txt | 1 + includes/abbreviations.ja.txt | 1 + includes/abbreviations.ko.txt | 1 + includes/abbreviations.ku-IQ.txt | 1 + includes/abbreviations.nl.txt | 1 + includes/abbreviations.pl.txt | 1 + includes/abbreviations.pt-BR.txt | 1 + includes/abbreviations.pt.txt | 1 + includes/abbreviations.ru.txt | 1 + includes/abbreviations.sv.txt | 1 + includes/abbreviations.tr.txt | 1 + includes/abbreviations.uk.txt | 1 + includes/abbreviations.vi.txt | 1 + includes/abbreviations.zh-Hant.txt | 1 + includes/abbreviations.zh.txt | 1 + 174 files changed, 5148 insertions(+), 593 deletions(-) create mode 100644 i18n/ar/basics/hardware.md create mode 100644 i18n/bn-IN/basics/hardware.md create mode 100644 i18n/bn/basics/hardware.md create mode 100644 i18n/cs/basics/hardware.md create mode 100644 i18n/de/basics/hardware.md create mode 100644 i18n/el/basics/hardware.md create mode 100644 i18n/eo/basics/hardware.md create mode 100644 i18n/es/basics/hardware.md create mode 100644 i18n/fa/basics/hardware.md create mode 100644 i18n/fr/basics/hardware.md create mode 100644 i18n/he/basics/hardware.md create mode 100644 i18n/hi/basics/hardware.md create mode 100644 i18n/hu/basics/hardware.md create mode 100644 i18n/id/basics/hardware.md create mode 100644 i18n/it/basics/hardware.md create mode 100644 i18n/ja/basics/hardware.md create mode 100644 i18n/ko/basics/hardware.md create mode 100644 i18n/ku-IQ/basics/hardware.md create mode 100644 i18n/nl/basics/hardware.md create mode 100644 i18n/pl/basics/hardware.md create mode 100644 i18n/pt-BR/basics/hardware.md create mode 100644 i18n/pt/basics/hardware.md create mode 100644 i18n/ru/basics/hardware.md create mode 100644 i18n/sv/basics/hardware.md create mode 100644 i18n/tr/basics/hardware.md create mode 100644 i18n/uk/basics/hardware.md create mode 100644 i18n/vi/basics/hardware.md create mode 100644 i18n/zh-Hant/basics/hardware.md create mode 100644 i18n/zh/basics/hardware.md diff --git a/i18n/ar/basics/common-threats.md b/i18n/ar/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/ar/basics/common-threats.md +++ b/i18n/ar/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/ar/basics/hardware.md b/i18n/ar/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/ar/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/ar/desktop-browsers.md b/i18n/ar/desktop-browsers.md index 725a7f23..fae9d1d5 100644 --- a/i18n/ar/desktop-browsers.md +++ b/i18n/ar/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/ar/os/ios-overview.md b/i18n/ar/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/ar/os/ios-overview.md +++ b/i18n/ar/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/ar/os/windows/index.md b/i18n/ar/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/ar/os/windows/index.md +++ b/i18n/ar/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/bn-IN/basics/common-threats.md b/i18n/bn-IN/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/bn-IN/basics/common-threats.md +++ b/i18n/bn-IN/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/bn-IN/basics/hardware.md b/i18n/bn-IN/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/bn-IN/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/bn-IN/desktop-browsers.md b/i18n/bn-IN/desktop-browsers.md index b7bba6eb..ec7094f4 100644 --- a/i18n/bn-IN/desktop-browsers.md +++ b/i18n/bn-IN/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/bn-IN/os/ios-overview.md b/i18n/bn-IN/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/bn-IN/os/ios-overview.md +++ b/i18n/bn-IN/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/bn-IN/os/windows/index.md b/i18n/bn-IN/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/bn-IN/os/windows/index.md +++ b/i18n/bn-IN/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/bn/basics/common-threats.md b/i18n/bn/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/bn/basics/common-threats.md +++ b/i18n/bn/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/bn/basics/hardware.md b/i18n/bn/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/bn/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/bn/desktop-browsers.md b/i18n/bn/desktop-browsers.md index b7bba6eb..ec7094f4 100644 --- a/i18n/bn/desktop-browsers.md +++ b/i18n/bn/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/bn/os/ios-overview.md b/i18n/bn/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/bn/os/ios-overview.md +++ b/i18n/bn/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/bn/os/windows/index.md b/i18n/bn/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/bn/os/windows/index.md +++ b/i18n/bn/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/cs/basics/common-threats.md b/i18n/cs/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/cs/basics/common-threats.md +++ b/i18n/cs/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/cs/basics/hardware.md b/i18n/cs/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/cs/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/cs/desktop-browsers.md b/i18n/cs/desktop-browsers.md index 11c0cc68..751ed490 100644 --- a/i18n/cs/desktop-browsers.md +++ b/i18n/cs/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/cs/os/ios-overview.md b/i18n/cs/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/cs/os/ios-overview.md +++ b/i18n/cs/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/cs/os/windows/index.md b/i18n/cs/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/cs/os/windows/index.md +++ b/i18n/cs/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/de/basics/common-threats.md b/i18n/de/basics/common-threats.md index b235e606..8407b76c 100644 --- a/i18n/de/basics/common-threats.md +++ b/i18n/de/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: Vereinte Nationen: [*Allgemeine Erklärung der Menschenrechte*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/de/basics/hardware.md b/i18n/de/basics/hardware.md new file mode 100644 index 00000000..aedfd0cb --- /dev/null +++ b/i18n/de/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warnung

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warnung

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/de/desktop-browsers.md b/i18n/de/desktop-browsers.md index 611e2e9f..5e0a3e3a 100644 --- a/i18n/de/desktop-browsers.md +++ b/i18n/de/desktop-browsers.md @@ -265,9 +265,7 @@ Brave fügt dem Dateinamen bei Downloads von der Brave-Website einen "[Herkunfts Diese Optionen sind unter :material-menu: → **Einstellungen** zu finden. -#### Settings - -##### Schutz +#### Schutz Brave enthält einige Anti-Fingerabdruck-Maßnahmen in der [Schutz](https://support.brave.com/hc/articles/360022973471-What-is-Shields)-Funktion. Wir empfehlen, diese Optionen [global](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) für alle Seiten zu konfigurieren. @@ -275,7 +273,6 @@ Die Schutz-Möglichkeiten können je nach Bedarf für jede Website heruntergestu
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave ermöglicht die Auswahl zusätzlicher Inhaltsfilter auf der internen Seite - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave ermöglicht die Auswahl zusätzlicher Inhaltsfilter auf der internen Seite 1. Diese Option bietet ähnliche Funktionen wie die erweiterten [Blockierungsmodi](https://github.com/gorhill/uBlock/wiki/Blocking-mode) von uBlock Origin. 2. Wenn du auf einer bestimmten Website, die du häufig besuchst, eingeloggt bleiben möchtest, kannst du Ausnahmen für die einzelnen Websites festlegen, indem du auf das Schildsymbol in der Adressleiste klickst. -##### Privacy and security +#### Privacy and security
-- [x] Aktiviere **Nicht-proxisiertes UDP deaktivieren** unter [WebRTC-IP-Nutzungsrichtlinien](https://support.brave.com/hc/en-us/articles/360017989132-How-do-I-change-my-Privacy-Settings-#webrtc) -- [ ] Deaktiviere **Nutzen Sie Google-Services für Push-Benachrichtigungen** -- [ ] Deaktiviere **Erlaubt Produktanalyse, die den Datenschutz respektiert (P3A)** -- [ ] Deaktiviere **Ping der täglichen Nutzung automatisch an Brave senden** -- [ ] Deaktiviere **Automatisch Diagnoseberichte senden** -- [ ] Deaktiviere **Privates Fenster mit Tor** (1) +- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* +- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) +- [ ] Uncheck **Use Google services for push messaging** +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave ist **nicht** so resistent gegen Fingerabdrücke wie der Tor-Browser. Außerdem nutzen viel weniger Leute Brave zusammen mit Tor, du wirst also auffallen. Wenn [starke Anonymität erforderlich ist](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity), verwende den [Tor-Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Browserdaten beim Schließen löschen

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Die Web3-Funktionen von Brave können deinen Browser-Fingerabdruck und deine Angriffsfläche potenziell vergrößern. Wenn du keine der Funktionen verwendest, sollten sie deaktiviert werden. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Die Web3-Funktionen von Brave können deinen Browser-Fingerabdruck und deine Angriffsfläche potenziell vergrößern. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/de/os/ios-overview.md b/i18n/de/os/ios-overview.md index f46865b9..bf0425ee 100644 --- a/i18n/de/os/ios-overview.md +++ b/i18n/de/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/de/os/windows/index.md b/i18n/de/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/de/os/windows/index.md +++ b/i18n/de/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/el/basics/common-threats.md b/i18n/el/basics/common-threats.md index 77b50889..b6eba3cb 100644 --- a/i18n/el/basics/common-threats.md +++ b/i18n/el/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/el/basics/hardware.md b/i18n/el/basics/hardware.md new file mode 100644 index 00000000..2485b199 --- /dev/null +++ b/i18n/el/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Σημείωση

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Σημείωση

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/el/desktop-browsers.md b/i18n/el/desktop-browsers.md index 2bad1c01..4996c9c7 100644 --- a/i18n/el/desktop-browsers.md +++ b/i18n/el/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Τα χαρακτηριστικά Web3 του Brave μπορούν δυνητικά να αυξήσουν το δακτυλικό αποτύπωμα του προγράμματος περιήγησης και την επιφάνεια επιθέσεων. Αν δεν χρησιμοποιείτε καμία από τις λειτουργίες, θα πρέπει να τις απενεργοποιήσετε. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Τα χαρακτηριστικά Web3 του Brave μπορούν δυνητικά να αυξήσουν το δακτυλικό αποτύπωμα του προγράμματος περιήγησης και την επιφάνεια επιθέσεων. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/el/os/ios-overview.md b/i18n/el/os/ios-overview.md index 2d5be1ee..aa74905f 100644 --- a/i18n/el/os/ios-overview.md +++ b/i18n/el/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/el/os/windows/index.md b/i18n/el/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/el/os/windows/index.md +++ b/i18n/el/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/eo/basics/common-threats.md b/i18n/eo/basics/common-threats.md index e1649d38..0e826333 100644 --- a/i18n/eo/basics/common-threats.md +++ b/i18n/eo/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/eo/basics/hardware.md b/i18n/eo/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/eo/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/eo/desktop-browsers.md b/i18n/eo/desktop-browsers.md index b7bba6eb..ec7094f4 100644 --- a/i18n/eo/desktop-browsers.md +++ b/i18n/eo/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/eo/os/ios-overview.md b/i18n/eo/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/eo/os/ios-overview.md +++ b/i18n/eo/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/eo/os/windows/index.md b/i18n/eo/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/eo/os/windows/index.md +++ b/i18n/eo/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/es/basics/common-threats.md b/i18n/es/basics/common-threats.md index 6b8452d3..2a102a3c 100644 --- a/i18n/es/basics/common-threats.md +++ b/i18n/es/basics/common-threats.md @@ -189,4 +189,4 @@ Siempre debes tener en cuenta los riesgos de intentar saltarse la censura, las p [^2]: Junta de Supervisión de la Privacidad y las Libertades Civiles de los Estados Unidos: [*Informe sobre el Programa de Registros Telefónicos llevado a cabo bajo la Sección 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Capitalismo de vigilancia*](https://es.wikipedia.org/wiki/Capitalismo_de_vigilancia) [^4]: "[Enumerar lo malo](https://ranum.com/security/computer_security/editorials/dumb)" (o, "enumerar todas las cosas malas que conocemos"), como hacen muchos bloqueadores de contenidos y programas antivirus, no consigue protegerle adecuadamente de amenazas nuevas y desconocidas porque aún no se han añadido a la lista de filtros. También deberías emplear otras técnicas de mitigación. -[^5]: Naciones Unidas: [*La Declaración Universal de Derechos Humanos*](https://www.un.org/es/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/es/basics/hardware.md b/i18n/es/basics/hardware.md new file mode 100644 index 00000000..a129555e --- /dev/null +++ b/i18n/es/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Actualizaciones de firmware + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Nota

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Advertencia

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Llaves de Seguridad + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Advertencia

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Nota

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/es/desktop-browsers.md b/i18n/es/desktop-browsers.md index 6f8d3680..cb0fd1e4 100644 --- a/i18n/es/desktop-browsers.md +++ b/i18n/es/desktop-browsers.md @@ -265,9 +265,7 @@ Brave añade un "[código de referido](https://github.com/brave/brave-browser/wi Estas opciones se encuentran en :material-menu: → **Configuración**. -#### Settings - -##### Escudos +#### Escudos Brave incluye algunas medidas antihuellas en su función [Escudos](https://support.brave.com/hc/articles/360022973471-What-is-Shields). Te sugerimos configurar estas opciones [globalmente](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) en todas las páginas que visites. @@ -275,7 +273,6 @@ Las opciones de los escudos pueden reducirse según las necesidades de cada siti
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave te permite seleccionar filtros de contenido adicionales dentro de la pági - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave te permite seleccionar filtros de contenido adicionales dentro de la pági 1. Esta opción proporciona una funcionalidad similar a los [modos de bloqueo](https://github.com/gorhill/uBlock/wiki/Blocking-mode) avanzados de uBlock Origin. 2. Si deseas permanecer conectado a un sitio concreto que visitas a menudo, puedes establecer excepciones por sitio haciendo clic en el icono del Escudo de la barra de direcciones. -##### Privacy and security +#### Privacy and security
-- [x] Selecciona **Desactivar el UDP sin proxy** en [Política de gestión de IP de WebRTC](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) -- [ ] Desmarca **Utiliza los servicios de Google para la mensajería push** -- [ ] Desmarca **Permitir estadísticas del producto con preservación de la privacidad (P3A)** -- [ ] Desmarca **Enviar automáticamente el ping de uso diario a Brave** -- [ ] Desmarca **Enviar informes de diagnóstico automáticamente** -- [ ] Desmarca **Ventana privada con Tor** (1) +- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* +- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) +- [ ] Uncheck **Use Google services for push messaging** +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave **no** es tan resistente a las huellas digitales como Tor Browser y mucha menos gente usa Brave con Tor, así que destacarás. Cuando se [requiera un fuerte anonimato](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity), utiliza el [Navegador Tor](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Desinfectar al cerrar

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Las funciones Web3 de Brave pueden aumentar potencialmente la huella digital de tu navegador y la superficie de ataque. A menos que utilices alguna de las funciones, deberían estar desactivadas. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Las funciones Web3 de Brave pueden aumentar potencialmente la huella digital de tu navegador y la superficie de ataque. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/es/os/ios-overview.md b/i18n/es/os/ios-overview.md index 5e86965d..b1c118e0 100644 --- a/i18n/es/os/ios-overview.md +++ b/i18n/es/os/ios-overview.md @@ -227,4 +227,4 @@ Apple siempre pone las versiones beta de iOS a disposición de quienes deseen ay ### Antes del Primer Desbloqueo -Si tu modelo de amenazas incluye herramientas forenses y quieres minimizar la posibilidad de que se utilicen exploits para acceder a tu teléfono, debes reiniciar el dispositivo con frecuencia. El estado *después de* un reinicio pero *antes de* desbloquear tu dispositivo se conoce como "Antes del Primer Desbloqueo" (BFU), y cuando tu dispositivo está en ese estado hace que sea [significativamente más difícil](https://belkasoft.com/checkm8_glossary) para las herramientas forenses explotar vulnerabilidades para acceder a tus datos. Este estado BFU te permite recibir notificaciones de llamadas, mensajes de texto y alarmas, pero la mayoría de los datos de tu dispositivo siguen estando encriptados y son inaccesibles. Esto puede ser poco práctico, así que considera si estas soluciones tienen sentido para tu situación. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. El estado *después de* un reinicio pero *antes de* desbloquear tu dispositivo se conoce como "Antes del Primer Desbloqueo" (BFU), y cuando tu dispositivo está en ese estado hace que sea [significativamente más difícil](https://belkasoft.com/checkm8_glossary) para las herramientas forenses explotar vulnerabilidades para acceder a tus datos. Este estado BFU te permite recibir notificaciones de llamadas, mensajes de texto y alarmas, pero la mayoría de los datos de tu dispositivo siguen estando encriptados y son inaccesibles. Esto puede ser poco práctico, así que considera si estas soluciones tienen sentido para tu situación. diff --git a/i18n/es/os/windows/index.md b/i18n/es/os/windows/index.md index 7a640a26..2a62c2db 100644 --- a/i18n/es/os/windows/index.md +++ b/i18n/es/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Notas de Privacidad -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/fa/basics/common-threats.md b/i18n/fa/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/fa/basics/common-threats.md +++ b/i18n/fa/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/fa/basics/hardware.md b/i18n/fa/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/fa/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/fa/desktop-browsers.md b/i18n/fa/desktop-browsers.md index 40c2bac5..d6baaf3d 100644 --- a/i18n/fa/desktop-browsers.md +++ b/i18n/fa/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/fa/os/ios-overview.md b/i18n/fa/os/ios-overview.md index dc5971d8..25bd54bd 100644 --- a/i18n/fa/os/ios-overview.md +++ b/i18n/fa/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/fa/os/windows/index.md b/i18n/fa/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/fa/os/windows/index.md +++ b/i18n/fa/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/fr/basics/common-threats.md b/i18n/fr/basics/common-threats.md index be41a1f2..3baac013 100644 --- a/i18n/fr/basics/common-threats.md +++ b/i18n/fr/basics/common-threats.md @@ -189,4 +189,4 @@ Vous devez toujours tenir compte des risques encourus en essayant de contourner [^2]: Conseil de surveillance de la vie privée et des libertés civiles des États-Unis : [*Rapport sur le programme d'enregistrements téléphoniques mené en vertu de la section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipédia : [*Capitalisme de surveillance*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Énumérer la méchanceté](https://ranum.com/security/computer_security/editorials/dumb)" (ou "énumérer toutes les mauvaises choses que nous connaissons") comme le font de nombreux bloqueurs de contenu et programmes antivirus, ne permet pas de vous protéger correctement contre les menaces nouvelles et inconnues, car elles n'ont pas encore été ajoutées à la liste des filtres. Vous devriez également utiliser d'autres techniques d'atténuation. -[^5]: Nations Unies : [*Déclaration universelle des droits de l'homme*](https://www.un.org/fr/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/fr/basics/hardware.md b/i18n/fr/basics/hardware.md new file mode 100644 index 00000000..cf01fdfb --- /dev/null +++ b/i18n/fr/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Mises à jour du micrologiciel + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Avertissement

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Clés de sécurité matérielles + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Avertissement

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/fr/desktop-browsers.md b/i18n/fr/desktop-browsers.md index 07467360..e9af0d39 100644 --- a/i18n/fr/desktop-browsers.md +++ b/i18n/fr/desktop-browsers.md @@ -265,9 +265,7 @@ Brave ajoute un "[code d'affiliation](https://github.com/brave/brave-browser/wik Ces options se trouvent dans :material-menu: → **Paramètres**. -#### Settings - -##### Shields +#### Shields Brave inclut des mesures anti-empreintes digitales dans sa fonction [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields). Nous vous conseillons de configurer ces options de [manière globale](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) sur toutes les pages que vous visitez. @@ -275,7 +273,6 @@ Les options "Boucliers" peuvent être réduites par site selon les besoins, mais
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave vous permet de sélectionner des filtres de contenu supplémentaires dans - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave vous permet de sélectionner des filtres de contenu supplémentaires dans 1. Cette option offre des fonctionnalités similaires aux [modes de blocage](https://github.com/gorhill/uBlock/wiki/Blocking-mode) avancés de uBlock Origin. 2. Si vous souhaitez rester connecté à un site particulier que vous visitez souvent, vous pouvez définir des exceptions pour chaque site en cliquant sur l'icône Bouclier dans la barre d'adresse. -##### Privacy and security +#### Privacy and security
-- [x] Sélectionnez **Désactiver l'UDP pas en proxy** sous [Politique de gestion des adresses IP WebRTC](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) -- [ ] Décochez **Utiliser les services Google de messagerie push** -- [ ] Décochez **Autoriser l'analyse de produits respectueuse de la vie privée (P3A)** -- [ ] Décochez **Envoyer automatiquement un signal d'utilisation quotidienne à Brave** -- [ ] Décochez **Envoyer automatiquement les rapports de diagnostic** -- [ ] Décochez **Fenêtre privée avec Tor** (1) +- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* +- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) +- [ ] Uncheck **Use Google services for push messaging** +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave **n'est pas** aussi résistant à la prise d'empreinte numérique que le navigateur Tor et beaucoup moins de personnes utilisent Brave avec Tor, vous sortirez donc du lot. Lorsqu'un [fort anonymat est requis](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity), utilisez le [navigateur Tor](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Suppression à la fermeture

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Décochez toutes les extensions intégrées que vous n'utilisez pas +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Les fonctionnalités Web3 de Brave peuvent potentiellement ajouter à l'empreinte numérique de votre navigateur et à la surface d'attaque. À moins que vous n'utilisiez l'une ou l'autre de ces fonctions, elles devraient être désactivées. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Les fonctionnalités Web3 de Brave peuvent potentiellement ajouter à l'empreinte numérique de votre navigateur et à la surface d'attaque. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Définir *Méthode de résolution des ressources IPFS* sur **Désactivé** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/fr/os/ios-overview.md b/i18n/fr/os/ios-overview.md index 0c277d88..a1969b6d 100644 --- a/i18n/fr/os/ios-overview.md +++ b/i18n/fr/os/ios-overview.md @@ -227,4 +227,4 @@ Apple met toujours des versions bêta d'iOS à la disposition de ceux qui souhai ### Avant le premier déverrouillage -Si votre modèle de menace comprend des outils d'investigation et que vous souhaitez minimiser les risques d'utilisation d'exploits pour accéder à votre téléphone, vous devriez redémarrer votre appareil fréquemment. L'état *après* un redémarrage mais *avant* le déverrouillage de votre appareil est appelé "Before First Unlock" (BFU), et lorsque votre appareil est dans cet état, il est [nettement plus difficile](https://belkasoft.com/checkm8_glossary) pour les outils de criminalistique d'exploiter des vulnérabilités pour accéder à vos données. Cet état BFU vous permet de recevoir des notifications pour les appels, les textes et les alarmes, mais la plupart des données de votre appareil sont toujours chiffrées et inaccessibles. Cela peut s'avérer peu pratique, il convient donc de se demander si ces compromis sont judicieux dans votre situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. L'état *après* un redémarrage mais *avant* le déverrouillage de votre appareil est appelé "Before First Unlock" (BFU), et lorsque votre appareil est dans cet état, il est [nettement plus difficile](https://belkasoft.com/checkm8_glossary) pour les outils de criminalistique d'exploiter des vulnérabilités pour accéder à vos données. Cet état BFU vous permet de recevoir des notifications pour les appels, les textes et les alarmes, mais la plupart des données de votre appareil sont toujours chiffrées et inaccessibles. Cela peut s'avérer peu pratique, il convient donc de se demander si ces compromis sont judicieux dans votre situation. diff --git a/i18n/fr/os/windows/index.md b/i18n/fr/os/windows/index.md index 9ef8ac93..161190a6 100644 --- a/i18n/fr/os/windows/index.md +++ b/i18n/fr/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Remarques concernant la vie privée -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/he/basics/common-threats.md b/i18n/he/basics/common-threats.md index d08ce79d..f629d62d 100644 --- a/i18n/he/basics/common-threats.md +++ b/i18n/he/basics/common-threats.md @@ -189,4 +189,4 @@ If you're concerned about mass surveillance programs, you can use strategies lik [^2]: מועצת הפיקוח על הפרטיות וחירויות האזרח של ארצות הברית: [*דיווח על תוכנית רישומי הטלפון שנערכה לפי סעיף 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: ויקיפדיה: [*מעקב קפיטליזם*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. אתה צריך גם להשתמש בטכניקות הפחתה אחרות. -[^5]: האומות המאוחדות: [*הכרזה אוניברסלית על זכויות אדם*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/he/basics/hardware.md b/i18n/he/basics/hardware.md new file mode 100644 index 00000000..fdab19fb --- /dev/null +++ b/i18n/he/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### עדכוני קושחה + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### מפתחות אבטחה של חומרה + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/he/desktop-browsers.md b/i18n/he/desktop-browsers.md index e0326672..403409dd 100644 --- a/i18n/he/desktop-browsers.md +++ b/i18n/he/desktop-browsers.md @@ -265,9 +265,7 @@ Brave מוסיף "[קוד הפניה](https://github.com/brave/brave-browser/wik ניתן למצוא אפשרויות אלה ב - :material-menu: ← **הגדרות**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Brave includes some anti-fingerprinting measures in its [Shields](https://suppor
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave הוא **לא** עמיד בפני טביעת אצבע כמו דפדפן Tor והרבה פחות אנשים משתמשים אמיץ עם Tor, כך תוכל להתבלט. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -תכונות ה-Web3 של Brave עשויות להוסיף לטביעת האצבע של הדפדפן ולשטח ההתקפה שלך. אלא אם אתה משתמש באחת מהתכונות, יש להשבית אותן. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +תכונות ה-Web3 של Brave עשויות להוסיף לטביעת האצבע של הדפדפן ולשטח ההתקפה שלך. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/he/os/ios-overview.md b/i18n/he/os/ios-overview.md index 2c6890c9..130ec90e 100644 --- a/i18n/he/os/ios-overview.md +++ b/i18n/he/os/ios-overview.md @@ -227,4 +227,4 @@ This is disabled by default and cannot be changed for users under 18. ### לפני הפתיחה הראשונה -אם מודל האיום שלך כולל כלים פורנזיים ואתה רוצה למזער את הסיכוי של ניצול שימוש כדי לגשת לטלפון שלך, עליך להפעיל מחדש את המכשיר לעתים קרובות. המצב *אחרי* אתחול מחדש אך *לפני* ביטול נעילת המכשיר שלך מכונה "לפני ביטול נעילה ראשון" (BFU), וכאשר המכשיר שלך נמצא במצב זה, זה מקשה [באופן משמעותי](https://belkasoft.com/checkm8_glossary) עבור כלים משפטיים לנצל נקודות תורפה כדי לגשת לנתונים שלך. מצב BFU זה מאפשר לך לקבל התראות על שיחות, הודעות טקסט והתראות, אך רוב הנתונים במכשיר שלך עדיין מוצפנים ואינם נגישים. זה יכול להיות לא מעשי, אז שקול אם הפשרות האלה הגיוניות למצב שלך. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. המצב *אחרי* אתחול מחדש אך *לפני* ביטול נעילת המכשיר שלך מכונה "לפני ביטול נעילה ראשון" (BFU), וכאשר המכשיר שלך נמצא במצב זה, זה מקשה [באופן משמעותי](https://belkasoft.com/checkm8_glossary) עבור כלים משפטיים לנצל נקודות תורפה כדי לגשת לנתונים שלך. מצב BFU זה מאפשר לך לקבל התראות על שיחות, הודעות טקסט והתראות, אך רוב הנתונים במכשיר שלך עדיין מוצפנים ואינם נגישים. זה יכול להיות לא מעשי, אז שקול אם הפשרות האלה הגיוניות למצב שלך. diff --git a/i18n/he/os/windows/index.md b/i18n/he/os/windows/index.md index bd0ae2c0..22a7b27f 100644 --- a/i18n/he/os/windows/index.md +++ b/i18n/he/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## הערות פרטיות -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/hi/basics/common-threats.md b/i18n/hi/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/hi/basics/common-threats.md +++ b/i18n/hi/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/hi/basics/hardware.md b/i18n/hi/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/hi/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/hi/desktop-browsers.md b/i18n/hi/desktop-browsers.md index b7bba6eb..ec7094f4 100644 --- a/i18n/hi/desktop-browsers.md +++ b/i18n/hi/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/hi/os/ios-overview.md b/i18n/hi/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/hi/os/ios-overview.md +++ b/i18n/hi/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/hi/os/windows/index.md b/i18n/hi/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/hi/os/windows/index.md +++ b/i18n/hi/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/hu/basics/common-threats.md b/i18n/hu/basics/common-threats.md index 103af8d1..065f8618 100644 --- a/i18n/hu/basics/common-threats.md +++ b/i18n/hu/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/hu/basics/hardware.md b/i18n/hu/basics/hardware.md new file mode 100644 index 00000000..d9306f15 --- /dev/null +++ b/i18n/hu/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware-frissítések + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Figyelmeztetés

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Figyelmeztetés

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/hu/desktop-browsers.md b/i18n/hu/desktop-browsers.md index 24b10481..f3181c87 100644 --- a/i18n/hu/desktop-browsers.md +++ b/i18n/hu/desktop-browsers.md @@ -266,9 +266,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -276,7 +274,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -289,6 +286,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -297,42 +295,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/hu/os/ios-overview.md b/i18n/hu/os/ios-overview.md index 5997fdfa..668186b7 100644 --- a/i18n/hu/os/ios-overview.md +++ b/i18n/hu/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Az első feloldás előtt -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/hu/os/windows/index.md b/i18n/hu/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/hu/os/windows/index.md +++ b/i18n/hu/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/id/basics/common-threats.md b/i18n/id/basics/common-threats.md index b347d939..b2b92010 100644 --- a/i18n/id/basics/common-threats.md +++ b/i18n/id/basics/common-threats.md @@ -189,4 +189,4 @@ Anda harus selalu mempertimbangkan risiko mencoba menerobos sensor, konsekuensi [^2]: Badan Pengawasan Privasi dan Kebebasan Sipil Amerika Serikat: [*Laporan tentang Program Rekaman Telepon yang Dilakukan berdasarkan Pasal 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Kapitalisme pengawasan*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Anda juga harus menggunakan teknik mitigasi lainnya. -[^5]: Perserikatan Bangsa-Bangsa: [*Deklarasi Universal Hak Asasi Manusia*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/id/basics/hardware.md b/i18n/id/basics/hardware.md new file mode 100644 index 00000000..8929718e --- /dev/null +++ b/i18n/id/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Pembaruan Firmware + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/id/desktop-browsers.md b/i18n/id/desktop-browsers.md index 75c9249b..25e44eb4 100644 --- a/i18n/id/desktop-browsers.md +++ b/i18n/id/desktop-browsers.md @@ -265,9 +265,7 @@ Brave menambahkan "[kode rujukan](https://github.com/brave/brave-browser/wiki/Br These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Perisai +#### Perisai Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/id/os/ios-overview.md b/i18n/id/os/ios-overview.md index a550a1fa..4962fa0b 100644 --- a/i18n/id/os/ios-overview.md +++ b/i18n/id/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/id/os/windows/index.md b/i18n/id/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/id/os/windows/index.md +++ b/i18n/id/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/it/basics/common-threats.md b/i18n/it/basics/common-threats.md index 6ad46798..4f0f710d 100644 --- a/i18n/it/basics/common-threats.md +++ b/i18n/it/basics/common-threats.md @@ -189,4 +189,4 @@ Devi sempre considerare i rischi di provare a eludere la censura, le potenziali [^2]: Comitato di Supervisione delle Libertà Civili e della Privacy degli Stati Uniti: [*Rapporto sul Programma dei registri telefonici condotto ai sensi della Sezione 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Capitalismo di sorveglianza*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (o, "elencare tutte le cose cattive che conosciamo"), come molti blocker di contenuti e programmi antivirus fanno, non riesce a proteggerti adeguatamente da minacce nuove e sconosciute perché non sono ancora state aggiunte alla lista dei filtri. Inoltre, dovresti utilizzare altre tecniche di mitigazione. -[^5]: Nazioni Unite: [*Dichiarazione Universale dei Diritti dell'Uomo*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/it/basics/hardware.md b/i18n/it/basics/hardware.md new file mode 100644 index 00000000..2f96be35 --- /dev/null +++ b/i18n/it/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Aggiornamenti del firmware + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Nota

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Avviso

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Chiavi di Sicurezza Hardware + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Avviso

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Nota

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/it/desktop-browsers.md b/i18n/it/desktop-browsers.md index daba728d..4c2ea276 100644 --- a/i18n/it/desktop-browsers.md +++ b/i18n/it/desktop-browsers.md @@ -265,9 +265,7 @@ Brave aggiunge un "[codice di riferimento](https://github.com/brave/brave-browse Queste opzioni si possono trovare in :material-menu: → **Impostazioni**. -#### Settings - -##### Shields +#### Shields Brave include delle misure anti-impronta digitale nella sua funzionalità, [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields). Suggeriamo di configurare queste opzioni [globalmente](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) tra tutte le pagine che visiti. @@ -275,7 +273,6 @@ Le opzioni di Protezioni sono regolabili per ogni sito ma consigliamo di imposta
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave consente di selezionare filtri aggiuntivi per i contenuti nella pagina int - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave consente di selezionare filtri aggiuntivi per i contenuti nella pagina int 1. Questa opzione offre una funzionalità simile alle [modalità di blocco](https://github.com/gorhill/uBlock/wiki/Blocking-mode) avanzate di uBlock Origin. 2. Se desideri mantenere l'accesso in un particolare sito che visiti spesso, puoi selezionare le eccezioni per ogni sito cliccando sull'icona dello scudo sulla barra degli indirizzi. -##### Privacy and security +#### Privacy and security
-- [x] Seleziona **Disabilita UDP senza proxy** sotto [Gestione politica IP WebRTC](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) -- [ ] Rimuovi la spunta da **Utilizza i servizi Google per la messaggistica push** -- [ ] Rimuovi la spunta da **Acconsenti all'analisi dei prodotti di tutela della privacy (P3A)** -- [ ] Rimuovi la spunta da **Invia automaticamente un ping di utilizzo giornaliero a Brave** -- [ ] Rimuovi la spunta da **Invia automaticamente i rapporti di diagnostica** -- [ ] Rimuovi la spunta da **Finestra in Incognito con Tor** (1) +- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* +- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) +- [ ] Uncheck **Use Google services for push messaging** +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave **non è** resistente al fingerprinting come il Tor Browser e molte meno persone utilizzano Brave con Tor, facendoti quindi distinguere. Dove [è richiesto un forte anonimato](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) utilizzare [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizzazione alla chiusura

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Le funzionalità Web3 di Brave possono potenzialmente aumentare il fingerprint del browser e la superficie di attacco. Disattiva le funzioni, a meno che tu non le utilizzi. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Le funzionalità Web3 di Brave possono potenzialmente aumentare il fingerprint del browser e la superficie di attacco. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/it/os/ios-overview.md b/i18n/it/os/ios-overview.md index f838468c..03328d0b 100644 --- a/i18n/it/os/ios-overview.md +++ b/i18n/it/os/ios-overview.md @@ -227,4 +227,4 @@ Apple rende sempre disponibili per versioni beta di iOS in anticipo, per coloro ### Prima del Primo Sblocco -Se il tuo modello di minaccia include strumenti forensi e desideri minimizzare le probabilità di exploit utilizzati per accedere al tuo telefono, dovresti riavviare frequentemente il tuo dispositivo. Lo stato *successivo* a un riavvio, ma *antecedente* allo sblocco del tuo dispositivo è noto come "Prima del Primo Sblocco" (BFU) e, quando il tuo dispositivo è in tale stato, rende [significativamente più difficile](https://belkasoft.com/checkm8_glossary), per gli strumenti forensi, di sfruttare vulnerabilità per accedere ai tuoi dati. Questo stato BFU ti consente di ricevere notifiche per le chiamate, i messaggi e le sveglie, ma gran parte dei dati sul tuo dispositivo sono ancora crittografati e inaccessibili. Ciò può essere poco pratico, quindi, considera se tali compromessi hanno senso per la tua situazione. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. Lo stato *successivo* a un riavvio, ma *antecedente* allo sblocco del tuo dispositivo è noto come "Prima del Primo Sblocco" (BFU) e, quando il tuo dispositivo è in tale stato, rende [significativamente più difficile](https://belkasoft.com/checkm8_glossary), per gli strumenti forensi, di sfruttare vulnerabilità per accedere ai tuoi dati. Questo stato BFU ti consente di ricevere notifiche per le chiamate, i messaggi e le sveglie, ma gran parte dei dati sul tuo dispositivo sono ancora crittografati e inaccessibili. Ciò può essere poco pratico, quindi, considera se tali compromessi hanno senso per la tua situazione. diff --git a/i18n/it/os/windows/index.md b/i18n/it/os/windows/index.md index 85a592f7..f7df3fa6 100644 --- a/i18n/it/os/windows/index.md +++ b/i18n/it/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Note sulla Privacy -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/ja/basics/common-threats.md b/i18n/ja/basics/common-threats.md index 8fa5fd2c..d270de4b 100644 --- a/i18n/ja/basics/common-threats.md +++ b/i18n/ja/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: 国連：[*世界人権宣言*](https://www.un.org/en/about-us/universal-declaration-of-human-rights) +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/ja/basics/hardware.md b/i18n/ja/basics/hardware.md new file mode 100644 index 00000000..b2d5bb50 --- /dev/null +++ b/i18n/ja/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### ファームウェアの更新 + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### ハードウェアセキュリティ + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/ja/desktop-browsers.md b/i18n/ja/desktop-browsers.md index 62bed509..82965844 100644 --- a/i18n/ja/desktop-browsers.md +++ b/i18n/ja/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% これらのオプションは :material-menu: → **設定**にあります。 -#### Settings - -##### シールド +#### シールド Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Brave includes some anti-fingerprinting measures in its [Shields](https://suppor
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. BraveはTor Browserほどフィンガープリントに対して強く**なく**、BraveでTorを使う人はずっと少ないため目立ってしまうでしょう。 Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -BraveのWeb3機能はブラウザのフィンガープリントなど攻撃面を潜在的に増やす可能性があります。 どの機能も使用しないなら、無効にしておくべきです。 +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +BraveのWeb3機能はブラウザのフィンガープリントなど攻撃面を潜在的に増やす可能性があります。 Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/ja/os/ios-overview.md b/i18n/ja/os/ios-overview.md index 24778a01..860771d3 100644 --- a/i18n/ja/os/ios-overview.md +++ b/i18n/ja/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/ja/os/windows/index.md b/i18n/ja/os/windows/index.md index d3456b06..9990fc44 100644 --- a/i18n/ja/os/windows/index.md +++ b/i18n/ja/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## プライバシーに関する注意事項 -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/ko/basics/common-threats.md b/i18n/ko/basics/common-threats.md index 3119c462..7dd6b6f7 100644 --- a/i18n/ko/basics/common-threats.md +++ b/i18n/ko/basics/common-threats.md @@ -189,4 +189,4 @@ Twitter, Facebook 같은 플랫폼이 대중의 요구, 시장의 압력, 정부 [^2]: 미국 프라이버시 및 시민 자유 감독 위원회: [*215조항에 따라 수행된 전화 통화 기록 프로그램에 대한 보고서*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. 다른 완화 기술도 추가로 사용해야 합니다. -[^5]: UN: [*세계 인권 선언*](https://www.un.org/en/about-us/universal-declaration-of-human-rights) +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/ko/basics/hardware.md b/i18n/ko/basics/hardware.md new file mode 100644 index 00000000..5c899703 --- /dev/null +++ b/i18n/ko/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### 펌웨어 업데이트 + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### 하드웨어 보안 키 + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/ko/desktop-browsers.md b/i18n/ko/desktop-browsers.md index a9a5c08d..cd31c416 100644 --- a/i18n/ko/desktop-browsers.md +++ b/i18n/ko/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% 이러한 옵션은 :material-menu: → **설정**에서 확인할 수 있습니다. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Brave includes some anti-fingerprinting measures in its [Shields](https://suppor
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave 브라우저의 핑거프린팅 방지 기능은 Tor 브라우저만큼 강력하지 **않습니다**. 또한 Brave에서 Tor를 사용하는 사람은 훨씬 적기 때문에, 더욱 눈에 띄게 됩니다. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave의 Web3 기능은 잠재적으로 브라우저의 핑거프린트와 공격 표면을 증가시킬 수 있습니다. 여러분이 해당 기능을 사용하지 않는다면 비활성화해야 합니다. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave의 Web3 기능은 잠재적으로 브라우저의 핑거프린트와 공격 표면을 증가시킬 수 있습니다. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/ko/os/ios-overview.md b/i18n/ko/os/ios-overview.md index 3ab771dc..ddc3cf75 100644 --- a/i18n/ko/os/ios-overview.md +++ b/i18n/ko/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/ko/os/windows/index.md b/i18n/ko/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/ko/os/windows/index.md +++ b/i18n/ko/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/ku-IQ/basics/common-threats.md b/i18n/ku-IQ/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/ku-IQ/basics/common-threats.md +++ b/i18n/ku-IQ/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/ku-IQ/basics/hardware.md b/i18n/ku-IQ/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/ku-IQ/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/ku-IQ/desktop-browsers.md b/i18n/ku-IQ/desktop-browsers.md index b7bba6eb..ec7094f4 100644 --- a/i18n/ku-IQ/desktop-browsers.md +++ b/i18n/ku-IQ/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/ku-IQ/os/ios-overview.md b/i18n/ku-IQ/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/ku-IQ/os/ios-overview.md +++ b/i18n/ku-IQ/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/ku-IQ/os/windows/index.md b/i18n/ku-IQ/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/ku-IQ/os/windows/index.md +++ b/i18n/ku-IQ/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/nl/basics/common-threats.md b/i18n/nl/basics/common-threats.md index 81a4831e..2c17887a 100644 --- a/i18n/nl/basics/common-threats.md +++ b/i18n/nl/basics/common-threats.md @@ -189,4 +189,4 @@ Je moet altijd rekening houden met de risico 's van het proberen om censuur te o [^2]: Wikipedia: [Surveillance kapitalisme](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^3]: Wikipedia: [*Surveillancekapitalisme*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Je moet ook andere mitigatietechnieken gebruiken. -[^5]: Verenigde Naties: [*Universele Verklaring van de Rechten van de Mens*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/nl/basics/hardware.md b/i18n/nl/basics/hardware.md new file mode 100644 index 00000000..2abade67 --- /dev/null +++ b/i18n/nl/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware-updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Veiligheidssleutels + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/nl/desktop-browsers.md b/i18n/nl/desktop-browsers.md index 6a5df844..478e6975 100644 --- a/i18n/nl/desktop-browsers.md +++ b/i18n/nl/desktop-browsers.md @@ -258,9 +258,7 @@ Brave voegt een "[referral code](https://github.com/brave/brave-browser/wiki/Bra Deze opties zijn te vinden in :material-menu: → **Instellingen**. -#### Settings - -##### Schilden +#### Schilden Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -268,7 +266,6 @@ De opties van Shields kunnen naar behoefte per site worden gedowngrade, maar sta
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -281,6 +278,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -289,42 +287,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **niet** zo resistent tegen vingerafdrukken als de Tor Browser en veel minder mensen gebruiken Brave met Tor, dus zal je opvallen. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -De Web3-functies van Brave kunnen de vingerafdruk van jouw browser en het aanvalsoppervlak vergroten. Tenzij je een van de functies gebruikt, moeten ze worden uitgeschakeld. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +De Web3-functies van Brave kunnen de vingerafdruk van jouw browser en het aanvalsoppervlak vergroten. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/nl/os/ios-overview.md b/i18n/nl/os/ios-overview.md index 83d128fd..e11326d3 100644 --- a/i18n/nl/os/ios-overview.md +++ b/i18n/nl/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/nl/os/windows/index.md b/i18n/nl/os/windows/index.md index 301b355c..2e374f6e 100644 --- a/i18n/nl/os/windows/index.md +++ b/i18n/nl/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Opmerkingen -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/pl/basics/common-threats.md b/i18n/pl/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/pl/basics/common-threats.md +++ b/i18n/pl/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/pl/basics/hardware.md b/i18n/pl/basics/hardware.md new file mode 100644 index 00000000..ff19bfbd --- /dev/null +++ b/i18n/pl/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Aktualizacje oprogramowania + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/pl/desktop-browsers.md b/i18n/pl/desktop-browsers.md index 987f49c8..d56079ab 100644 --- a/i18n/pl/desktop-browsers.md +++ b/i18n/pl/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/pl/os/ios-overview.md b/i18n/pl/os/ios-overview.md index 3e69a5f4..830c3c67 100644 --- a/i18n/pl/os/ios-overview.md +++ b/i18n/pl/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/pl/os/windows/index.md b/i18n/pl/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/pl/os/windows/index.md +++ b/i18n/pl/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/pt-BR/basics/common-threats.md b/i18n/pt-BR/basics/common-threats.md index 90f09b84..2b5e0cba 100644 --- a/i18n/pt-BR/basics/common-threats.md +++ b/i18n/pt-BR/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/pt-BR/basics/hardware.md b/i18n/pt-BR/basics/hardware.md new file mode 100644 index 00000000..579b9a2d --- /dev/null +++ b/i18n/pt-BR/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Atualizações de Firmware + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/pt-BR/desktop-browsers.md b/i18n/pt-BR/desktop-browsers.md index 39a30e0c..44e62fa6 100644 --- a/i18n/pt-BR/desktop-browsers.md +++ b/i18n/pt-BR/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% Essas opções podem ser encontradas em :material-menu: → **Configurações**. -#### Settings - -##### Shields (Escudos) +#### Shields (Escudos) Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ As opções do Shields podem ser reduzidas para cada site caso necessário, mas
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. O Brave **não** é tão resistente a impressões digitais como o Tor Browser e muito menos pessoas utilizam o Brave com o Tor, então você se destacará. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -As funcionalidades Web3 do Brave podem potencialmente acrescentar à impressão digital do seu navegador e a superfície de ataque. A menos que utilize alguma destas funcionalidades, elas devem estar desativadas. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +As funcionalidades Web3 do Brave podem potencialmente acrescentar à impressão digital do seu navegador e a superfície de ataque. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/pt-BR/os/ios-overview.md b/i18n/pt-BR/os/ios-overview.md index 4360f2a9..e18f9315 100644 --- a/i18n/pt-BR/os/ios-overview.md +++ b/i18n/pt-BR/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/pt-BR/os/windows/index.md b/i18n/pt-BR/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/pt-BR/os/windows/index.md +++ b/i18n/pt-BR/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/pt/basics/common-threats.md b/i18n/pt/basics/common-threats.md index 0350d5d2..97f47cda 100644 --- a/i18n/pt/basics/common-threats.md +++ b/i18n/pt/basics/common-threats.md @@ -189,4 +189,4 @@ Deve sempre considerar os riscos de tentar contornar a censura, as possíveis co [^2]: Conselho de Supervisão de Privacidade e Liberdades Civis dos Estados Unidos: [*Relatório sobre o Programa de Registos Telefónicos Conduzido ao abrigo da Secção 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Capitalismo de vigilância<*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Deve empregar outras técnicas de mitigação. -[^5]: Nações Unidas: [*Declaração Universal dos Direitos Humanos *](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/pt/basics/hardware.md b/i18n/pt/basics/hardware.md new file mode 100644 index 00000000..300e8070 --- /dev/null +++ b/i18n/pt/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Chaves de Segurança de Hardware + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/pt/desktop-browsers.md b/i18n/pt/desktop-browsers.md index 0ebabcf7..f1316c56 100644 --- a/i18n/pt/desktop-browsers.md +++ b/i18n/pt/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% Estas opções podem ser encontradas em :material-menu: → **Definições...**. -#### Settings - -##### Proteções +#### Proteções Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ As opções de proteção podem ser revogadas por cada site, de acordo com as ne
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. O Brave **não é** tão resistente à recolha de impressões digitais como o Tor e muito menos pessoas utilizam o Brave com o Tor, pelo que a sua presença se destacará. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -As funcionalidades Web3 do Brave podem potencialmente aumentar a impressão digital do seu browser e a superfície de ataque. A menos que utilize alguma destas funcionalidades, desative-as. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +As funcionalidades Web3 do Brave podem potencialmente aumentar a impressão digital do seu browser e a superfície de ataque. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/pt/os/ios-overview.md b/i18n/pt/os/ios-overview.md index b9a193af..19256782 100644 --- a/i18n/pt/os/ios-overview.md +++ b/i18n/pt/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/pt/os/windows/index.md b/i18n/pt/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/pt/os/windows/index.md +++ b/i18n/pt/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/ru/basics/common-threats.md b/i18n/ru/basics/common-threats.md index ea996533..51da8988 100644 --- a/i18n/ru/basics/common-threats.md +++ b/i18n/ru/basics/common-threats.md @@ -189,4 +189,4 @@ If you're concerned about mass surveillance programs, you can use strategies lik [^2]: Совет по надзору за соблюдением конфиденциальности и гражданских свобод США: [*Отчет о программе записи телефонных разговоров, проводимой в соответствии с разделом 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Вы также должны использовать другие методы смягчения последствий. -[^5]: Организация Объединенных Наций: [*Всеобщая декларация прав человека*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/ru/basics/hardware.md b/i18n/ru/basics/hardware.md new file mode 100644 index 00000000..6f05613f --- /dev/null +++ b/i18n/ru/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Обновления прошивки + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Предупреждение

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Аппаратные ключи безопасности + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Предупреждение

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/ru/desktop-browsers.md b/i18n/ru/desktop-browsers.md index b6807d21..a6c3c2ee 100644 --- a/i18n/ru/desktop-browsers.md +++ b/i18n/ru/desktop-browsers.md @@ -265,9 +265,7 @@ Brave добавляет "[реферальный код](https://github. om/bra Эти параметры можно найти в разделе :material-menu: → **Настройки**. -#### Settings - -##### Щиты +#### Щиты Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Brave includes some anti-fingerprinting measures in its [Shields](https://suppor
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. Если вы хотите оставаться залогиненными на определенном сайте, который вы часто посещаете, вы можете установить исключения для каждого сайта, нажав на значок щита в адресной строке. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave **не так устойчив** к цифровым отпечаткам, как Tor Browser, и гораздо меньше людей используют Brave вместе с Tor, поэтому ты будешь выделяться. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Функции Web3 в Brave потенциально могут увеличить цифровой отпечаток твоего браузера и площадь атаки. Если ты не используешь эти функции, их следует отключить. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Функции Web3 в Brave потенциально могут увеличить цифровой отпечаток твоего браузера и площадь атаки. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/ru/os/ios-overview.md b/i18n/ru/os/ios-overview.md index e38a6bb3..96f86a11 100644 --- a/i18n/ru/os/ios-overview.md +++ b/i18n/ru/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/ru/os/windows/index.md b/i18n/ru/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/ru/os/windows/index.md +++ b/i18n/ru/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/sv/basics/common-threats.md b/i18n/sv/basics/common-threats.md index d0023469..d6688f54 100644 --- a/i18n/sv/basics/common-threats.md +++ b/i18n/sv/basics/common-threats.md @@ -189,4 +189,4 @@ Du måste alltid överväga riskerna med att försöka kringgå censur, de poten [^2]: Usa: s tillsynsnämnd för integritet och medborgerliga fri- och rättigheter: [*Rapport om telefonregistreringsprogrammet som genomförts enligt avsnitt 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Övervakningskapitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Du bör också använda andra metoder för att minska risken. -[^5]: Förenta nationerna: [*Universella förklaringen om de mänskliga rättigheterna*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/sv/basics/hardware.md b/i18n/sv/basics/hardware.md new file mode 100644 index 00000000..d672ea84 --- /dev/null +++ b/i18n/sv/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Varning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hårdvarusäkerhetsnycklar + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Varning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/sv/desktop-browsers.md b/i18n/sv/desktop-browsers.md index ff4f31a5..a49e099c 100644 --- a/i18n/sv/desktop-browsers.md +++ b/i18n/sv/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Sköldar +#### Sköldar Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields alternativ kan nedgraderas vid behov för varje enskild plats, men som s
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Tillägg +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Tillägg + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/sv/os/ios-overview.md b/i18n/sv/os/ios-overview.md index 5b1e426f..492d04cb 100644 --- a/i18n/sv/os/ios-overview.md +++ b/i18n/sv/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/sv/os/windows/index.md b/i18n/sv/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/sv/os/windows/index.md +++ b/i18n/sv/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/tr/basics/common-threats.md b/i18n/tr/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/tr/basics/common-threats.md +++ b/i18n/tr/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/tr/basics/hardware.md b/i18n/tr/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/tr/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/tr/desktop-browsers.md b/i18n/tr/desktop-browsers.md index 50852f07..5607571a 100644 --- a/i18n/tr/desktop-browsers.md +++ b/i18n/tr/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/tr/os/ios-overview.md b/i18n/tr/os/ios-overview.md index c23dc5f4..14826451 100644 --- a/i18n/tr/os/ios-overview.md +++ b/i18n/tr/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/tr/os/windows/index.md b/i18n/tr/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/tr/os/windows/index.md +++ b/i18n/tr/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/uk/basics/common-threats.md b/i18n/uk/basics/common-threats.md index 9788b622..5f461b22 100644 --- a/i18n/uk/basics/common-threats.md +++ b/i18n/uk/basics/common-threats.md @@ -189,4 +189,4 @@ If you're concerned about mass surveillance programs, you can use strategies lik [^2]: Рада з нагляду за дотриманням приватності та громадянських свобод США: [*Звіт про програму прослуховування телефонних розмов, здійснену відповідно до Розділу 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Вікіпедія: [*Капіталізм нагляду*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. Ви також повинні використовувати інші методи пом'якшення. -[^5]: Організація Об'єднаних Націй: [*Декларація про права людини*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/uk/basics/hardware.md b/i18n/uk/basics/hardware.md new file mode 100644 index 00000000..18c6dae5 --- /dev/null +++ b/i18n/uk/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Оновлення мікропрограми + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/uk/desktop-browsers.md b/i18n/uk/desktop-browsers.md index 82796774..c4328fb3 100644 --- a/i18n/uk/desktop-browsers.md +++ b/i18n/uk/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/uk/os/ios-overview.md b/i18n/uk/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/uk/os/ios-overview.md +++ b/i18n/uk/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/uk/os/windows/index.md b/i18n/uk/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/uk/os/windows/index.md +++ b/i18n/uk/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/vi/basics/common-threats.md b/i18n/vi/basics/common-threats.md index 231bf687..7d8bf19a 100644 --- a/i18n/vi/basics/common-threats.md +++ b/i18n/vi/basics/common-threats.md @@ -189,4 +189,4 @@ You must always consider the risks of trying to bypass censorship, the potential [^2]: United States Privacy and Civil Liberties Oversight Board: [*Report on the Telephone Records Program Conducted under Section 215*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: Wikipedia: [*Surveillance capitalism*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. You should also employ other mitigation techniques. -[^5]: United Nations: [*Universal Declaration of Human Rights*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/vi/basics/hardware.md b/i18n/vi/basics/hardware.md new file mode 100644 index 00000000..4b795a9a --- /dev/null +++ b/i18n/vi/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### Firmware Updates + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

Warning

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### Hardware Security Keys + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

Warning

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/vi/desktop-browsers.md b/i18n/vi/desktop-browsers.md index 6f3619f8..bb0495ac 100644 --- a/i18n/vi/desktop-browsers.md +++ b/i18n/vi/desktop-browsers.md @@ -265,9 +265,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% These options can be found in :material-menu: → **Settings**. -#### Settings - -##### Shields +#### Shields Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -275,7 +273,6 @@ Shields' options can be downgraded on a per-site basis as needed, but by default
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -288,6 +285,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -296,42 +294,54 @@ Brave allows you to select additional content filters within the internal `brave 1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of features, they should be disabled. +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* +#### Web3 + +Brave's Web3 features can potentially add to your browser fingerprint and attack surface. Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/vi/os/ios-overview.md b/i18n/vi/os/ios-overview.md index 293a0554..b0935919 100644 --- a/i18n/vi/os/ios-overview.md +++ b/i18n/vi/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/vi/os/windows/index.md b/i18n/vi/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/vi/os/windows/index.md +++ b/i18n/vi/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/zh-Hant/basics/common-threats.md b/i18n/zh-Hant/basics/common-threats.md index ddbbaf4a..680c5a26 100644 --- a/i18n/zh-Hant/basics/common-threats.md +++ b/i18n/zh-Hant/basics/common-threats.md @@ -189,4 +189,4 @@ description: 您的威脅模型雖說是個人的事，但它也是本站許多 [^2]: 美國隱私和公民自由監督委員會： [*根據第 215 條進行的電話記錄計劃的報告*](https://documents.pclob.gov/prod/Documents/OversightReport/ec542143-1079-424a-84b3-acc354698560/215-Report_on_the_Telephone_Records_Program.pdf) [^3]: 維基百科: [*監控資本主義*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: “[枚舉壞處](https://ranum.com/security/computer_security/editorials/dumb)” （或“列出所知的全部壞事” ），未能充分保護您免受新的和未知的威脅，因為許多內容攔截程式和防病毒程式尚未被添加到過濾器列表。 您還應採用其他緩解技術。 -[^5]: 聯合國： [*《世界人權宣言》*](https://www.un.org/en/about-us/universal-declaration-of-human-rights). +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/zh-Hant/basics/hardware.md b/i18n/zh-Hant/basics/hardware.md new file mode 100644 index 00000000..1b9b15fb --- /dev/null +++ b/i18n/zh-Hant/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### 韌體更新 + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

備註

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

警告

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### 硬件安全金鑰 + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

警告

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

備註

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/zh-Hant/desktop-browsers.md b/i18n/zh-Hant/desktop-browsers.md index ec4dcb21..810f95cb 100644 --- a/i18n/zh-Hant/desktop-browsers.md +++ b/i18n/zh-Hant/desktop-browsers.md @@ -265,9 +265,7 @@ Brave 在官網的下載檔案中新增了 "[推廣代碼](https://github.com/br 這些選項可以在 :material-menu: → **設定** 中找到。 -#### Settings - -##### 防護 +#### 防護 Brave 的[防護](https://support.brave.com/hc/articles/360022973471-What-is-Shields)功能包含一些防指紋識別措施。 我們建議在您訪問的所有網頁上[全域](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings)套用這些設定。 @@ -275,8 +273,7 @@ Brave 的[防護](https://support.brave.com/hc/articles/360022973471-What-is-Shi
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** -- [x] 將 *追蹤器與廣告封鎖* 設定為 **積極** +- [x] Select **Aggressive** under *Trackers & ads blocking*
使用預設過濾器列表 @@ -287,6 +284,7 @@ Brave 可在內部 `brave://adblock`頁面中選擇其他內容過濾器。 我 - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -295,42 +293,54 @@ Brave 可在內部 `brave://adblock`頁面中選擇其他內容過濾器。 我 1. 此選項提供的功能類似於 uBlock Origin 的進階[封鎖模式](https://github.com/gorhill/uBlock/wiki/Blocking-mode)。 2. 若想在經常造訪的特定站點保持登入，則可以透過網址列中的盾牌圖示來為每個站點設定例外。 -##### Privacy and security +#### Privacy and security
-- [x] 將 [WebRTC IP 處理政策](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) 設定為 **停用非代理 UDP** -- [ ] 取消勾選 **使用 Google 服務來推播訊息** -- [ ] 取消勾選 **允許保護私隱的產品分析 (P3A)** -- [ ] 取消勾選 **自動傳送每日使用 ping 到 Brave** -- [ ] 取消勾選 **自動傳送診斷報告** -- [ ] 取消勾選 **使用 Tor 的隱私視窗** (1) +- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* +- [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) +- [ ] Uncheck **Use Google services for push messaging** +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave 在瀏覽器指紋識別的隱藏能力**不如** Tor 瀏覽器，且使用 Brave 的 Tor 使用者少，因此這將會使您顯得突出。 在[需要強大匿名性](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity)的情況下，請使用 [Tor 瀏覽器](tor.md#tor-browser)。 +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

離開時清除資料

-- [x] 在 *網站與 Shields 設定* 選單中的“內容”下，點擊 *網站在裝置端的資料* 選單後，選擇 **在所有視窗關閉後刪除網站儲存到裝置的資料** 。 +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. 如果希望在經常訪問的特定網站上保持登入，可在「自訂設定」部分下針對每個網站設定例外。
-##### Extensions +##### Tor windows -- [ ] 取消勾選所有您用不到的內建擴充功能 +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave 的 Web3 功能可能會增加您的瀏覽器指紋和攻擊面。 除非有用到任何功能，否則應停用這些功能。 +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- 將預設的 *以太坊* 與 *Solana* 錢包設定為 **擴充功能 (無後援)** +#### Web3 + +Brave 的 Web3 功能可能會增加您的瀏覽器指紋和攻擊面。 Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - 將 *解析 IPFS 資源的方法* 設定為 **已停用** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + +#### System
diff --git a/i18n/zh-Hant/os/ios-overview.md b/i18n/zh-Hant/os/ios-overview.md index e52a98e6..5624668d 100644 --- a/i18n/zh-Hant/os/ios-overview.md +++ b/i18n/zh-Hant/os/ios-overview.md @@ -227,4 +227,4 @@ Apple 會為那些希望幫助查找和報告錯誤的人先提供 iOS 測試版 ### Before First Unlock(初次解鎖之前) -如果您的威脅模型包含鑑識工具，且希望最大程度地減少他人利用漏洞訪問手機的可能性，則應經常重新啟動設備。 重啟後**解鎖設備**之前的狀態稱為“首次解鎖之前”(BFU) ，當設備處於該狀態時，取證鑑識工具[明顯更加困難](https://belkasoft.com/checkm8_glossary)利用漏洞訪問您的資料。 此 BFU 狀態允許您接收電話、簡訊和鬧鐘通知，但設備上的大部分資料為加密且無法訪問。 這可能不切實際，因此請考慮權衡這個作法對於自身情況是否有意義。 +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. 重啟後**解鎖設備**之前的狀態稱為“首次解鎖之前”(BFU) ，當設備處於該狀態時，取證鑑識工具[明顯更加困難](https://belkasoft.com/checkm8_glossary)利用漏洞訪問您的資料。 此 BFU 狀態允許您接收電話、簡訊和鬧鐘通知，但設備上的大部分資料為加密且無法訪問。 這可能不切實際，因此請考慮權衡這個作法對於自身情況是否有意義。 diff --git a/i18n/zh-Hant/os/windows/index.md b/i18n/zh-Hant/os/windows/index.md index e9ba4665..1e34b706 100644 --- a/i18n/zh-Hant/os/windows/index.md +++ b/i18n/zh-Hant/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## 隱私筆記 -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/i18n/zh/basics/common-threats.md b/i18n/zh/basics/common-threats.md index 1ca1736b..e39b1b74 100644 --- a/i18n/zh/basics/common-threats.md +++ b/i18n/zh/basics/common-threats.md @@ -189,4 +189,4 @@ If you're concerned about mass surveillance programs, you can use strategies lik [^2]: 维基百科： [监控资本主义](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^3]: 维基百科。 [*监视资本主义*](https://en.wikipedia.org/wiki/Surveillance_capitalism) [^4]: "[Enumerating badness](https://ranum.com/security/computer_security/editorials/dumb)" (or, "listing all the bad things that we know about"), as many content blockers and antivirus programs do, fails to adequately protect you from new and unknown threats because they have not yet been added to the filter list. 你还应该采用其他缓解技术。 -[^5]: 联合国。 [*世界人权宣言》*](https://www.un.org/en/about-us/universal-declaration-of-human-rights)。 +[^5]: United Nations: [*Universal Declaration of Human Rights*](https://un.org/en/about-us/universal-declaration-of-human-rights). diff --git a/i18n/zh/basics/hardware.md b/i18n/zh/basics/hardware.md new file mode 100644 index 00000000..9ef5f632 --- /dev/null +++ b/i18n/zh/basics/hardware.md @@ -0,0 +1,146 @@ +--- +title: Choosing Your Hardware +icon: material/chip +description: Software isn't all that matters; learn about the hardware tools you use every day to protect your privacy. +--- + +When it comes to discussions about privacy, hardware is often not thought about as much as what software we use. Your hardware should be considered the foundation on which you build the rest of your privacy setup. + +## Picking a Computer + +The internals of your devices process and store all of your digital data. It is important that all devices are supported by the manufacturer and developers by continuing to receive security updates. + +### Hardware Security Programs + +Some devices will have a "hardware security program", which is a collaboration between vendors on best practices and recommendations when designing hardware, for example: + +- [Windows Secured-core PCs](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11) meet a higher security criteria specified by Microsoft. These protections aren't only applicable to Windows users; Users of other operating systems can still take advantage of features like [DMA protection](https://learn.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and the ability to completely distrust Microsoft certificates. +- [Android Ready SE](https://developers.google.com/android/security/android-ready-se) is a collaboration between vendors to ensure their devices follow [best practices](https://source.android.com/docs/security/best-practices/hardware) and include tamper resistant hardware backed storage for things like encryption keys. +- macOS running on an Apple SoC takes advantage of [hardware security](../os/macos-overview.md#hardware-security) which may not be available with third party operating systems. +- [ChromeOS security](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper) is at its best when running on a Chromebook as it is able to make use of available hardware features such as the [hardware root-of-trust](https://chromium.org/chromium-os/developer-library/reference/security/security-whitepaper/#hardware-root-of-trust-and-verified-boot). + +Even if you don't use these operating systems, participation in these programs may indicate that the manufacturer is following best practices when it comes to hardware security and updates. + +### Preinstalled OS + +New computers nearly always come with Windows preinstalled, unless you buy a Mac or a specialty Linux machine. It's usually a good idea to wipe the drive and install a fresh copy of your operating system of choice, even if that means just reinstalling Windows from scratch. Due to agreements between hardware vendors and shady software vendors, the default Windows install often comes preloaded with bloatware, [adware](https://bleepingcomputer.com/news/technology/lenovo-gets-a-slap-on-the-wrist-for-superfish-adware-scandal), or even [malware](https://zdnet.com/article/dell-poweredge-motherboards-ship-with-malware). + +### 固件更新 + +Hardware often has security issues that are discovered and patched through firmware updates for your hardware. + +Almost every component of your computer requires firmware to operate, from your motherboard to your storage devices. It is ideal for all the components of your device to be fully supported. Apple devices, Chromebooks, most Android phones, and Microsoft Surface devices will handle firmware updates for you as long as the device is supported. + +If you build your own PC, you may need to manually update your motherboard's firmware by downloading it from your OEM's website. If you use Linux, consider using the built-in [`fwupd`](https://fwupd.org) tool that will let you check for and apply any firmware updates available for your motherboard. + +### TPM/Secure Cryptoprocessor + +Most computers and phones come equipped with a TPM (or a similar secure cryptoprocessor) which safely stores your encryption keys and handles other security-related functions. If you're currently using a machine that doesn't have one of these, you might benefit from purchasing a newer computer that has this feature. Some desktop and server motherboards have a "TPM header" which can accept a small accessory board containing the TPM. + +
+

Note

+ +Virtual TPMs are susceptible to side-channel attacks and external TPMs, as a result of being separate from the CPU on the motherboard, are vulnerable to [sniffing](https://pulsesecurity.co.nz/articles/TPM-sniffing) when an attacker has access to the hardware. The solution to this problem is to include the secure processor inside the CPU itself, which is the case for Apple's chips and Microsoft's [Pluton](https://microsoft.com/en-us/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs). + +
+ +### Biometrics + +Many devices come equipped with a fingerprint reader or face recognition capabilities. These can be very convenient, but they aren't perfect and sometimes fail. Most devices will fall back to a PIN or password when this happens, meaning that the security of your devices is still only as good as your password. + +Biometrics can prevent someone from watching you type in your password, so if shoulder-surfing is part of your threat model then biometrics are a good option. + +Most implementations of face authentication require you to be looking at your phone and also only work from a relatively close distance, so you don't need to worry too much about someone pointing your phone at your face to unlock it without your consent. You can still disable biometrics when your phone is locked if you want. On iOS, you can hold the side button and a volume button for 3 seconds to disable Face ID on models that support it. On Android, hold the power button and press Lockdown on the menu. + +
+

警告

+ +Some devices do not have the proper hardware for secure face authentication. There's two main types of face authentication: 2D and 3D. 3D face authentication makes use of a dot projector that lets the device create a 3D depth map of your face. Make sure that your device has this capability. + +
+ +Android defines three [security classes](https://source.android.com/docs/security/features/biometric/measure#biometric-classes) for biometrics; you should check that your device is Class 3 before enabling biometrics. + +### Device Encryption + +If your device is [encrypted](../encryption.md), your data is most secure when your device is completely powered off (as opposed to merely asleep), i.e. before you've entered your encryption key or lock screen password for the first time. On phones, this state of higher security is referred to as "Before First Unlock" (BFU), and "After First Unlock" (AFU) once you enter the correct password after a reboot/power-on. AFU is considerably less secure against digital forensics toolkits and other exploits, compared to BFU. Therefore, if you are concerned about an attacker with physical access to your device, you should turn it off fully whenever you aren't using it. + +This may be impractical, so consider whether it's worth it, but in either case even AFU mode is effective against most threats, given you are using a strong encryption key. + +## External Hardware + +Some threats can't be protected against by your internal components alone. Many of these options are highly situational; please evaluate if they are really necessary for your threat model. + +### 硬件安全密钥 + +Hardware keys are devices that use strong cryptography to authenticate you to a device or account. The idea is that because they can not be copied, you can use them to secure accounts in such a way that they can only be accessed with physical possession of the key, eliminating many remote attacks. + +[Recommended Hardware Keys :material-arrow-right-drop-circle:](../security-keys.md){ .md-button .md-button--primary } [Learn More about Hardware Keys :material-arrow-right-drop-circle:](multi-factor-authentication.md#hardware-security-keys){ .md-button } + +### Camera/Microphone + +If you don't want to trust your OS's permission controls to prevent the camera from activating in the first place, you can buy camera blockers that physically prevent light from reaching the camera. You could also buy a device that doesn't have a built-in camera and use an external camera that you can unplug whenever you're done using it. Some devices come with built-in camera blockers or hardware switches that physically disconnect the camera from power. + +
+

警告

+ +You should only buy covers that fit your laptop and won't cause damage when you close the lid. Covering the camera will interfere with automatic brightness and face authentication features. + +
+ +For microphone access, in most cases you will need to trust your OS's built-in permission controls. Alternatively, buy a device that doesn't have a built-in microphone and use an external microphone that you can unplug when you're done using it. Some devices, like a [MacBook or an iPad](https://support.apple.com/guide/security/hardware-microphone-disconnect-secbbd20b00b/web), feature a hardware disconnect for the microphone when you close the lid. + +Many computers have a BIOS option to disable the camera and microphone. When disabled there, the hardware won't even appear as a device on a booted system. + +### Privacy Screens + +Privacy screens are a film you can put over your normal screen so that the screen is only visible from a certain angle. These are good if your threat model includes others peeking at your screen, but it is not foolproof as anyone could just move to a different viewing angle and see what's on your screen. + +### Dead Man's Switches + +A dead man's switch stops a piece of machinery from operating without the presence of a human operator. These were originally designed as a safety measure, but the same concept can be applied to an electronic device to lock it when you're not present. + +Some laptops are able to [detect](https://support.microsoft.com/en-us/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb) when you're present and can lock automatically when you aren't sitting in front of the screen. You should check the settings in your OS to see if your computer supports this feature. + +You can also get cables, like [Buskill](https://buskill.in), that will lock or wipe your computer when the cable is disconnected. + +### Anti-Interdiction/Evil Maid Attack + +The best way to prevent a targeted attack against you before a device is in your possession is to purchase a device in a physical store, rather than ordering it to your address. + +Make sure your device supports secure boot/verified boot, and you have it enabled. Try to avoid leaving your device unattended whenever possible. + +## Secure your Network + +### Compartmentalization + +Many solutions exist that allow you to separate what you're doing on a computer, such as virtual machines and sandboxing. However, the best compartmentalization is physical separation. This is useful especially for situations where certain software requires you to bypass security features in your OS, such as with anti-cheat software bundled with many games. + +For gaming, it may be useful to designate one machine as your "gaming" machine and only use it for that one task. Keep it on a separate VLAN. This may require the use of a managed switch and a router that supports segregated networks. + +Most consumer routers allow you to do this by enabling a separate "guest" network that can't talk to your main network. All untrusted devices can go here, including IoT devices like your smart fridge, thermostat, TV, etc. + +### Minimalism + +As the saying goes, "less is more". The fewer devices you have connected to your network, the less potential attack surface you'll have and the less work it will be to make sure they all stay up-to-date. + +You may find it useful to go around your home and make a list of every connected device you have to help you keep track. + +### Routers + +Your router handles all your network traffic and acts as your first line of defense between you and the open internet. + +
+

Note

+ +A lot of routers come with storage to put your files on so you can access them from any computer on your network. We recommend you don't use networking devices for things other than networking. In the event your router was compromised, your files would also be compromised. + +
+ +The most important thing to think about with routers is keeping them up-to-date. Many modern routers will automatically install updates, but many others won't. You should check on your router's settings page for this option. That page can usually be accessed by typing `192.168.1.1` or `192.168.0.1` into the URL bar of any browser assuming you're on the same network. You can also check in the network settings of your OS for "router" or "gateway". + +If your router does not support automatic updates, you will need to go to the manufacturer's site to download the updates and apply them manually. + +Many consumer-grade routers aren't supported for very long. If your router isn't supported by the manufacturer anymore, you can check if it's supported by [FOSS firmware](../router.md). You can also buy routers that come with FOSS firmware installed by default; these tend to be supported longer than most routers. + +Some ISPs provide a combined router/modem. It can be beneficial for security to purchase a separate router and set your ISP router/modem into modem-only mode. This way, even when your ISP-provided router is no longer getting updates, you can still get security updates and patches. It also means any problems that affect your modem won't affect your router and vice versa. diff --git a/i18n/zh/desktop-browsers.md b/i18n/zh/desktop-browsers.md index 59c0ea9a..6879e47c 100644 --- a/i18n/zh/desktop-browsers.md +++ b/i18n/zh/desktop-browsers.md @@ -282,11 +282,7 @@ Brave adds a "[referral code](https://github.com/brave/brave-browser/wiki/Brave% -#### Settings - - - -##### 盾 +#### 盾 Brave includes some anti-fingerprinting measures in its [Shields](https://support.brave.com/hc/articles/360022973471-What-is-Shields) feature. We suggest configuring these options [globally](https://support.brave.com/hc/articles/360023646212-How-do-I-configure-global-and-site-specific-Shields-settings) across all pages that you visit. @@ -294,7 +290,6 @@ Shields的选项可以根据需要在每个站点的基础上进行降级，但
-- [x] Select **Prevent sites from fingerprinting me based on my language preferences** - [x] Select **Aggressive** under *Trackers & ads blocking*
@@ -307,6 +302,7 @@ Brave allows you to select additional content filters within the internal `brave - [x] Select **Strict** under *Upgrade connections to HTTPS* - [x] (Optional) Select **Block Scripts** (1) - [x] Check **Block fingerprinting** +- [x] Select **Block third-party cookies** - [x] Check **Forget me when I close this site** (2) - [ ] Uncheck all social media components @@ -317,46 +313,62 @@ Brave allows you to select additional content filters within the internal `brave -##### Privacy and security +#### Privacy and security
+- [x] Select **Don't allow sites to use the V8 optimizer** under *Security* → *Manage V8 security* (1) +- [x] Select **Automatically remove permissions from unused sites** under *Sites and Shields Settings* - [x] Select **Disable non-proxied UDP** under [WebRTC IP Handling Policy](https://support.brave.com/hc/articles/360017989132-How-do-I-change-my-Privacy-Settings#webrtc) - [ ] Uncheck **Use Google services for push messaging** -- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** -- [ ] Uncheck **Automatically send daily usage ping to Brave** -- [ ] Uncheck **Automatically send diagnostic reports** -- [ ] Uncheck **Private window with Tor** (1) +- [x] Select **Auto-redirect AMP pages** +- [x] Select **Auto-redirect tracking URLs** +- [x] Select **Prevent sites from fingerprinting me based on my language preferences**
-1. Brave 对指纹的抵抗力**不如** Tor 浏览器，而且使用 Brave 的 Tor 功能的人要少得多，所以你的指纹会突出。 Where [strong anonymity is required](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) use the [Tor Browser](tor.md#tor-browser). +1. Disabling the V8 optimizer reduces your attack surface by disabling [*some*](https://grapheneos.social/@GrapheneOS/112708049232710156) parts of JavaScript Just-In-Time (JIT) compilation.

Sanitizing on close

-- [x] In the *Sites and Shields Settings* menu, under Content, after clicking on the *On-device site data* menu, select **Delete data sites have saved to your device when you close all windows**. +- [x] Select **Delete data sites have saved to your device when you close all windows** under *Sites and Shields Settings* → *Content* → *Additional content settings* → *On-device site data*. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis under the *Customized behaviors* section.
-##### Extensions +##### Tor windows -- [ ] Uncheck all built-in extensions you do not use +[**Private Window with Tor**](https://support.brave.com/hc/articles/360018121491-What-is-a-Private-Window-with-Tor-Connectivity) allows you to route your traffic through the Tor network in Private Windows and access .onion services, which may be useful in some cases. However, Brave is **not** as resistant to fingerprinting as the Tor Browser and far fewer people use Brave with Tor, so you will stand out. If your threat model requires strong anonymity, use the [Tor Browser](tor.md#tor-browser). -##### Web3 +##### Data Collection -Brave 的 Web3 功能可能会增加浏览器指纹和攻击面。 如果您不使用这些功能，应将其禁用。 +- [ ] Uncheck **Allow privacy-preserving product analytics (P3A)** +- [ ] Uncheck **Automatically send daily usage ping to Brave** +- [ ] Uncheck **Automatically send diagnostic reports** -- Select **Extensions (no fallback)** under *Default Ethereum wallet* and *Default Solana wallet* + + +#### Web3 + +Brave 的 Web3 功能可能会增加浏览器指纹和攻击面。 Unless you use any of these features, they should be disabled. + +- Select **Extensions (no fallback)** under *Default Ethereum wallet* +- Select **Extensions (no fallback)** under *Default Solana wallet* - Set *Method to resolve IPFS resources* to **Disabled** -##### System +#### Extensions + +- [ ] Uncheck all built-in extensions you don't use + + + +#### System
diff --git a/i18n/zh/os/ios-overview.md b/i18n/zh/os/ios-overview.md index 06b06572..7a9caea5 100644 --- a/i18n/zh/os/ios-overview.md +++ b/i18n/zh/os/ios-overview.md @@ -227,4 +227,4 @@ Apple always makes beta versions of iOS available early for those that wish to h ### Before First Unlock -If your threat model includes forensic tools and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. +If your threat model includes forensic tools, and you want to minimize the chance of exploits being used to access your phone, you should restart your device frequently. The state *after* a reboot but *before* unlocking your device is referred to as "Before First Unlock" (BFU), and when your device is in that state it makes it [significantly more difficult](https://belkasoft.com/checkm8_glossary) for forensic tools to exploit vulnerabilities to access your data. This BFU state allows you to receive notifications for calls, texts, and alarms, but most of the data on your device is still encrypted and inaccessible. This can be impractical, so consider whether these trade-offs make sense for your situation. diff --git a/i18n/zh/os/windows/index.md b/i18n/zh/os/windows/index.md index a558c66b..8217591b 100644 --- a/i18n/zh/os/windows/index.md +++ b/i18n/zh/os/windows/index.md @@ -26,7 +26,7 @@ This section is a work in progress, because it takes considerably more time and ## Privacy Notes -Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://www.theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. +Microsoft Windows, particularly those versions aimed at consumers like the **Home** version often don't prioritize privacy friendly features by [default](https://theguardian.com/technology/2015/jul/31/windows-10-microsoft-faces-criticism-over-privacy-default-settings). As a result we often see more [data collection](https://en.wikipedia.org/wiki/Criticism_of_Microsoft#Telemetry_and_data_collection) than necessary, without any real warnings that this is the default behavior. In an attempt to compete with Google in the advertising space, [Cortana](https://en.wikipedia.org/wiki/Cortana_\(virtual_assistant\)) has included unique identifiers such as an "advertising ID" in order to correlate usage and assist advertisers in targeted advertising. At launch, telemetry could not be disabled in non-enterprise editions of Windows 10. It still cannot be disabled, but Microsoft added the ability to [reduce](https://www.extremetech.com/computing/243079-upcoming-windows-update-reduces-spying-microsoft-still-mum-data-collects) the data that is sent to them. With Windows 11 there are a number of restrictions or defaults such as: diff --git a/includes/abbreviations.ar.txt b/includes/abbreviations.ar.txt index 3eae37dd..5b5b9bbe 100644 --- a/includes/abbreviations.ar.txt +++ b/includes/abbreviations.ar.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.bn-IN.txt b/includes/abbreviations.bn-IN.txt index b093015a..93195bd3 100644 --- a/includes/abbreviations.bn-IN.txt +++ b/includes/abbreviations.bn-IN.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.bn.txt b/includes/abbreviations.bn.txt index c7fcc13e..26535764 100644 --- a/includes/abbreviations.bn.txt +++ b/includes/abbreviations.bn.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.cs.txt b/includes/abbreviations.cs.txt index 48528b31..4f7085e8 100644 --- a/includes/abbreviations.cs.txt +++ b/includes/abbreviations.cs.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtuální privátní síť +*[VLAN]: Virtual Local Area Network *[VoIP]: Hlas přes IP (internetový protokol) *[W3C]: Konsorcium World Wide Web *[XMPP]: Rozšiřitelný protokol pro posílání zpráv a zjištění stavu diff --git a/includes/abbreviations.de.txt b/includes/abbreviations.de.txt index 449d8c91..b3f2b661 100644 --- a/includes/abbreviations.de.txt +++ b/includes/abbreviations.de.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtuelles Privates Netzwerk +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.el.txt b/includes/abbreviations.el.txt index d54f9b03..5853f227 100644 --- a/includes/abbreviations.el.txt +++ b/includes/abbreviations.el.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol (ελληνιστί: Πρωτόκολλο Δεδομενογράμματος Χρήστοντος) *[VPN]: Εικονικό Ιδιωτικό Δίκτυο +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over Internet Protocol (ελληνιστί: Φωνή επί Διαδικτυακού Πρωτοκόλλου) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.eo.txt b/includes/abbreviations.eo.txt index b093015a..93195bd3 100644 --- a/includes/abbreviations.eo.txt +++ b/includes/abbreviations.eo.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.es.txt b/includes/abbreviations.es.txt index 85732ee1..9dbfb0b8 100644 --- a/includes/abbreviations.es.txt +++ b/includes/abbreviations.es.txt @@ -94,6 +94,7 @@ *[UEFI]: Interfaz de Firmware Extensible Unificada *[UDP]: Protocolo de Datagramas de Usuario *[VPN]: Red Privada Virtual +*[VLAN]: Virtual Local Area Network *[VoIP]: Voz sobre IP (Protocolo de Internet) *[W3C]: Consorcio World Wide Web *[XMPP]: Protocolo Extensible de Mensajería y Presencia diff --git a/includes/abbreviations.fa.txt b/includes/abbreviations.fa.txt index 00afda1a..a1470c5c 100644 --- a/includes/abbreviations.fa.txt +++ b/includes/abbreviations.fa.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.fr.txt b/includes/abbreviations.fr.txt index 1910b5ea..e96b0119 100644 --- a/includes/abbreviations.fr.txt +++ b/includes/abbreviations.fr.txt @@ -94,6 +94,7 @@ *[UEFI]: Interface micrologicielle extensible unifiée *[UDP]: Protocole de datagramme utilisateur *[VPN]: Réseau privé virtuel +*[VLAN]: Virtual Local Area Network *[VoIP]: Voix sur IP (protocole internet) *[W3C]: Consortium World Wide Web *[XMPP]: Protocole extensible de messagerie et de présence diff --git a/includes/abbreviations.he.txt b/includes/abbreviations.he.txt index d0eb7786..5b495ea3 100644 --- a/includes/abbreviations.he.txt +++ b/includes/abbreviations.he.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: פרוטוקול יחידת נתונים של משתמש *[VPN]: רשת וירטואלית פרטית +*[VLAN]: Virtual Local Area Network *[VoIP]: קול על IP (פרוטוקול אינטרנט) *[W3C]: קונסורציום האינטרנט העולמי *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.hi.txt b/includes/abbreviations.hi.txt index b093015a..93195bd3 100644 --- a/includes/abbreviations.hi.txt +++ b/includes/abbreviations.hi.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.hu.txt b/includes/abbreviations.hu.txt index 2d5cb673..1634f718 100644 --- a/includes/abbreviations.hu.txt +++ b/includes/abbreviations.hu.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network - Virtuális Privát Hálózat +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.id.txt b/includes/abbreviations.id.txt index 5c1be835..c6f3d1c8 100644 --- a/includes/abbreviations.id.txt +++ b/includes/abbreviations.id.txt @@ -94,6 +94,7 @@ *[UEFI]: Antarmuka Firmware yang Dapat Diperluas Terpadu *[UDP]: Protokol Datagram Pengguna *[VPN]: Jaringan Pribadi Virtual +*[VLAN]: Virtual Local Area Network *[VoIP]: Suara melalui IP (Protokol Internet) *[W3C]: Konsorsium Waring Wera Wanua *[XMPP]: Protokol Perpesanan dan Kehadiran yang Dapat Diperluas diff --git a/includes/abbreviations.it.txt b/includes/abbreviations.it.txt index 37b29ec2..171f125f 100644 --- a/includes/abbreviations.it.txt +++ b/includes/abbreviations.it.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Rete virtuale privata +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.ja.txt b/includes/abbreviations.ja.txt index 42bc1d8d..118f7a46 100644 --- a/includes/abbreviations.ja.txt +++ b/includes/abbreviations.ja.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: ユーザーデータグラムプロトコル（User Datagram Protocol） *[VPN]: 仮想プライベートネットワーク（Virtual Private Network） +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP *[W3C]: ワールド・ワイド・ウェブ・コンソーシアム（World Wide Web Consortium） *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.ko.txt b/includes/abbreviations.ko.txt index cfa73f0e..3368cd0e 100644 --- a/includes/abbreviations.ko.txt +++ b/includes/abbreviations.ko.txt @@ -94,6 +94,7 @@ *[UEFI]: 통합 확장 펌웨어 인터페이스(Unified Extensible Firmware Interface) *[UDP]: 사용자 데이터그램 프로토콜 *[VPN]: 가상 사설망(Virtual Private Network) +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.ku-IQ.txt b/includes/abbreviations.ku-IQ.txt index b093015a..93195bd3 100644 --- a/includes/abbreviations.ku-IQ.txt +++ b/includes/abbreviations.ku-IQ.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.nl.txt b/includes/abbreviations.nl.txt index 934550b6..0ed00a26 100644 --- a/includes/abbreviations.nl.txt +++ b/includes/abbreviations.nl.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.pl.txt b/includes/abbreviations.pl.txt index 3cfcb5b6..b38a22e8 100644 --- a/includes/abbreviations.pl.txt +++ b/includes/abbreviations.pl.txt @@ -94,6 +94,7 @@ *[UEFI]: Zunifikowany rozszerzalny interfejs oprogramowania układowego *[UDP]: Protokół pakietów użytkownika *[VPN]: Wirtualna sieć prywatna +*[VLAN]: Virtual Local Area Network *[VoIP]: Przesyłanie dźwięku za pomocą łącza internetowego *[W3C]: Konsorcjum World Wide Web *[XMPP]: Rozszerzalny protokół przesyłania wiadomości i statusu diff --git a/includes/abbreviations.pt-BR.txt b/includes/abbreviations.pt-BR.txt index dacf8e11..742f61f9 100644 --- a/includes/abbreviations.pt-BR.txt +++ b/includes/abbreviations.pt-BR.txt @@ -94,6 +94,7 @@ Caraterística digital herdada: Legado Digital refere-se a recursos que permitem *[UEFI]: Interface Unificada de Firmware Extensível *[UDP]: Protocolo do Datagrama do Usuário *[VPN]: Rede Privada Virtual +*[VLAN]: Virtual Local Area Network *[VoIP]: Voz por IP (Protocolo de Internet) *[W3C]: Consórcio World Wide Web *[XMPP]: Protocolo de Mensagens e Presença Extensível diff --git a/includes/abbreviations.pt.txt b/includes/abbreviations.pt.txt index 49d08fa1..9e228d01 100644 --- a/includes/abbreviations.pt.txt +++ b/includes/abbreviations.pt.txt @@ -94,6 +94,7 @@ *[UEFI]: Interface de Firmware Extensível Unificada *[UDP]: Protocolo de Datagrama do Utilizador *[VPN]: Rede virtual privada +*[VLAN]: Virtual Local Area Network *[VoIP]: Voz sobre IP (Protocolo Internet) *[W3C]: Consórcio da World Wide Web *[XMPP]: Protocolo Extensível de Mensagens e Presença diff --git a/includes/abbreviations.ru.txt b/includes/abbreviations.ru.txt index e773f780..78999678 100644 --- a/includes/abbreviations.ru.txt +++ b/includes/abbreviations.ru.txt @@ -94,6 +94,7 @@ *[UEFI]: Интерфейс между операционной системой и микропрограммами *[UDP]: Протокол пользовательских датаграмм *[VPN]: Виртуальная частная сеть +*[VLAN]: Virtual Local Area Network *[VoIP]: Передача голоса по IP (интернет-протокол) *[W3C]: Консорциум всемирной паутины *[XMPP]: Расширяемый протокол обмена сообщениями и информацией о присутствии diff --git a/includes/abbreviations.sv.txt b/includes/abbreviations.sv.txt index 0f791edd..73edf4d4 100644 --- a/includes/abbreviations.sv.txt +++ b/includes/abbreviations.sv.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware-gränssnitt *[UDP]: Användardatagramprotokoll *[VPN]: Virtuella privata servrar +*[VLAN]: Virtual Local Area Network *[VoIP]: Röst över IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Utökningsbart meddelande- och närvaroprotokoll diff --git a/includes/abbreviations.tr.txt b/includes/abbreviations.tr.txt index 7206a95a..4c9f9716 100644 --- a/includes/abbreviations.tr.txt +++ b/includes/abbreviations.tr.txt @@ -94,6 +94,7 @@ *[UEFI]: Birleşik Genişletilebilir Üretici Yazılımı Arabirimi *[UDP]: Kullanıcı Veri Birimi Protokolü *[VPN]: Sanal Özel Ağ +*[VLAN]: Virtual Local Area Network *[VoIP]: IP üzerinden Ses (İnternet Protokolü) *[W3C]: Dünya Çapında Ağ Konsorsiyumu *[XMPP]: Genişletilebilir Mesajlaşma ve Varlık Protokolü diff --git a/includes/abbreviations.uk.txt b/includes/abbreviations.uk.txt index 782dd4a1..9aeded30 100644 --- a/includes/abbreviations.uk.txt +++ b/includes/abbreviations.uk.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.vi.txt b/includes/abbreviations.vi.txt index b093015a..93195bd3 100644 --- a/includes/abbreviations.vi.txt +++ b/includes/abbreviations.vi.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol diff --git a/includes/abbreviations.zh-Hant.txt b/includes/abbreviations.zh-Hant.txt index 9263dc5b..e7b1f94b 100644 --- a/includes/abbreviations.zh-Hant.txt +++ b/includes/abbreviations.zh-Hant.txt @@ -94,6 +94,7 @@ *[UEFI]: 整合可延伸韌體介面 *[UDP]: 用戶資料圖報協議 *[VPN]: 虛擬私密連線 +*[VLAN]: Virtual Local Area Network *[VoIP]: IP語音(Internet通訊協定) *[W3C]: 全球資訊網協會 *[XMPP]: 可延伸傳訊與顯示通訊協定 diff --git a/includes/abbreviations.zh.txt b/includes/abbreviations.zh.txt index 5201100c..0776e614 100644 --- a/includes/abbreviations.zh.txt +++ b/includes/abbreviations.zh.txt @@ -94,6 +94,7 @@ *[UEFI]: Unified Extensible Firmware Interface *[UDP]: User Datagram Protocol *[VPN]: Virtual Private Network +*[VLAN]: Virtual Local Area Network *[VoIP]: Voice over IP (Internet Protocol) *[W3C]: World Wide Web Consortium *[XMPP]: Extensible Messaging and Presence Protocol